Configuration of the HTTP proxy
Ostatnia zmiana dla wersji: 14.2.0 (07.2026)
Nowość:
- Beta Wyłącznie dla użytkowników korzystających z wersji beta::
- The number of threads for the HTTP proxy can be individually configured
- Neue Einstellungen für das Logging
- Globale Werte werden in weiteren Konfigurations-Profilen angezeigt, sind dort aber nicht veränderbar
- Added note on current certificate requirements
- Renamed the Website-Allowlist and updated the description
notempty
Ten artykuł odnosi się do wersji beta
Introduction
The proxy serves as an intermediary between the internet and the network to be protected.
The clients send their request to the proxy and the proxy passes it on to the corresponding servers.
The actual address of the client remains hidden from the server.
In this way, it is possible to check the data traffic for viruses and unwanted content.
notempty
If necessary, additional configuration profiles can be added alongside the standard profile.
Nowość od v14.1.1
notempty
- Wsparcie dla certyfikatów z kluczem o długości poniżej 1024 bitów zostanie wycofane od wersji UTM 14.2.0
- Połączenia HTTP-Proxy oraz SSL-VPN, które dotychczas używały powyższych, przestarzałych certyfikatów, przestaną funkcjonować od wersji v14.2.0!
- Od wersji 14.2.1 zostanie również wycofane wsparcie dla certyfikatów z algorytmem podpisu SHA1.
- Wbrew wcześniejszym zapowiedziom, zarówno połączenia HTTP-Proxy, jak i SSL-VPN wykorzystujące certyfikaty o długości klucza 1024 bitów będą nadal funkcjonować, pod warunkiem, że są one podpisane algorytmem SHA256.
- Niebezpieczne certyfikaty należy pilnie wymienić!
BSI zaleca — stan na 01.2025 — długości kluczy od 3000 bitów i SHA256
BSI – Wytyczne techniczne — Metody kryptograficzne: Zalecenia i długości kluczy BSI TR-02102-1 | Rozdział 2.3: Szyfrowanie RSADomyślne ustawienie UTM dla nowych certyfikatów to klucz RSA o długości 3072 bit oraz SHA256 jako algorytm hashujący
- Dotknięte aplikacje:
- OpenVPN
- Certyfikat serwera w roli serwera (Roadwarrior lub S2S)
- Certyfikat klienta dla S2S
- Jeśli dotyczy, certyfikat określony jako certyfikat klienta za pomocą atrybutu użytkownika (Uwierzytelnianie → Użytkownicy → Edytuj użytkownika)
- Mailrelay
- Przekazywanie "Certyfikatu" (pod szyfrowaniem TLS jako serwer)
- Reverse-Proxy
- Ustawienia → Certyfikat SSL
- Webserver
- Sieć → Ustawienia serwera → Serwer WWW → Certyfikat
- HTTP-Proxy
- Przechwytywanie SSL → Certyfikat CA
- OpenVPN
Global Profile
notempty
The global profile applies to all interfaces and the transparent proxy. Most settings are overridden by additionally created profiles.
General
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Applications HTTP-Proxy  Area General
|
|---|---|---|---|
| Proxy Port: | 8080 | Specifies on which port the proxy is to be addressed | |
| Outgoing Address: | The IP address of the interface that the HTTP proxy should use. The Outgoing Address is used for two scenarios:
In this example, the proxy is bound to the faster DSL line:
Connection to a web server in the VPN network:
| ||
| Forward requests to system-wide parent proxy: | Nie | If another proxy is used before the HTTP proxy, this function must be activated. The configuration takes place under | |
| Authentication method: | The proxy offers various possibilities for authentication. The possibilities are: | ||
| None | The HTTP proxy processes all requests without authentication | ||
| Basic | With basic authentication, the users are queried against the stored users under Obszar User on the firewall | ||
| NTLM / Kerberos | Here the firewall must be made known to the server. This can be set up in the web interface under | ||
| Radius | Here the firewall must be made known to the server. This can be set up in the web interface under | ||
| Allow access only from local sources: | Tak default |
Access to the HTTP proxy is now only possible from internal sources. These are:
| |
| Allow access to local destinations: | Tak default |
All internal networks can also be reached via the HTTP proxy (the packetfilter has already been passed through to reach the HTTP proxy). Disabling it prevents this and access to other internal networks must be explicitly allowed via the port filter without an HTTP proxy. | |
| Forward Microsoft connection-oriented authentication: | Nie | If it is enabled, login or authentication to websites is possible. For some websites this is not possible otherwise. With this option, NTLM, Negotiate and Kerberos authentications are forwarded notempty
If SSL-Interception is active, this parameter must be enabled for HTTPS-based authentications, otherwise no authentication/login is possible on these websites. | |
Authentication exceptions | |||
| Enabled | Off default |
Authentication exceptions are disabled by default.
