Community discussions

MikroTik App
 
ciscociscocisco
just joined
Topic Author
Posts: 4
Joined: Mon Apr 13, 2015 9:25 am

redirect-page

Mon Apr 13, 2015 10:34 am

Hi
I need a emergency help to redirect www.google.com to www.google.com/ncr in my router
please help i have bad problem with google incorrect ip location problem
thanks in advance
 
User avatar
hossain2004a
Member Candidate
Member Candidate
Posts: 247
Joined: Mon Dec 22, 2014 7:34 pm
Location: Iran

Re: redirect-page

Mon Apr 13, 2015 10:22 pm

WebProxy is the way to go.
http://wiki.mikrotik.com/wiki/Manual:IP/Proxy

But i'm not sure redirecting in proxy would be work with HTTPS or not :( (long time no check)
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: redirect-page

Mon Apr 13, 2015 10:25 pm

It won't - Mikrotik's proxy is for standard http.
Redirecting ssl would cause SSL certificate red alert warnings.
 
ciscociscocisco
just joined
Topic Author
Posts: 4
Joined: Mon Apr 13, 2015 9:25 am

Re: redirect-page

Wed Apr 15, 2015 7:42 am

Hi
none of the method above worked .
can i do this via layer 7 protocol ?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: redirect-page

Wed Apr 15, 2015 6:25 pm

No - you can't interfere with an ssl connection without causing red flags all over the users' screens.
Layer7 firewall matcher looks into the packet payload - which with SSL is going to be encrypted, right?
...
The entire purpose of SSL is end-to-end security which should always defeat a middlebox.

If you don't care about ssl warnings, then if you have a web server with URL rewriting capabilities, set it up to rewrite www.google.com -> www.google.com/ncr , put a self-signed certificate on the server, and then you can intercept DNS and give the IP of your web server for www.google.com
(dstnat - redirect udp 53, set up IP > dns to allow remote requests)

Remember that this solution is going to give the end user an invalid certificate warning, no matter what you do, except:

hack google and steal their private SSL key
find a trusted CA who will sign a CSR from you for *.google.com
force every user to add your private CA as a trusted authority and issue yourself a google.com cert and sign it with your own CA.
(all of these are bad - and any user who allowed #3 should be given a computer class in security, because then you would have the power to sandbox their bank website and they would get no alarms!)