System-Wide Transparent Proxying Using URL Patterns

Question

Internet censorship -where I live- has almost turned web unusable so I decided to setup a transparent proxy using Tor for my home network. ince Tor is so slow -here- proxying all traffic through Tor would slow my connection to a crawl. Therefore I need a mechanism to selectively proxy the traffic.

I know a bit of 'iptables' and it looks to me like the solution to my problem. However there's a trick. As most of the websites I need to access through Tor (like Google+, Facebook and such) use several IP addresses for their entry points, it's almost impossible for me to add 'iptables' rules for all of those IP addresses. I need a mechanism to proxy the traffic based on URL patterns. For example I need to be able to proxy access to '*.facebook.com' through Tor.

So the question boils down to: how can I setup a system-wide transparent proxy using URL patterns?

Any idea/hint is much appreciated.

Answer 1

Squid might be what you want.

Squid out of the box configuration is generally ready to go as a proxy server, so the next thing you would need is an ACL like:

acl viator dstdomain .hotmail.com

So here you would include all the domains you want to proxy.

And you'll want the tor proxy defined:

cache_peer tor.proxy     parent    <tor port>       0

Then a command to direct traffic to tor, and prevent direct access for those domains, then let everything else through:

cache_peer_access tor.proxy allow viator
never_direct allow viator
always_direct allow !viator

Deployment of squid in your environment would require more information about your setup.

Answer 2

You don't have to install and use an additional proxy server, of course.

Selecting a HTTP proxy server according to the pattern of the URL is exactly what proxy-auto-configuration scripts do, after all.

Further reading

• Jonathan de Boyne Pollard (2004). Automatic proxy HTTP server configuration in web browsers. Frequently Given Answers.