If enabled: URLs listed here are accessed without prior authentication. |
 Section authentication exceptions
|
| Exception (URL): | \.ttt-point\.de | If authentication exceptions are enabled, custom exceptions can be defined here | |
Log Log notempty Nowość od v14.2.0 | |||
| Writes a general Syslog for the HTTP proxy (Open: Obszar Log Aus Bereich Allgemein hierher verschoben |
Off | Schreibt ein generelles Syslog für den HTTP-Proxy (Aufruf: Obszar Log |  |
| Logging (USR): Aus Bereich Allgemein hierher verschoben |
Zeigt an, ob ein Unified Security Report aktiviert wurde oder nicht | ||
| Logging (Statistics): Aus Bereich Allgemein hierher verschoben Only available if no anonymization for the HTTP proxy Settings at |
Off | Writes a statistical Log call: Obszar HTTP proxy statistics | |
| Logging (Cache): | Off | Wenn eine Section (s.u.) ausgewählt wurde, wird das Log in /data/squid/cache.log geschrieben. | |
| Section für Cache-Logging: | ALL (All sections) s.u. | Die Sections lassen sich per Klick in die Clickbox auswählen. Eine Liste aller Sections findet sich auch in der squid-cache Doku | |
| Level für Cache-Logging: | 1 s.u. | Umfang des Loggings. Hinweise zu den Logleveln findet sich ebenfalls in der squid-cache Doku | |
notempty
Bei der Anzahl der Sections und des Log-Levels ist zu beachten, daß beachtliche Datenmengen anfallen können. Bei Auswahl vieler bis aller Sections sind 20-100 GB schnell im Laufe von 24h erreicht. Das kann dazu führen, daß die Kapazität der Festplatte erschöpft wird und ein Anmelden per GUI nicht mehr möglich ist! | |||
Virusscan | |||
General | |||
|
Der Virenscanner im HTTP-Proxy kann Datenverkehr auf Viren prüfen. Die Funktion lässt sich per CLI deaktivieren oder aktivieren. Per Default ist die Funktion aktiviert. FastDiff Deaktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 0 } FastDiff Aktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 1 } FastDiff Status abfragen:extc value get { application ikarus variable ENABLE_FASTDIFF } application|variable |value -----------+---------------+----- ikarus |ENABLE_FASTDIFF|1 Zusätzlich werden mit der Funktion SigQA neue aber unbekannte Signaturen an unser AV-Labor übermittelt. Die Funktion lässt sich per CLI deaktivieren oder aktivieren. Per Default ist die Funktion aktiviert. SigQA Deaktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 0 } SigQA Aktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 1 } SigQA Status abfragen:extc value get { application ikarus variable ENABLE_SIGQA } application|variable |value -----------+------------+----- ikarus |ENABLE_SIGQA|1 | |||
| Virusscan: | Wł. | The virus scanner is activated and the associated service is running (default setting) |
Datei:UTM v14.1.1 Anwendungen HTTP Proxy Virenscanner-en.png Area Virusscan
|
| Wł. | The virus scanner service is deactivated. The HTTP proxy is not working correctly. The service can be started via the menu Virusscan | ||
| Wł. | The virus scanner service is deactivated. The HTTP proxy is not working correctly. notempty On devices with less than 3GB RAM, the service for the virus scanner cannot start. Please change to current hardware or allocate more RAM! | ||
| Off | The virus scanner is deactivated. | ||
| Maximum scan size limit: | 2 Megabytes | Sets the size of the files to be scanned by the virus scanner | |
| Trickle Time: | 5 seconds | Interval at which data is transferred from the proxy to the browser so that the browser does not stop loading during the virus check | |
| Allowlist ICY-Protokoll: | Off | A web radio protocol that can be excluded from testing | |
| Cache Updates notempty Nowość od v12.7.2 |
Off | When activated Wł., the virus database updates are distributed to the connected clients with Securepoint Antivirus Pro after the initial download. In this way, traffic is reduced and the updates are rolled out smoothly. | |
| Mime type blocklist | application/x-shockwave-flash Example |
Mime types listed here are blocked in any case. The button opens a dialogue in which a mime type can be selected from a dop-down menu or an individual type can be entered. The MIME-Type detection is performed after the first few bytes of the file. Normally, this detection is accurate, and the blocklist is applied accordingly. Additionally, there is a rescan mechanism in place, which re-evaluates the MIME-Type specifically for Microsoft-Compound Storage Formate files. This rescan occurs once the full file is available or when the loaded portion of the file reaches the Virusscanner sizelimit.
| |
Allowlist | |||
| Enabled | The allowlist for MIME types and websites is enabled by default | ||
| Mime-Type Allowlist | application/pkcs10 Example |
Mime types listed here are not scanned. Standard defaults:
| |
|
Exceptions
»^[^:]*://download\.windowsupdate\.com/ |
Here it is possible to create your own filters based on Regular Expressions (Regex). notempty Viruses from these pages are not detected! Some update servers that cause problems when using a virus scanner are already preconfigured. Hint: Further exceptions are necessary so that iTunes can communicate correctly with the internet. | ||
Bandwidth | |||
| Bandwidth limiting policy: | None | Default |  Area Bandwidth
|
| Limit total bandwidth | In this case, the proxy only uses the specified maximum bandwidth and leaves the rest of the bandwidth untouched by your internet connection. (This bandwidth is shared by all hosts connected to the proxy.) | ||
| Per host bandwidth | Bandwidth for each host. The limited bandwidth for hosts cannot exceed the global bandwidth. | ||
| Global bandwidth: | 2.000.000 kbit/s | Default value, if activated | |
| Per host bandwidth: | 64.000 kbit/s | Default value, if activated | |
App Blocking | |||
| The general app blocking with fixed ports has been removed. Individual apps, or the ports they use, can be blocked flexibly via the packet filter. | |||
SSL-InterceptionWith the SSL interception feature, it is possible to recognise malicious code in SSL-encrypted data streams at the gateway. It interrupts the encrypted connections and makes the data packets visible to virus scanners and other filters. Data transmission to the client is then encrypted again. To do this, however, it is necessary to create a CA under and select this in the CA certificate field. | |||
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Applications HTTP-Proxy  SSL Interception tab
|
| Enabled | The SSL-Interception is turned off | ||
| When enabled, only connections blocked by the web filter are intercepted. This avoids the problem that there are sites that do not tolerate an interruption of the encryption (e.g. banking software) without having to define an exception for it. | |||
| Activates the SSL interception | |||
| Validate SNI: |
Yes | When activated, any SNI in the ClientHello of the TLS handshake is checked. The host name contained is resolved and the addresses in the result are compared with the target address of the intercepted request. If they do not match, the connection is closed. Without Server Name Indication validation, clients can manipulate SNI arbitrarily to bypass the web filter. This setting should only be considered as a last resort when it seems impossible to standardize the DNS settings between the HTTP proxy and the UTM clients. If the client and UTM use different DNS servers, this can lead to false positives.
| |
| Allow non identified protocols: | Yes | If this switch is deactivated, unrecognized protocols are blocked. | |
| CA-Certificate: | CA-SSL-Interception | Here, a CA must be selected that can re-encrypt the connection after decryption (and scanning). The public key of the CA must be installed on all client computers that are to use SSL Interception. Download can be done here directly with . notempty
| |
| The public key should be installed on the clients that are going to use SSL interception to avoid certificate errors. | |||
| Peer verification: not for Only webfilter based |
On | This should definitely be enabled! With this, the HTTP proxy checks whether the certificate of the called page is trustworthy. Since the browser only sees the local certificate, a check by the browser is no longer possible. | |
Exceptions for SSL-Interception Exceptions for SSL-Interception | |||
| Enabled | Off | It is possible to define exceptions in the format of Regular Expressions. However, since only https can arrive here, it is not filtered for protocols, unlike the virus scanner. New exceptions can be added directly in the input field. So an exception for www.securepoint.de would be:
.*\.securepoint\.de" notempty
The following applies to the behaviour of regex exceptions in transparent mode when SSL interception is set to Always:
| |
| Compare exceptions with the SNI: Only available if salidate SNI is active. |
Off | Applies Server Name Indication validation only to activated Exceptions of SSL-Interception . | |
| Exceptions: Only in Always mode |
.*\.ttt-point\.de Predefined in the Global Configuration Profile .*\.ikarus\.at.*\.mailsecurity\.at .*91\.212\.136\..* |
Define exceptions here for ttt-point.de | |
Peer verification exceptions Peer verification exceptions only if peer verification is active | |||
| Enabled | Off | Here exceptions for certificate verification in regex format can be added.
| |
Transparent Mode | |||
| Transparent Mode | Wł. | Due to the transparent mode, the proxy is not visible to the clients, the client sees its internet connection (HTTP) as if no proxy was connected in front of it. Nevertheless, the entire HTTP stream goes through the proxy, which means that no settings have to be made on the client. However, there are the same possibilities to analyze / block / filter / manipulate the data stream as if a fixed proxy were used. Each network object or group of network objects that are to use the transparent proxy must be stored here. |
 Area Transparent Mode
|
| Protocol: | HTTP or HTTPS |
Protocol that is used | UTMuser@firewall.name.fqdn Applications HTTP-Proxy Globales Konfigurationsprofil bearbeiten  Adding a Transparent Rule
|
| Type: | INCLUDE | The transparent mode is applied | |
| EXCLUDE | Transparent mode is not applied | ||
| Source: | internal-network | Source network object created under Obszar Network objects | |
| Destination: | internet | Destination network object | |
Advancednotempty
Nowość od 14.2.0 | |||
UTMuser@firewall.name.fqdn Applications HTTP-Proxy Advanced  Advanced settings of the HTTP-Proxy
| |||
| Number of threads: | The number of threads is automatically determined and set | ||
| 4 | The recommended number of threads is the number of cores notempty
More threads than cores are not advised | ||
Add Configuration Profile
notempty
Nowość od v14.1.1
General
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Applications HTTP-Proxy Datei:UTM v14.2.0 Weiteres Konfigurationsprofil Allgemein-pl.pmg The General section in an additional configuration profile
|
|---|---|---|---|
| Name: | Configuration Profile 2 | Specify the name for the configuration profile | |
| Interface | LAN1 | Assign this configuration profile to an interface, e.g., LAN1 | |
| Proxy-Port |
8080 | Is set in the global configuration profile – the input field is disabled here. | |
| Outgoing Address: | The IP address of the interface that the HTTP proxy should use. The Outgoing Address is used for two scenarios:
In this example, the proxy is bound to the faster DSL line:
Connection to a web server in the VPN network:
| ||
| Forward requests to system-wide parent proxy : Is set in the global configuration profile |
Nie | ||
| Logging (Syslog lokal): | Wył. | ||
| Logging (Statistics): Only available if no anonymization for the HTTP proxy Settings at |
Wł. | ||
| Authentication method: | The proxy offers various possibilities for authentication. The possibilities are: | ||
| None | The HTTP proxy processes all requests without authentication | ||
| Basic | With basic authentication, the users are queried against the stored users under Obszar User on the firewall | ||
| NTLM / Kerberos | Here the firewall must be made known to the server. This can be set up in the web interface under | ||
| Radius | Here the firewall must be made known to the server. This can be set up in the web interface under | ||
| Allow access only from local sources: | Tak default |
Access to the HTTP proxy is now only possible from internal sources. These are:
| |
| Allow access to local destinations: | Tak default |
All internal networks can also be reached via the HTTP proxy (the packetfilter has already been passed through to reach the HTTP proxy). Disabling it prevents this and access to other internal networks must be explicitly allowed via the port filter without an HTTP proxy. | |
| Forward Microsoft connection-oriented authentication: | Nie | If it is enabled, login or authentication to websites is possible. For some websites this is not possible otherwise. With this option, NTLM, Negotiate and Kerberos authentications are forwarded notempty
If SSL-Interception is active, this parameter must be enabled for HTTPS-based authentications, otherwise no authentication/login is possible on these websites. | |
Authentication exceptions | |||
| Enabled | Wył. default |
Authentication exceptions are disabled by default.
