Redirect also HTTPS

RouterOS Forwarding Protocols
1

Hello,

I have a small LAN with a RB2011 as a gateway.
And I need to redirect all requests on https://facebook.com to my local web server.

Is there any way? Like using L7 etc?


Thank you so much! :slight_smile:

2

Not transparently - https is designed to stop man-in-the-middle attacks, which is what a transparent redirect would be.

If you configure the browsers on the LAN to use the Mikrotik as a proxy (specified as proxy server in the settings) then you can make a redirect rule in the proxy settings for facebook.

3

Hello,

thank you for the answer. I can’t do anything so? Because I have no access to private computers in ours LAN (mobile phones etc.).

So there’s no option to redirect without accessing ours LAN devices?


Thank you.

4

Well, like I said, HTTPS is designed to detect some device between the browser and the server if it tries to manipulate the connection.

Here is how the process breaks down for a transparent https redirect:

Say you type https://www.google.com/ into your browser.
Your browser looks up the IP address for www.google.com (I get 173.194.115.81 as the IP right now - Google has lots of them)
It then creates a socket to 173.194.115.81:443/TCP
At this point, your router has silently redirected the connection to a transparent proxy server-

  • the browser thinks it’s talking to 173.194.115.81
  • it’s really talking to some other device, say 10.20.30.43
    Ok - the first thing that happens for SSL is that the server must present a certificate to the client. This is where the problem is.
    What certificate is your proxy going to give?
    It can’t grab Google’s certificate and hand that to the client because the proxy server doesn’t have Google’s private key that works with the certificate.
    You could give a fake google certificate, but it isn’t going to be signed by any reputable certificate authority, so the browser is going to alert the user that an untrusted organization has signed this certificate that claims to be from Google.
    You could give your OWN certificate, even one that’s signed by a trusted CA, but that certificate won’t say “www.google.com” on it, so the browser is going to alert the user that they’re connecting to a site with a certificate that doesn’t match the address you wanted to go to.

You can put proxy information into DHCP and tell clients that they should use your proxy as a proxy server to access the web, and so long as the users haven’t disabled automatic proxy detection, their devices should follow along. The reason a configured proxy connection can filter web requests is that the client browser has to ask the proxy “go to https://www.google.com/ please” at which point the policy can say “sorry, no Google for you” before it ever tries to open a secure connection to google. If it IS permitted, then the proxy makes the connection and just hands everything through, so it doesn’t participate in the encryption - so the certificate from Google is really given to the client.

Do some googling to find out more about the DHCP options and other pieces of the puzzle needed to automatically assign a proxy. It might be something you can do, and if you want to filter https access by URL, then this is your only option. Other than that, you can use a policy-based DNS service like OpenDNS to limit what your users can do.