Hi Team:
We need to enforce strict filtering based on a hostname allow-list for our devices.
Our current setup uses redsocks (official proxy for Balena) to transparently redirect traffic to a Squid proxy. The problem is that redsocks resolves the domain to an IP address before the connection is passed to Squid. Consequently, for HTTPS traffic, Squid only sees an IP address, making our hostname-based rules hard to apply.
What is the best practice on Balena to solve this?
Is there a way to configure redsocks to pass the original hostname instead of the resolved IP?
If not, what is the recommended alternative for transparently intercepting traffic while preserving the hostname for filtering?
Any guidance would be greatly appreciated. Thanks!
Is there a way to configure redsocks to pass the original hostname instead of the resolved IP
Well, redsocks works at TCP layer, which uses IP addressing. There is a hint here, that proxy hostnames will be resolved to IP. You could experiment with X-Forwarded-For, but that’s would probably require changing the upstream proxy configuration.
If not, what is the recommended alternative for transparently intercepting traffic while preserving the hostname for filtering?
You could consider binding a second IP to the Squid proxy and route redsocks traffic there, assuming your Squid proxy can be reconfigured to treat all requests arriving on specific interface/IP as coming from this device.
Hi! Thanks for your answer, but I have another questions:
How can one enforce filtering of egress traffic when the redsocks proxy effectively hides the domain ? Since we have no physical control over the IoT devices, how do you recommend we prevent abuse of the device or SIM card ? The only option seems to be filtering of egress based on the destination IP address but this makes connectivity to all the required destinations very brittle. Is there an option to fully remove redsocks from the stack and simply use the http_proxy and https_proxy environment variables, understanding that some tools may need additional configurations.
How can one enforce filtering of egress traffic when the redsocks proxy effectively hides the domain
Redsocks is not really fit for purpose for your specific use case, it mentions this in their README (about corp. firewalls). A different solution is required here, for example one that first routes all host traffic via a VPN server that you control. The redirect could in theory be implemented as a container in the composition using protocol such as Wireguard.
Once on the VPN server, you would need to do capture ports 80 and 443 (DNS too?) and redirect them to a local proxy, which will inspect the SNI header. But keep in mind, SNI headers can be spoofed as well, see Unlocking free WiFi on British Airways | saxrag
Also, Cloudlink VPN isn’t HTTPS/TLS, it’s OpenVPN protocol that uses 443/tcp. It doesn’t have any SNI protocol headers and doesn’t look like a normal TLS stream. You can chose to leave it alone and let it run over the host’s gateway (prefered) or whitelist balenaCloud Cloudlink destination IPs in your config (these IP could and will change).