Member Avatar for Bheeman89

Hello Daniweb.

I have an issue here about my LAN network. I want to redirect all the web traffic that is happening in my LAN to a proxy server before it reaches the router and the Internet. Now, my infrastructure is like this where client makes request, request go through switch and straight to router & internet. Now I want to enforce where whatever request being made would go through switch > proxy server > router > internet. Is this possible. This is a way for me to control my network. Hope anyone can give me a hint on how to go on with this configuration? Thank you very much in advance.
  • 3 Contributors
  • 7 Replies
  • 4K Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

You can do this two clean ways, and which you choose depends on how much control you have over the router and clients.

  1. Explicit proxy + egress filtering (what JorgeM suggested in #4). Configure browsers to use your proxy and then block all direct outbound web from the LAN except the proxy. At scale, push a PAC file or WPAD so clients auto-learn the proxy without manual browser edits. A PAC file lets you fail over or bypass internal sites cleanly. Example PAC guidance: MDN PAC file overview. On the edge device, add an ACL/policy like:
permit tcp LAN_SUBNET PROXY_IP eq 3128
deny   tcp any any eq 80
deny   tcp any any eq 443
permit ip  any any

Apply outbound on the WAN interface. Even SME routers usually support simple egress ACLs; if yours cannot, place a small firewall between the switch and router to enforce it. Cisco ACL basics for ports and direction are here: Cisco IP access lists guide.

  1. Network-layer interception. If you must avoid client config, you can intercept only HTTP reliably. On a Linux proxy that is the gateway or inline, use iptables REDIRECT/DNAT to send port 80 to Squid’s intercept port; see the Squid example and caveats: Linux traffic interception using REDIRECT. Some routers can hand off web traffic to a proxy using WCCP; this avoids per-host browser config and scales well: Cisco IOS XE WCCP configuration. Squid has WCCP examples too: Squid WCCP on Cisco IOS.

Important: HTTPS interception requires running a bumping proxy and deploying a trusted org CA to all clients; otherwise block direct 443 and keep proxies explicit. See Squid’s ssl_bump notes and risks: ssl_bump directive.

Recommended Answers

All 7 Replies

Member Avatar for Oxiegen

Well. It depends.
What kind of proxy server are you running?
MS? Linux? Hardware?

There are several suggestions in this thread, which is a linux based proxy.
And you can also read up on Web Proxy Autodiscovery Protocol.

Member Avatar for Bheeman89

hello oxiegen. thanks for the reply. i am actually running gtb inspector where it acts like a proxy server. so now i want to direct all web traffic to go through gtb proxy first before going to router n internet? is it possible? for firewall, we only have a basic firewall configured in the router. we are yet to purchase a standalone hardware firewall. Thank you again.

Member Avatar for JorgeM

There are a few options. Not all proxy solutions support these options...

1) Run the proxy service on the Internet router. Most routers that support this type of service actually do not proxy, but do URL filtering. The result is the same except the device is not caching.
2) run an inline proxy (between the switch and the Internet router)
3) Certain network routers have the ability to "hand-off" HTTP/HTTPS traffic to a proxy server.
4) configure your browsers to explicity use a proxy. Then on your perimeter firewall/router, block all outbound HTTP/HTTPS traffic for all hosts except your proxy. This will force clients to configure their browsers if they want access to the Internet, since the proxy will be the only host that has access through the firewall (very common approach).

Member Avatar for Oxiegen

Like JorgeM said. Suggestion 4 would be the best bet.
I've never even heard of gtb inspector. :)

Member Avatar for Bheeman89

Hello Oxiegen. GTB inspector is an application running on CentOS. So basically it ais also a linux distro as well. However the duty of the inspector is more to as a DLP (if you refer to gtb technologies maybe you would get a clear picture). So basically gtb is not only a DLP but it has many feautres where serving as a proxy server is also one of it.

Member Avatar for Bheeman89

Hello JorgeM. Thank you for your replies and suggestion. I have discuessed with my superior and we are planning to go on the 4th option. But in order to block the http and https request you need to configure an ACL right. However our router is serving as a firewall for us where all our setting for firewall is done pre configured in the router itself. So its considered as a SME router with limited functionalities. So i was thinking if this option is best available in entreprise routers such as Watchguard perhaps. However, I like the idea, but I need any input from you on how do I plan to block the requests in my current router? is it possible or I have to add another device in between to accomplish this setting? Thanks again JorgeM.

Member Avatar for JorgeM

Hello Bheeman89, So I am not familiar with the "SME" type router. In any case, whether it functions as a router or Firewall, you still should be able to incorporate this basic type of ruleset. If that router works off of ACLs, that is fine. What you want to do is restrict all traffic outbound from all internal hosts except from the traffic on port 80 and 443. This takes care of blocking people from any outbound access, except when using the proxy and only on port 80 and 443.

I would suggest that you should be able to implement this even on the most limited type of router/firewall. But if you cant and you have to spend some dollars, then yes something like a Watchguard, Sonicwall will definately work.

Alternatively, if you want to place something inline, that is a good option as well, but hte device you place in the inline format would have to be able to support it. I know of many firewall/proxy appliances that support this configuration. Not sure if GTB inspector on CentOS can do this. Its probably worth checking that out.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.