Re: https permit/deny

[vects <alexc@actcom.co.il>]

On Sun, 2007-02-11 at 14:45 -0300, Leonardo Rodrigues Magalhães wrote:
>     Never used l7 for doing that kind of filtering, dont know if it's 
> possible.
> 
>     Anyway, if you need some hard filtering based on URLs, both http and 
> https, i would recommend that you use an http/https proxy, just like 
> squid, for doing that.
> 
>     Completly block https (TCP/443) traffic with iptables and get your 
> clients for use an http/https proxy and does the filtering there. I'm 
> pretty convinced it will be easier and you'll have a lot more 
> flexibility on the rules. Squid's ACLs are pretty flexible, you should 
> give it a try.
Does it work in transparent mode ( I mean for https)? 
I just can't tell all clients to use squid by phone, https filtering
must be hidden for them. As I know the latest squid supports totally
transparent mode, is that working for https also?

Thanks, Alexc.

> 
> 
> vects escreveu:
> > Hi,
> >
> > I'm looking for solution of the next problem, I have to enable/disable
> > an access to list of https web servers, I don't know in advance IPs of
> > them, permit rule must be based of the url user typed in location bar.
> >
> > Is possible to do that by iptables and extentions?
> > I thought about l7 filter.
> >
> >   
>