Proxies

4. The Proxy

4.1. Installing the server

The proxy server is a simple out-of-the box Squid proxy on a virtual Ubuntu server. The installation script is below:

echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise1 start *'
echo '*********************************************************'
echo '**************PROXY**************************************'
echo '*********************************************************'

# SHELL
function aptget {
    DEBIAN_FRONTEND=noninteractive apt-get -y \
     -o Dpkg::Options::="--force-confdef" \
     -o Dpkg::Options::="--force-confold" \
     $@
}

aptget -y update
aptget -y upgrade

ifconfig eth1 10.128.4.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.4.1

ifconfig
netstat -rn

aptget install -y squid
aptget install -y squid-deb-proxy
aptget install -y language-pack-en
cp /vagrant/squid.conf /etc/squid3/squid.conf
service squid3 restart

cat > /etc/resolv.conf <
search server
nameserver 10.128.6.100
EOF

At the end of the script, we set the nameserver to 10.128.6.100. This is done after all the apt-gets, because our own DNS server does not resolve the hostnames needed for the apt-get. It is also important to see that the DNS server is the server server, for the .server hostnames, that is.

The squid.conf contains:

#Recommended minimum configuration:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8 192.168.100.0/24 192.168.101.0/24
acl SSL_ports port 443
acl Safe_ports port 80     # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http

dns_nameservers 10.128.6.100

acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports

http_access deny to_localhost
icp_access deny all
htcp_access deny all

http_port 3128
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid3/access.log squid

#Suggested default:
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .        0    20%    4320
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3

# Allow all machines to all sites
http_access allow all

This is more or less a minimal setup for Squid.

4.2. Split DNS

Split DNS, also called split brains or split horizon, is a method that separates the internal DNS from the external DNS. There are a number of reasons for keeping a split DNS, most of which have some security aspects. The idea behind it is very simple: there are two instances of DNS, that do not share data. This is exactly how we set-up our network: the client does not know about the server hostnames and vice-versa.

On the client (our Windows 10), the nameserver is precise2. We can see this by issuing ipconfig /all on the command prompt. The result will contain:

DNS Servers . . . . . . . . . . . . . : 10.128.2.100

This means, that our Windows 10 system can resolve all the client addresses, but not the server addresses:

C:\WINDOWS\system32>nslookup
Default Server:  dns.client
Address:  10.128.2.100
> proxy.client
Server:  dns.client
Address:  10.128.2.100
Name:    proxy.client
Address:  10.128.4.100
>web.server
Server:  dns.client
Address:  10.128.2.100
*** dns.client can't find web.server: Query refused
>

On the other hand, the proxy's DNS points to the server side. The same nslookup set here gives:

vagrant@precise64:~$ nslookup
> proxy.client
Server:		10.128.6.100
Address:	10.128.6.100#53
** server can't find proxy.client: NXDOMAIN
> web.server
Server:		10.128.6.100
Address:	10.128.6.100#53
Name:	web.server
Address: 10.128.5.100
>

4.3. Using the proxy

There are many ways to set a proxy on Windows 10. You can do it system-wide or just for a single application. I choose the latter. Under the 3-points menu in the Edge browser, under Advanced, there is a setting Proxy Setup. Via the Open Proxy Settings button, you can manually set a proxy. Use 10.128.4.100 on port 3128.

When we now browse to http://webserver/index.lighthttpd.html, we see our default Placeholder Page. So, how does that work?

Our browser sends the complete http-get request to the proxy.

We see the packet coming from 10.128.1.100 (Windows 10) to 10.128.4.100, our proxy server. We also see that the destination port of the packet is 3128, which is the proxy port and not the http port. In the request, we see the complete http request to the URL. The client has done nothing to resolve the host name, it just sends it in the request to the proxy and lets the proxy handle it.

If you look at the rest of the traffic, you can see that Microsoft Edge is very noisy. Most of the other requests fail, because our proxy does not work for the Internet. We see calls to login.live.com, www.w3.or/Icons, nav.smartscreen.microsoft.com, which all fail here, but normally just slow down your browser.

On our proxy, we see the following traffic. You may need to restart the proxy, because otherwise it might serve from cache.

What we see is that the proxy first gets the http-request fro 10.128.1.100, our Windows 10 server. This results in a DNS query to 10.128.6.100, our server DNS (frame 116), from which it gets its response. The response in 232 says that web.server is at 10.128.5.100, and the DNS answer is to the proxy, not to the client.

Next, the proxy sets up a session to the web server to get the web page.