Squid + Virtual IP. HTTPS won't work

stramato

Here's my config

pfSense
LAN's Real Interface IP: 192.168.1.1/22
Virtual IP1: 10.1.1.1/24

Client PC
LAN IP: 10.1.1.2/24

The client cannot access HTTPS websites (connection timeout). Normal HTTP is OK.

Squid is set to Transparent.

What seems to be the problem here?

jimp

You cannot transparently proxy HTTPS connections.

rds_correia

Are you sure, jimp?
I have squid set to transparent and my clients can open https sites.
I'm confused ???
Cheers

dvserg

@rds_correia:

Are you sure, jimp?
I have squid set to transparent and my clients can open https sites.
I'm confused ???
Cheers

Transparent Squid firewall rules direct 80 port requests to the squid proxy. But https use 443 port.

jimp

@rds_correia:

Are you sure, jimp?
I have squid set to transparent and my clients can open https sites.
I'm confused ???
Cheers

Sure you can get to https sites, but they aren't going through the proxy :-)

rds_correia

@jimp:

Sure you can get to https sites, but they aren't going through the proxy :-)

Serious? That would explain this.
Is there any way around this issue?
Cheers

jimp

I replied on your other thread since it's not strictly relevant to this one.

stramato

I also just figured this out. By default, HTTPS bypasses Transparent Squid.

With "normal" configuration, pfSense does this automatically (send all HTTP to Squid, bypass Squid when HTTPS).

But in special cases such as mine (I have a LAN Virtual IP in a different subnet), you have to manually tell pfSense to Outbound NAT HTTPS traffic to a WAN from the LAN Virtual IP, or else, it will try to contact the "real" IP, which it cannot reach because the Virtual IP is in a different subnet from the real IP.

Automatic Outbound NAT only configures the "real" IP of an interface, not Virtual IP's.

XIII

As stated in the docs, you can proxy https and other traffic through squid but you must tell each program about the proxy, because if you tried to transparently proxy https traffic you would get security warnings.