3

I would like to setup a filtering mechanism for certain websites I use, including the ones served over https.

Privoxy provides this functionality, but only over http.

I'm pretty comfortable around programming and system management, but when it comes to hardcore networking my knowledge and experience lacks a little.

I found this question/answer which seems to address the https problem by tunneling traffic using STunnel.

I have issues placing some of the concepts that come into play. Is it possible to set this (meaning "creating the ability to use a custom Privoxy filter (not just blocking, really altering content) on HTTPS traffic) up on a single machine running Windows? I mean would that then act as both the STunnel client/server and the Privoxy proxyserver?

Any guidance would be greatly appreciated!

  • 1
    I've used nginx as a web proxy before. The configuration is easy and I think on a question in stackoverflow, though I forgot where. Setup the SSL cert on nginx and send all requests to the server, and host it locally where nginx can reverse proxy it. You can add the client ip or whatever you want from the request to the headers and change the content on the server. – ytpillai Dec 17 '17 at 17:29
  • @ytpillai - i don't understand this... Let's say I setup nginx in a Docker container on my local machine. Should I then configure the local machine to use the exposed endpoint/port on the Docker machine (pointing to nginx) as a proxyserver? Where does Privoxy come into play here? – ropstah Dec 17 '17 at 17:34
4

I think nginx is your answer. http://nginx.org/en/docs/windows.html

You can setup your SSL cert on there and have all clients connect to it. Then just reverse proxy the request to local host (no need for ssl here since its just local), and add client headers onto the local request.

Clients can tunnel into nginx (which is technically a web server in itself) and nginx will reverse proxy domains or ips as necessary.

Then you can use https://github.com/justcoding121/Titanium-Web-Proxy as a traffic interceptor and send all traffic to it.

| improve this answer | |
  • Just added a comment, I can also install nginx for Windows I see. But then what? Where does Privoxy come into play here? What should I set as proxy server in my Windows Network Configuration? – ropstah Dec 17 '17 at 17:35
  • 1
    Don't think you need Privoxy here since nginx itself can act as your reverse proxy. Looks like your best approach is whitelisting certain protocols and websites, so you can set your reverse proxy rules to allow only certain locations and protocols and deny everything else (default rule config equivalent to default deny all). Not necessary to have a separate proxy server unless you want to filter egress traffic too. Then you can have a physical pfsense firewall setup as a bridge for your network to your machine and make it the proxy server. – ytpillai Dec 17 '17 at 17:38
  • 1
    Nginx can proxy a request and a response to a specified location, and that seems to be what you have requested. And yes, just read the other comment, only nginx should be exposed. Keep in mind that the most, most secure solution is always a physical firewall if you are worried about malware ridden traffic too, since those are specifically built for that purpose. – ytpillai Dec 17 '17 at 17:42
  • The thing is that Privoxy provides functionality to 'match' certain hosts/urls through patterns and apply filters (Perl script regex replacements) on responses it serves back. You seem way more literate on networking than myself so I'm going to assume Nginx can either "transform" responses from a https connection or forward those to Privoxy again to do the transformation. Hopefully the configuration for each of these 'services' will speak for itself (regarding the request pipeline) because I really have no idea on why this works and why Privoxy doesn't support https transformations.. – ropstah Dec 17 '17 at 18:20
  • Just to make sure, is this what's going on: Nginx forwards incoming https requests and returns those as http responses? – ropstah Dec 17 '17 at 18:35
0

Privoxy can filter SSL (https) after a fashion. See Privoxy FAQ on SSL.

| improve this answer | |
  • 1
    Welcome to Super User! Whilst the link may provide an answer the question, it would be preferable to include the essential information for the answer here, and provide the link for reference. Thanks! – bertieb Aug 28 '18 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.