On Thu, 2008-01-31 at 23:29 +0530, Yogesh Patil wrote: > hi, > I am using SQUID 2.6.STABLE17 with fedora core 8, & BIND > DNS SERVER configured on the same box, i have configured squid as > transparent proxy with all default settings , and applied iptables > rule by using the following > command > > iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT > --to-port 3128 > > i am able to browse http websites, but when i try to open https > sites, such as, gmail.com, hotmail.com etc.. i am not able to get any > response from the proxy. > i have also tryied with forwarding 443 (https) port to the 3128 > (squid) port but still no success., so i think it doesnt seems to be > netfilter (iptables) problem, it may be problem with the squid > config, Port forwarding isn't the answer. What have you done to enable the SSL proxying in the Squid configuration? Why are you trying to proxy HTTPS? If you're trying to cache it, you're violating security, and I don't think it's going to let you do that. Secure web browsing really needs *NO* man in the middle. But if you're tunnelling SSL through Squid (uncached proxying), that's a different matter (still a security risk to those wanting to use secure websites through your proxy, not always done, but technically feasible). The last time I set up Squid, was with FC4, so it's an older version, and options may have changed since then. But you have to go through the ACL rules, list the ports used for SSL, and add them to the safe ports rule. And allow the safe and SSL ports through the access rules. Snippets from my configuration: acl SSL_ports port 443 563 acl Safe_ports port 443 563 # https, snews http_access deny !Safe_ports http_access deny CONNECT !SSL_ports Don't confuse yourself with the SSL accelerator configuration, that's for using Squid to aid your own secure webserver, if you have one. Have you looked at: http://www.squid-cache.org/ -- (This computer runs FC7, my others run FC4, FC5 & FC6, in case that's important to the thread.) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
