Forum Discussion
NimbostratusHTTP Explicit Proxy and http requests
Ah, so the difference here is in how explicit proxy handles http vs. https. Https traffic is in fact sent into the tunnel to be picked up by a wildcard virtual server as you discovered, however http traffic is sent directly to the end web server requested using routing specified under network->routes. As far as forcing non-encrypted http traffic to hit that virtual server requires some irule manipulation to accomplish that. A simpler strategy then trying to "virtual" the connection over to wildcard vs is in the HTTP_PROXY_REQUEST method on the explicit proxy VS you could run some of that same logic and block connections based on uri and/or ip right there.
Ah, so the difference here is in how explicit proxy handles http vs. https. Https traffic is in fact sent into the tunnel to be picked up by a wildcard virtual server as you discovered, however http traffic is sent directly to the end web server requested using routing specified under network->routes. As far as forcing non-encrypted http traffic to hit that virtual server requires some irule manipulation to accomplish that. A simpler strategy then trying to "virtual" the connection over to wildcard vs is in the HTTP_PROXY_REQUEST method on the explicit proxy VS you could run some of that same logic and block connections based on uri and/or ip right there.
Sample iRule Basic Logic
when CLIENT_ACCEPTED {
block by IP
} ; CLIENT_ACCEPTED
when HTTP_PROXY_REQUEST {
if {[HTTP::method] eq "CONNECT"} {
HTTP Profile will forward via tunnel to transparent proxy
return
}
otherwise you know it is non-tls and as such could use HTTP:: commands to parse request and decide on allow/disallow.
} ; HTTP_PROXY_REQUEST
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
