1

I am running at home a proxy server setup designed to limit access to certain websites that I find produce a drag on my mental health (for very complex personal reasons totally off topic here), which I built using the Squid program. The setup works by having my main work computer connect to another one that runs Squid and for which I have purposefully arranged so that I do not have the root password, which instead belongs to trusted family members. This proxying computer is then connected to the Internet, and is specially reserved for my use only. However, and while I've been using it for a while now and it seems to block the intended sites fairly well, I note that it also keeps - very frequently, almost all the time - tripping anti-bot protection on sites guarded by things like Cloudflare, such as LinuxQuestions.org.

Now, I've been able to tolerate this as not much more than an annoyance, but it's never quite sat well with me because I don't know what it means security-wise, and can't find a lot of reports about this kind of thing while googling. Does this indicate that the server is misconfigured in some way? How? Could it make the system compromised? Could it cause web admins to think (even if not correctly) that I am some malicious agent looking to hack their site and thus get me in trouble at some point? Note that I had to enable the SSL Bump facilities given that most sites today use HTTPS, so that it can decrypt the HTTPS URLs and sniff them for relevant domains and keywords. I presume this makes the outgoing data somehow look like it comes from a bot or other malicious program due to the "man in the middle" nature of the SSL Bump system, but is that inevitable, or again, does it indicate I have done something wrong in configuring the proxying program?

(Note: I think the whole squid.conf would be too large to post here.)

I've also found threads like this:

Why internet traffic behind ISP is not subject to captcha like a VPN?

which suggest this can occur with VPNs due to the NAT involved mapping many addresses to one, but here I am only mapping one internal address - as said, nobody else uses the proxied network.

2 Answers 2

1

I've been having the same kind of issues towards hosts behind CloudFlare.. What I could analyze here is that, as long as I'm NOT "Bumping traffic/SSL Intercepting traffic" at the Squid level, I'm able to crawl such web sites..

As soon as I'm "bumping" traffic, I'm getting all the CloudFlare catchas.. Well, I can live without CloudFlare TBH. It seems to me that I've honestly exhausted all the XFF, VIA and other settings like "visible_hostname" etc and that the issue happens with or without XFF headers, VIA headers etc..

This might also perhaps be due to the Squid version used, which as stated earlier might leave some match-able patterns/signature. I'm here running a somewhat older version, v4.8 which comes embedded within the used solution and within my setup immutable..

So to me, currently a workaround is not to bump traffic on Squid

0

One probable answer is the proxy is leaving a signature of some sort that is being picked up on - and as a result the remote site sees proxy as suspicious because users usually are hiding themselves - unlike http - https isn't supposed to be proxied (ignoring reverse proxys which are entirely different)

I can only postulate the trigger is something like an X-FORWARDED-FOR header added by the proxy or anonymizing features of it or both - I know that my ad-blockers mean Google has a harder time tracking me and building a profile so it throws me more captchas.

These captchas are unlikely to indicate things are compromised - but if the proxy server is accessible outside your LAN its not impossible. Find the external address associated with it and do an RBL/IP reputation search to check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .