A forward proxy: the office's one way out to the web

The idea

A forward proxy is the office's only way out to the web: it fetches every page for you, so it can read, log and refuse what you ask for. Here the employee reaches newsSite and socialSite only through webProxy or socksProxy, because edgeRouter lets nothing else out.

Steps

1. No way out but the proxy

   An office that lets every laptop talk to the web directly can neither see nor stop what leaves; one way out can. The edge Router lets only the proxies out of the office: the forward proxy webProxy, and a SOCKS proxy.

   employee:~# curl -m 4 http://newsSite.lab/
   newsSite:~# tail -n 1 /var/log/httpd.log

2. The proxy reads the URL

   Reading the whole address is what lets a proxy refuse one file and pass its neighbour. A request through a proxy carries the whole URL. Squid refuses socialSite.lab and any path ending in .exe.

   employee:~# curl -I http://newsSite.lab/files/tool.exe
   employee:~# curl http://newsSite.lab/files/report.txt
   webProxy:~# tail -n 2 /var/log/squid/access.log