How to block HTTP requests initiated from Java clients on Squid proxy server?

Question

I have deployed Squid Server 3.5.27 on Windows Server 2008 R2. I have one Windows 7 machine pointing to my Squid server which is acting as a proxy. Any browser based request initiated from the Windows7 machine is hitting my proxy server. Once hit, ACLs are coming into action by blocking the request.

Squid.conf:
acl mynet src 10.210.177.209
acl forbidden dstdomain "C:\Squid\etc\squid\blockedHosts.conf"

blockedHosts.conf:
www.google.co.in

This is working as desired, as far as the browser is concerned. I want to make sure that any request made for google.co.in from my Windows7 machine, should be blocked. However, this is not happening.

I have written a sample Java code which makes HTTPURLConnection to "http://www.google.co.in". This is somehow, bypassing a proxy. Sample Java Code:

public static void main(String[] args) throws MalformedURLException,
            ProtocolException, IOException {

        String url = "http://www.google.co.in";
        try {

            URL myurl = new URL(url);
            HttpURLConnection.setFollowRedirects(true);
            con = (HttpURLConnection) myurl.openConnection();

            con.setRequestMethod("GET");

            StringBuilder content;

            try (BufferedReader in = new BufferedReader(
                    new InputStreamReader(con.getInputStream()))) {

                String line;
                content = new StringBuilder();

                while ((line = in.readLine()) != null) {
                    content.append(line);
                    content.append(System.lineSeparator());
                }
            }

            System.out.println(content.toString());

        } finally {

            con.disconnect();
        }
    }

Can someone please guide me, what configurations do I need to make in squid.conf to prevent this bypassing?

score 0 · Answer 1 · answered Apr 25 '18 at 13:19

Check whether your squid runs in transparent mode - at least TCP port 80 must be redirected to squid somehow, e.g. on your router:

# iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to SQUID_IP_ADDRESS:SQUID_PORT

and intercept option must be added at the end of the line http_port in squid.conf, e. g.:

http_port 3128 intercept

Or you may write Java code with HTTP proxy support as well, here is an example: https://stackoverflow.com/a/1433296/5920627

How to block HTTP requests initiated from Java clients on Squid proxy server?

1 Answers1