Allowing HTTP/HTTPS Targets at Unusual Ports

This section describes modifying the allowed target ports for PrivX Web Proxies. These instructions assume you to have some familiarity with Squid configuration.

By default PrivX only allows access to HTTP/HTTPS targets running on certain ports. The allowed ports are available toward the start of your Squid configuration file.

To allow access to targets at nonstandard ports:

1. Verify and set the allowed target ports on your Web-Proxy machines in ​/opt/privx/etc/squid.conf​​:

   • For HTTP and HTTPS targets, ensure the target port is included in the ​Safe_ports​ list. You can add the target port by adding a similar line immediately after other ​acl Safe_ports​ directives (replace ​<target_port>​​ with the port of your HTTP/HTTPS service):

     Bash

     acl ​Safe_ports​ port ​<target_port>​​
     

   • Additionally for HTTPS targets, ensure the target port is included in the ​SSL_ports​ list. You can add the target port by adding a similar line immediately after other ​acl​ SSL_ports​ directives (replace ​<target_port>​​ with the port of your HTTPS service):

     Bash

     acl ​SSL_ports​ port ​<target_port>​​
     

   For example, to allow access to HTTPS target running on port 9443, you would need to add the port to ​SSL_ports​​:

   Bash

   acl SSL_ports port 443
   ​​acl SSL_ports port 9443​​
   acl Safe_ports port 80          # http
   acl Safe_ports port 21          # ftp
   acl Safe_ports port 443         # https
   acl Safe_ports port 1025-65535  # unregistered ports
   acl CONNECT method CONNECT
   

   Port 9443 is already included in ​Safe_ports​​ by default.

2. Restart the ​squid​​ service to apply the changes:

   Bash

   # systemctl restart squid
   

Access Restrictions for Web Connections

You can control access to specific websites for specific PrivX roles. With this you can prevent users from accessing arbitrary websites by entering URLs, and via links on web targets.

You can also configure host specific domain restrictions (since PrivX 16). See Customizing the PrivX Carrier browser for more information.
​
Role-based access control is configured via Squid on PrivX Web Proxies. These instructions assume you have some familiarity with Squid configuration. This section provides some basic examples about access control. For more comprehensive descriptions about Squid's access-control settings, see their vendor documentation at ​https://wiki.squid-cache.org/SquidFaq/SquidAcl​​
​
To control access for a PrivX role, you will typically need to specify the following in the Squid configuration:

• Define an ​acl​ matching the members of the PrivX role. You can determine PrivX users' roles from their ​User-Agent​​ header.

• Define ​acl​​s for the restricted address(es).

• Define rules allowing/denying matching members to access restricted address(es).

For example, to only allow ​privx-admin​ members to access while denying all other PrivX users access to ​www.example.com​​, perform the following on all your PrivX Web Proxies:

1. Add rules like the following to the Squid configuration at /opt/privx/etc/squid.conf​​:

   Bash

   # Match all PrivX users belonging to the privx-admin role
   acl is_privx_admin req_header User-Agent Role\=privx-admin
   
   # Define restricted address(es)
   acl restricted_to_certain_privx_roles ssl::server_name www.example.com
   
   # Allow privx-admins to access restricted address(es)
   http_access allow is_privx_admin restricted_to_certain_privx_roles
   
   # Deny others access to restricted address(es)
   http_access deny restricted_to_certain_privx_roles
   

2. Restart the ​squid​​ service to apply the changes:

   Bash

   # systemctl restart squid
   

Trusting Sites with Self-Signed Certificates

Configure trust for any web targets that use self-signed certificates, for the following benefits:

• PrivX users connecting to web targets no longer receive security warnings about insecure server certificates.

• Support websocket connections from the web target.

📘

Note

We recommend setting up web targets before configuring trust for them. For more information about setting up targets in PrivX, see Setting up Hosts.

To trust a web target:

1. On your PrivX Web Proxy, add the CA-certificate chain of the web target to the system trust anchors: Save the CA-certificate-chain file under ​​/etc/pki/ca-trust/source/anchors/​​.

   Then run:

   Bash

   # update-ca-trust extract
   

   Restart the Squid service to apply the changes:

   Bash

   # systemctl restart squid
   

2. ​​(Optional)​​ Perform this step if you need to enable websocket connections from the web target.

   On your PrivX Carrier, add the CA-certificate chain of the web target to your PrivX-Carrier configuration at ​​/opt/privx/etc/carrier-config.toml​​.

   Then restart the Carrier and Docker services to apply the changes:

   Bash

   # systemctl restart privx-carrier
   # systemctl restart docker
   

Changing Web Proxy Port Numbers

To change the Web Proxy ports, you need to edit the following:

📘

Note

In the following examples, replace the port numbers ​18080​ and ​18443​​ with the ports you want to use.

1. On the Carrier host, change the ports in the ​/opt/privx/etc/carrier-container.toml​​ file:

   Bash

   [web_container]
   
   # Web proxy ports for HTTP and HTTPS. The port numbers and Carrier host IP \
   address should match the Squid configuration file in /opt/privx/etc/squid.conf
   # Proxy server IP address is configured via PrivX UI.
   http_proxy_port = ​18080​​
   https_proxy_port = ​18443​​
   

   After editing the file, restart the Carrier service:

   Bash

   # systemctl restart privx-carrier
   

   On the Web Proxy host, edit the Squid configuration file in ​/opt/privx/etc/squid.conf​​ to match the port numbers you entered previously:

   Bash

   http_port ​18080​​
   http_port ​18443​​ ssl-bump cert=/opt/privx/squid_cert/squid.crt \
   key=/opt/privx/squid_cert/squid.key generate-host-certificates=on \
   dynamic_cert_mem_cache_size=4MB
   

   After editing the file, restart the Web Proxy and Squid services:

   Bash

   # systemctl restart privx-web-proxy squid
   

   The Web Proxy host's firewall should allow access to the ports you have specified. Run:

   Bash

   # firewall-cmd --permanent --add-port=​​18443​​/tcp
   # firewall-cmd --permanent --add-port=​18080​​/tcp
   # firewall-cmd --reload
   

Custom Load-Balancer Support

If you are using a custom load balancer in a PrivX HA deployment, you will need to ensure that its session-affinity cookie (also known as a sticky-session cookie) is accepted by all your PrivX Carriers and PrivX Web-Proxies:

1. Add the name of the session-affinity cookie to the ​known_lb_cookies​​ setting. The setting is located in the following configuration files, for Carriers and Web-Proxies respectively:

   • ​​/opt/privx/etc/carrier-config.toml​​

   • ​​/opt/privx/etc/web-proxy-config.toml​​

2. Restart the Carrier and Web-Proxy services. On your Carriers, run:

   Bash

   # systemctl restart privx-carrier
   

   And on your Web-Proxies, run:

   Bash

   # systemctl restart privx-web-proxy
   

   📘

   Note

   If your PrivX HA deployment also includes Extenders, configure those to accept your session-affinity cookie as well, according to the instructions at High-Availability Deployment.

For more information, see Websockets and the PrivX Carrier browser and Customizing the PrivX Carrier browser