6

If I'm an administrator of a corporate network, I could use an HTTP proxy to examine outgoing connections to monitor what websites my employees are going to, and terminate connections based upon policy/content rules.

Or, I put an invisible bump-in-the-wire box at the gateway to examine traffic content and terminate connections based upon the same rules.

As far as I can tell, these two options are identical, except that a proxy requires configuring clients to use the proxy. This makes me think that everyone would choose to use a bump-in-the-wire, yet HTTP proxies still exist and are in use.

Is there a benefit to HTTP proxies that explains why they are used?

Improve this question

7 Answers 7

Reset to default
4

With the HTTP proxy, user systems can have local private addresses (e.g. addresses in the 10.0.0.0/8 or 192.168.0.0/16 networks) since, at the TCP/IP level, these systems only talk to the proxy, not the Internet at large. With the "bump-in-the-wire" box, user systems must be able to contact arbitrary external sites more or less directly, which involves either public IP (expensive !) or some NAT (which can have problems scaling to thousands of local users).

The bump-in-the-wire box also needs to intercept incoming and outgoing traffic, and, as such, may be cumbersome to retrofit in an existing architecture. The HTTP proxy, on the other hand, is an ordinary host, as far as routers are concerned.

Improve this answer
6
  • How is the bump-in-the-wire box cumbersome to install? No network configuration changes are needed. HTTP proxies have limited value because they can be easily bypassed since they are not looking at all 65K+ ports. Of course we are just talking generic solutions and there is quite a variation within each category.
    – Bill Frank
    Dec 31, 2011 at 16:48
  • I'll grant this answer the green checkbox for private IP observation. It's a practical reason that I hadn't thought of.
    – Jumbogram
    Jan 2, 2012 at 1:21
  • I guess it depends on what type of organization you are in. If you don't have a firewall, perhaps not having to worry about NAT'ing makes sense. However, I would still like a response from someone regarding the issue of bypassing an HTTP proxy because in general they are only monitoring a small number of ports such as 80 and 443. And I would like a clarification on what's "cumbersome" about installing a "bump-in-the-wire" appliance.
    – Bill Frank
    Jan 2, 2012 at 19:13
  • 1
    @BillFrank: if the existing network uses, e.g., a pair of routers (for resistance to hardware failures or load balancing), there is no easy place where you could put your appliance -- it would have to be integrated in the routers, something which might not be easy if the routers are black-box appliance themselves. As for bypassing the proxy, this cannot be done if IP are private and there is no NAT: the proxy is the only machine which can contact the Internet at all, on any port -- and that's the situation I most often encounter in big organizations.
    – Thomas Pornin
    Jan 2, 2012 at 20:26
  • @ThomasPornin I would like to clarify my two points:
    – Bill Frank
    Jan 3, 2012 at 15:49
2

For the purposes of monitoring users on a corporate network, the difference between on-the-wire sniffing/interception and proxies is small. In-fact, an on-the-wire box is a superior choice in most respects if all traffic is forced over it, as it will see traffic across all ports.

However, proxies are not solely installed in corporate environments for spying and blocking on their users. The abstraction layer they provide of requiring HTTP/HTTPS traffic (of which is likely the majority) is most definitely good practice to increasing the security of your corporate network.

Whilst alone, a proxy is not the be-all-end-all of security on your network, it is certainly not a solution to be ignored because "it doesn't do much". Assuming a windows dominate network, setting up group policy on your network to require clients to connect out on the corporate proxy with Active Directory credentials is a fantasticly simple mitigation. This prevents Mr.BadGuy from rocking up to your network and (a) sniffing internet-bound creds which can be used for elevation and (b) exfiltrating corporate data out of your network without even as much as an account.

A proxy in a well-designed network can prove to be an elegant solution and really, in a corporate environment, not much (if any) more than HTTP/HTTPS should be allowed outbound. Whilst an on-the-wire solution gives you a lot of power, it also brings along a lot of risk. How much capital would an attacker gain from breaking into your on-the-wire box?

Improve this answer
1

I think it is a matter of traffic scale and networking infrastructure currently in place. If you only want to proxy HTTP traffic, then it doesn't make sense to put it as a bump in the wire (a transparent proxy) such that everything has to be separated out at the switch. This means you would require (additional) L4 gear to push the HTTP traffic to the transparent proxy, whereas an explicit proxy does not require the additional switching.

Improve this answer
3
  • Why would anyone only want to proxy HTTP traffic?
    – Jumbogram
    Jan 2, 2012 at 1:17
  • Why not? Some corporate policies may only require to proxy http.
    – logicalscope
    Jan 2, 2012 at 6:07
  • From my perspective, in 2012, the only reason to proxy is for caching. But proxies for security purposes is a very weak solution. With the proliferation of port hopping applications like Skype, all 65K+ ports must be monitored, if you want to establish real control of traffic to and from the Internet.
    – Bill Frank
    Jan 2, 2012 at 19:17
1

While reading The Tangled Web, I came across an issue with a transparent proxy that also caches content to save bandwidth:

"The approach taken by transparent proxies is unusually dangerous: Any such proxy can look at the destination IP and the Host header sent in the intercepted connection, but it has no way of immediately telling if that destination IP is genuinely associated with the specified server name. Unless an additional lookup and correlation is performed, co-conspiring clients and servers can have a field day with this behavior. Without these additional checks, the attacker simply needs to connect to his or her home server and send a misleading Host: www.google.com header to have the response cached for all other users as though genuinely coming from www.google.com."

Improve this answer
0

HTTP proxies are limited to HTTP, and usually only look for traffic on port 80. A smart user could easily bypass the HTTP proxy to get to the Internet by communicating on some other port.

I would recommend the bump-in-the-wire approach as long as the solution you are deploying monitors all 65K+ ports. In other words, no user would be able to bypass because all ports are monitored. Of course, your policies would have to take advantage of this capability. This is very easy to install because no IP addresses are used. Therefore no network reconfiguration needed. Obviously, this approach assumes some other device is providing firewall/NAT functionality.

Also, you would need to think about how the bump-in-the-wire device fails. If it fails closed, then access to the Internet is blocked for everyone. You could use a bypass switch if this is unacceptable. Of course, you could deploy a pair of appliances with high availability/auto failover.

Improve this answer
0

A proxy can offer better defense-in-depth and more flexible network design. For instance, all HTTP/HTTPS/streaming-content traffic not going through the proxy can be identified and killed by a modern firewall regardless of what port it runs on (or only permitted if it's a known host running a known proxy-unaware application). More, by using a set of proxies and a .pac script, you can separate out different types of web traffic - desktop users can be sent to a caching proxy on one internet connection, critical server or workstation traffic can head out through another, and web-application traffic to a trusted network (where the proxy is configured to protect the trusted network from unauthorized users) on a third.

This can be achieved with transparent-mode filtering with some clever routing, firewalling and layer 3 switch configuration, but it will be far easier and more reliable in some situations to manage with a set of proxies.

Improve this answer
-1

I'm afraid that there aren't an easy solution. One of the main causes is that an user can easily find in the web a site with fresh new proxies every day and they can use that IP addresses to bypass your HTTP proxy or your bump-in-the-wire.

The best approach is one that filters by content, not by destination. It could be bypassed anyway but for less cases and is difficult.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .