Question

我正在尝试使用squid代理将我的Raspberry pi设置为WiFi接入点。连接到AP（wlan0）的所有用户都将从eth0

获得互联网

当我使用代理192.168.0.1配置浏览器时：3128可以访问所有http和https站点

现在我以透明模式设置了一个Squid。此时只能访问HTTP。 HTTPS站点未打开

错误：SSL连接错误

请查找日志和配置示例

Iptables的

-A PREROUTING -i wlan0 -p tcp -m tcp --dport 21 -j REDIRECT --to-ports 3128
-A PREROUTING -i wlan0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i wlan0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128

鱿鱼

#Access List
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl home_network src 192.168.0.0/24
acl guest_network src 192.168.1.0/24
acl guest_network src 192.168.169.0/24


#Ports allowed through Squid
acl Safe_ports port 80 #http
acl Safe_ports port 443 #https
acl SSL_ports port 443
acl SSL method CONNECT
acl CONNECT method CONNECT

#allow/deny
http_access allow localhost
http_access allow home_network
http_access allow guest_network
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all

#proxy ports
visible_hostname proxy
#http_port 3128 transparent
http_port 3128 intercept
http_port 8080

#caching directory
cache_dir ufs /cache/squid 2048 16 128
cache_mem 1024 MB

#refresh patterns for caching static files
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private
refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-cache ignore-no-store ignore-private
refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private
refresh_pattern -i \.index.(html|htm)$ 0 40% 10080
refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern . 0 40% 40320

鱿鱼日志

1438333207.745      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html
1438333207.749      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html
1438333207.753      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html
1438333207.789      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html
1438333207.803      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html
1438333210.190      1 192.168.0.10 NONE/400 4000 NONE error:invalid-request - NONE/- text/html

Answer 1

您正尝试将端口443上的CONNECT / HTTPS请求转发到截获的http_port。如果我更正，拦截模式中定义的http_port将只提供http流量，而不是https

在squid配置中，在拦截/透明模式下定义https_port并将您的443端口转发到该https_port。

这可能会解决您的问题。

您可能必须使用https拦截/透明模式的证书，创建证书并告诉squid碰撞虚拟域。

该https端口中的所有其他流量都将被覆盖，没有任何冲突

HTTPS站点无法在Squid透明模式下工作

1 个答案: