1 
Client ---> First packet ---> Proxy ---> New packet? ---> Server

If we speak about proxy systems, does the first packet get discarded and a new packet gets created, or it's still the same packet (TTL gets decreased) any only the Layer 2 addressing gets changed? So if the L2 addressing gets changed do we speak about a new "packet"/"frame"? What if SSL/TLS is involved?

Improve this question

1 Answer 1

Reset to default
3

When using a proxy there is one connection between client and proxy and another connection between proxy and server. These connections are usually fully independent regarding TTL, TCP flow control, packet size (when using TCP) etc. Often they also have different source and destination IP and ports, i.e. with an explicit proxy the target of the connection from the server is the proxy, the target of the connection to the server is the server (different from proxy) and the source of this connection is the proxy (and not the client). Even the application layer content might be different, for example by injecting X-Forwarded-For headers into the original HTTP request when forwarding the request or Via headers into request and response.

Some proxies explicitly extract packet layer information from the source connection and apply these to the target connection when forwarding the data. Often this is the destination IP address when the proxy is configured to be used in a destination transparent way. It could also be source IP (and port) if the proxy is used in a fully transparent way (destination and source transparency). It might in theory also be possible to extract the original TTL and apply it when forwarding but I'm not aware of any proxy doing this.

With SSL/TLS involved the situation is no different. If SSL interception is done then there is one SSL connection from client to proxy and another one from proxy to server so that the proxy can get the plain text data. If no SSL interception is done then there are still two TCP connections but the proxy will forward the encrypted data directly.

Note that the behavior of a proxy as used in an application layer gateway as described above is different from Deep Packet Inspection (DPI) as done in many Next Generation Firewalls (but not all, some employ proxies). With DPI the original packet gets forwarded which includes the same source and IP address and port and also TTL. SSL interception is not possible this way, i.e. for this the firewalls also employ (transparent) proxy technologies with one SSL connection between client and firewall and another one between firewall and server.

Improve this answer
3
  • So altoug we speak about to different connections, in a fully transparent proxy the source IP in the packet from the proxy to the server would be or could be the source IP of the client, right ? So isn't this somehow IP spoofing ? Also going further, in the above example, the packet coming back from the server would hit the proxy but with destination as the client's IP?
    – cyzczy
    Commented Jul 8, 2017 at 12:10
  • @adam86: A transparent proxy is doing IP spoofing in that it uses IP addresses inside a connection which don't belong to the firewall itself. To do this the routing needs to be setup in a way that the client is on one side of the firewall and the server on the other side. This is no different from using a router or packet filter in the network only that the proxy is "more active".
    – Steffen Ullrich
    Commented Jul 8, 2017 at 12:29
  • @adam86 - All the transparent proxies I've worked with are transparent from the client-side only. The server sees the IP address of the proxy, not the client.
    – paj28
    Commented Jul 8, 2017 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .