SSL Man In the Middle Filtering blocking any app

reza3sw

This is a very big problem that I have been asking over and over again, but nobody could answer it. Perhaps this is a pfsense problem that could not solve it ... I had this problem with the https://trello.com site and it was a problem. I put in the bypass, but other apps can not be done
If we put all the programs in the bypass, then this pfsense part is not applicable ... This is still a problem, and it's a problem for administrators and those who can solve this problem. Please provide a solution.

Also, there are other problems, such as openconnect, in Linux and the ubuntu terminal with port 443, and even sites and applications that need access to the server through the IP do not work.

Generally speaking, when the pfsense and MITM proxy server is used, everything is cut off and users become very dissatisfied.

aGeekhere

https://forum.netgate.com/topic/100342/guide-to-filtering-web-content-http-and-https-with-pfsense-2-3/166

Read the last few comments

reza3sw

Thanks but
I set manualy proxy and port in android phone..but didn't work any app

And define rule in NAT port forward
80 and 443 redirect to pfsense lan address port 3128

But not work any app

Derelict

Many believe that HTTPS MITM is an unsound practice if not immoral. Personally, I am one of them.

When you click transparent proxy you automatically get a port forward on the squid interfaces that forwards all port 80 traffic to 3128.

If you also check HTTPS you also get a port forward for port 443 traffic to port 3129.

Those are the default ports.

If you set the clients manually you do not need port forwards and should disable transparent mode.

Everything you should need is here:

https://www.youtube.com/watch?v=xm_wEezrWf4

reza3sw

Thanks for your good answer ... The things you said are true, but the problem with Internet access is that the smartphone apps are still up to date with MITM...
But when I use MITM - splice all ...any app work correctly

I also believe that https MITM is not applicable ... but where need control bandwidth through squid...

Derelict

Splice all is not MITM.

reza3sw

... I mean, in Man in the middle, enable the splice all option, the problem is resolved, but the monitoring on 443 is not complete.

Derelict

This post is deleted!

reza3sw

I searched on other sites that are related to squid.
This problem has been reported by squid users but no solutions have been made

Has anyone had this problem? Has it resolved?

reggie14

Android apps, by default, don't trust roots installed by the user/admin. This security feature was added in Android N.

reza3sw

Thanks
There is no solution right now?

Gertjan

The MITM "problem" will probably never get solved.

reza3sw

@gertjan said in SSL Man In the Middle Filtering blocking any app:

The MITM "problem" will probably never get solved.

Thank you very much