Hi,
I have a squid server configured as transparent proxy.
squid.conf:
https://pastebin.com/rP6m4mNU
I configure the websites I want to make redirection for in /usr/lib/squid/fixhtml.sh - Looks something like this:
s@/test.mydomain.com/@/192.168.30.30:9665/@;
So if I point test.mydomain.com to my squid external IP, it will redirect all connections to 192.168.30.30:9665.
the current state is working fine, if I go to http://test.mydomain.com& https://test.mydomain.com it's working.
Now, I created a new squid, with the same configurations, I pointed test.mydomain.com to the new squid external IP..
http://test.mydomain.com is working, but https://test.mydomain.com gives the error:
Secure Connection Failed - Error code: SSL_ERROR_RX_RECORD_TOO_LONG
from access.log I found this error:
HTTP/1.1" 403 1552 "-" "-" TCP_DENIED:NONE
I did read that squid cannot handle HTTPS traffic, so my question is, how does it work with the old squid?
I suppose the last sysadmins did some configuration I'm not aware of...
I'm really lost, I don't understand what I'm missing..
Thanks!
Edit: iptables rules from working squid:
https://pastebin.com/psgyRf4G ( I cloned the working squid and replaced all the IP's to the right one, Still not working ).
Edit 2:
I found a rule on our pfsense firewall ( Configured as gateway for the working squid ):
https://i.imgur.com/RAsBYCm.png
WebExternal is the external IP of the squid.
sq01webp is the internal IP of the squid.
Edit 3:
I found another interesting routing commands under /etc/network/if-up.d/routing
https://pastebin.com/gf1d7TCh
Edit 4:
Seems to be working now, I found out that the routing commands '/etc/network/if-up.d/routing' are not even in use.
the squid configuration was fine, I just had to fix those iptables rules on my squid gateway firewall:
-A PREROUTING -d EXTERNALIP/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.30.66
-A PREROUTING -d EXTERNALIP/32 -i eth+ -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.30.90:1080
-A FORWARD -d 192.168.30.90/32 -p tcp -m tcp --dport 1080 -j ACCEPT
-A FORWARD -s 192.168.30.90/32 -p tcp -m tcp --sport 1080 -j ACCEPT