Connect to remote proxy server with RSA private key

[tigs]

Hello all

I am just learning to set up a proxy server on the amazon cloud. It was debian 10 and tinyproxy. The server was setup requiring RSA private key. Is there a way I can setup my pfsense box to connect to the server so that all the computers behind the firewall will go through the proxy?

I can set up my windows machine easily by just using the IP and port under /settings/network/proxy. It works perfectly. However, on the pfsense box, under /system/advanced/miscellaneous: the proxy setup would require username and password. I tried to leave that blank, just input the IP and port. It did not seem to work. I mean the computers behind the pfsense box still has my ISP IP.

I have two LAN interfaces. If this is possible, can I set it up in a way so that only one interfaces go through proxy, the other one still through the ISP IP?

Thanks a lot.

[stephenw10]

An http proxy? Including https?

That value in Advanced setting is only for traffic from the firewall itself, for firmware updates etc.

You would have to route client traffic via the proxy but it's probably going to fail. Better to just configure clients behind the firewall to use it directly.

Steve

[tigs]

@stephenw10 said in Connect to remote proxy server with RSA private key:

An http proxy? Including https?

That value in Advanced setting id only for traffic from the firewall itself, for firmware updates etc.

You would have to route client traffic via the proxy but it's probably going to fail. Better to just configure clients behind the firewall to use it directly.

Steve

Thanks Steve!

At the moment I was just trying to see if I can get this to work. So it doesn't matter it is http or https.

Sound like it is not possible. At least I know the answer and will stop spending time getting it to work.

Some of the devices does not have setting for proxy, e.g. the smart TV. I guess I will have to live with that.

I was trying to switch from a VPN service provider to a proxy server as the openvpn is way too slow. I can only get 5% of my ISP speed.

Anyway.

Thanks for your help.

[stephenw10]

Like 50Mbps out of 1G? Almost anything should be faster than that.

You can use a proxy you just have to set the clients to use it. Otherwise it has to be a transparent proxy with all the SSL problems that implies.

Steve

[tigs]

@stephenw10 said in Connect to remote proxy server with RSA private key:

Like 50Mbps out of 1G? Almost anything should be faster than that.

You can use a proxy you just have to set the clients to use it. Otherwise it has to be a transparent proxy with all the SSL problems that implies.

Steve

you are right 50Mb out of 1G. I think I am done with openvpn after many years. It just started to slow down and drop connection from time to time. I used to have good experience with it, getting 200Mb out of 1G. PIA is unable to solve the problem.

is there an instruction of setting up the upstream proxy with SSL? I just want to give it try. I seem to be able to follow all the squid and SSL stuff, just can never find where to input the upstream proxy IP and port stuff.

What about SOCKS5 proxy? Shadowsocks? PIA offers both of this. also want to give those a try if possible?

I was looking at other firewalls. ipfire has specifically places you can enter upstream proxy IP and port.

R
thanks

[stephenw10]

You can enter it in Sys > Adv > Misc but only for traffic from the firewall itself. Doing that means the firewall knows it's going via a proxy and accepts the SSL cert from there. Otherwise it will reject the cert as being not the expected site as any other client would.

50Mbps is pretty slow though. If your hardware is even vaguely capable you should see far more than that.
If you're running you own proxy in AWS you can also run your own VPN server. Since you control both ends you can optimise it easily. You could use IPSec.

Steve

[tigs]

@stephenw10 said in Connect to remote proxy server with RSA private key:

You can enter it in Sys > Adv > Misc but only for traffic from the firewall itself. Doing that means the firewall knows it's going via a proxy and accepts the SSL cert from there. Otherwise it will reject the cert as being not the expected site as any other client would.

50Mbps is pretty slow though. If your hardware is even vaguely capable you should see far more than that.
If you're running you own proxy in AWS you can also run your own VPN server. Since you control both ends you can optimise it easily. You could use IPSec.

Steve

Hi Steve,

following your pointer, I have been trying to play with IPsec with AWS. I have setup an IPsec server, and I am able to configure my desktop PC (win 10) or synology NAS to connect to it without any issues. However, I would like to conect my pfsense box to it so all local devices go through the same tunnel without having to configure them individually. I want my pfsense box work the same way as it does with VPN client. Can I accomplish this, configuring the pfsense as a Ipsec client?

I have the following info available and nothing more:
Server IP:
IPsec PSK:
Username:
Password:

Here is the link I followed to setup the IPsec server on a ubuntu server
link text

if not, are there any other platforms that would allow this configuration?

Thanks and happy New Year!

[stephenw10]

Those scripts appear to be aimed at setting up a remote access / mobile ipsec style server and pfSense cannot act as a mobile client.
You want to be setting up a site-to-site style IPSec server.

The only problem is that if you use a policy based tunnel it will have to cover any destination so will be an all or nothing option.
If you use route based IPSec you can policy route traffic over it so be a lot more selective.

If it were me I would run pfSense in AWS too. That gives you the most options and the easiest setup.

Steve

[tigs]

@stephenw10 said in Connect to remote proxy server with RSA private key:

Those scripts appeat to be aimed at setting up a remote access / mobile ipsec style server and pfSense cannot act as a mobile client.
You want to be setting up a site-to-site style IPSec server.

The only problem is that if you use a policy based tunnel it will have to cover any destination so will be an all or nothing option.
If you use route based IPSec you can policy route traffic over it so be a lot more selective.

If it were me I would run pfSense in AWS too. That gives you the most options and the easiest setup.

Steve

thank you steve for pointing to the directions.

will do further research.