It seems that I can´t find a proper way to make this work:
I want to block access to certain sites in a work environment (mostly facebook and adult sites). Since there is no domain blocking in the firewall I thought I would use the Proxy feature which does have it, but then I´ve found intermittent problems to access https sites that are not blocked, GMail being the most important.
Not using the proxy for https connections means I don´t block facebook, and this kind of blocking is one of the main reasons why we bought a mikrotik router…
So I added several gmail related domains to the list of exclusions for https in the browsers, but the truth is there’s always a new domain I have to exclude, making this “whitelisting” a bad solution.
I´ve searched and stumbled with some threads regarding this but I couldn´t get a clear answer to configure things in a manner in which I could effectively block only some specific http and https without affecting the rest. I don´t think I particulary want to proxy nor to avoid it, I just need to do some blocking as easily as possible.
I should admit that I would rather choose a GUI based solution over a CLI one; back in the day I cut my teeth with Freesco and handcrafted my own iptables rules, but nowadays that would require more time and concentration that what I have available…
If you are talking about transparent proxy - it can’t be done.
HTTPS can not be used through a transparent proxy - basically you introduce man in the middle attack.
You need to setup the proxy in browsers on the stations. And to avoid someone just removing their proxy setting you make a firewall rule to drop connections on port 443 from stations.
Woa! Three replys in a few hours? It’s great to see this is an active forum, thank you guys for chipping in!
I had the proxy configured in the browsers (actually in the terminal’s OS and the browsers set to “use system config”), but then some terminals started to report GMail problems, I excluded a bunch of domains and fixed GMail, but then YouTube (used for work) would not load its videos. So I just removed https from the Proxy config until I find a solution.
Fortunately I had not set up Proxy in the terminal that do online banking, that would have been a harsh call
So I don’t think I was doing transparent Proxy since I had the browser config in place.
I must be missing something because if that doesn’t work then how is it supposed to work?
FWIW :
As you mentinoed, I also considered tinkering with DNS but I am not sure I can make mikrotik send bogus DNS responses like facebook=120.0.0.1
I am looking into something like OpenDNS where you can blacklist some domains, but it seems it have a fair amount of issues too. I am sure I had found a better service but lost the bookmark and can’t find it again
There is no AD in this network so deploying stuff (i.e. customized hosts files) takes some extra scripting and, more importantly, requires me to remember many little details when I have to reinstall a terminal.
You can set up a transparent squid proxy, on separate PC, to do these things. No need then to tinker around with the users PCs.
However, as you have access to these PCs, you might also play the “Man in the Middle Attack”, after installing squids certificate on these PCs. To allow squid to decipher https. Very tricky setup, though.
you mean - add a static entry, and everyone who queries for that name will get set address? No other entries will be added for that name. Even if you set IPv4 addresses and domain have IPv6 addresses - IPv6 entries will not be added and thus, added in response to the client querying for AAAA entry.
