Some of our systems have extra "security needs", and they are not allowed to initiate outgoing connections by default. This means that IP ACLs are used so that they can only reach necessary services reach necessary services (SMTP gateway, DNS resolvers, NTP etc).
Because those hosts do need access to some web sites (mostly for software updates), we use a proxy server to allow them access to those domains.
...
It support both IPv4 and IPv6:
| Code Block | ||||
|---|---|---|---|---|
| ||||
Listen :: #This# This will accept connections on IPv6, but also on IPv4: (IPv4-mapped IPv6 addresses are used:) #CONNECT Jan 04 15:29:13 [23566]: Connect (file descriptor 6): host.terena.org [::ffff:192.87.30.2] Listen 0.0.0.0Listen :: # This will listen on IPv4 only Listen 2001:610:148:dead::6660.0.0.0 # This will listen only on the specified IPv6 address. Not nice, but workable. Listen 2001:610:148:dead::666 |
Whitelist
I configured tinyproxy to block everything, except a list of domains, by using this configuration:
...
| Code Block |
|---|
C:\Users\Administrator>netsh winhttp set proxy proxy6.terena.org:8888 "<local>" Current WinHTTP proxy settings: Proxy Server(s) : proxy6.terena.org:8888 Bypass List : (none) |
...