If enabled: URLs listed here are accessed without prior authentication. |
Section authentication exceptions
|
| Exception (URL): | \.ttt-point\.de | If authentication exceptions are enabled, custom exceptions can be defined here | |
Virusscan | |||
General | |||
|
Der Virenscanner im HTTP-Proxy kann Datenverkehr auf Viren prüfen. notempty Dabei werden mit FastDiff die Viruspattern in Echtzeit aktualisiert. Nowość od v14.1.0 Die Funktion lässt sich per CLI deaktivieren oder aktivieren. Per Default ist die Funktion aktiviert. FastDiff Deaktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 0 } FastDiff Aktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 1 } FastDiff Status abfragen:extc value get { application ikarus variable ENABLE_FASTDIFF } application|variable |value -----------+---------------+----- ikarus |ENABLE_FASTDIFF|1 notempty Zusätzlich werden mit der Funktion SigQA neue aber unbekannte Signaturen an unser AV-Labor übermittelt. Nowość od v14.1.0 Die Funktion lässt sich per CLI deaktivieren oder aktivieren. Per Default ist die Funktion aktiviert. SigQA Deaktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 0 } SigQA Aktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 1 } SigQA Status abfragen:extc value get { application ikarus variable ENABLE_SIGQA } application|variable |value -----------+------------+----- ikarus |ENABLE_SIGQA|1 | |||
| Virusscan: | Wył. | The virus scanner is deactivated, but the associated service is running (default setting) |
 |
| Wł. | The virus scanner is activated and the associated service is running | ||
| Wł. | The virus scanner service is deactivated. The HTTP proxy is not working correctly. The service can be started via the menu Virusscan | ||
| Wł. | The virus scanner service is deactivated. The HTTP proxy is not working correctly. notempty On devices with less than 3GB RAM, the service for the virus scanner cannot start. Please change to current hardware or allocate more RAM! | ||
| Wył. | The virus scanner is deactivated. | ||
| Maximum scan size limit: Is set in the global configuration profile |
2 Megabytes | ||
| Trickle Time: Is set in the global configuration profile |
5 seconds | ||
| Allowlist ICY-Protokoll: | Wył. | A web radio protocol that can be excluded from testing | |
Allowlist | |||
| Enabled | The allowlist for MIME types and websites is enabled by default | ||
| Mime-Type Allowlist Is set in the global configuration profile |
application/pkcs10 Przykład |
||
|
Exceptions
»^[^:]*://download\.windowsupdate\.com/ |
Here it is possible to create your own filters based on Regular Expressions (Regex). notempty Viruses from these pages are not detected! Some update servers that cause problems when using a virus scanner are already preconfigured. Hint: Further exceptions are necessary so that iTunes can communicate correctly with the internet. | ||
| Cache Updates notempty Nowość od v12.7.2 Is set in the global configuration profile |
Wył. | ||
Bandwidth | |||
| Bandwidth limiting policy: | None | Default | Area Bandwidth
|
| Limit total bandwidth | In this case, the proxy only uses the specified maximum bandwidth and leaves the rest of the bandwidth untouched by your internet connection. (This bandwidth is shared by all hosts connected to the proxy.) | ||
| Per host bandwidth | Bandwidth for each host. The limited bandwidth for hosts cannot exceed the global bandwidth. | ||
| Global bandwidth: | 2.000.000 kbit/s | Default value, if activated | |
| Per host bandwidth: | 64.000 kbit/s | Default value, if activated | |
App Blocking | |||
| The general app blocking with fixed ports has been removed. Individual apps, or the ports they use, can be blocked flexibly via the packet filter. | |||
SSL-InterceptionWith the SSL interception feature, it is possible to recognise malicious code in SSL-encrypted data streams at the gateway. It interrupts the encrypted connections and makes the data packets visible to virus scanners and other filters. Data transmission to the client is then encrypted again. To do this, however, it is necessary to create a CA under and select this in the CA certificate field. | |||
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Applications HTTP-Proxy  SSL Interception tab
|
| Enabled | The SSL-Interception is turned off | ||
| When enabled, only connections blocked by the web filter are intercepted. This avoids the problem that there are sites that do not tolerate an interruption of the encryption (e.g. banking software) without having to define an exception for it. | |||
| Activates the SSL interception | |||
| Validate SNI: Is set in the global configuration profile |
Yes | When activated, any SNI in the ClientHello of the TLS handshake is checked. The host name contained is resolved and the addresses in the result are compared with the target address of the intercepted request. If they do not match, the connection is closed. Without Server Name Indication validation, clients can manipulate SNI arbitrarily to bypass the web filter. This setting should only be considered as a last resort when it seems impossible to standardize the DNS settings between the HTTP proxy and the UTM clients. If the client and UTM use different DNS servers, this can lead to false positives.
| |
| Allow non identified protocols: | Yes | If this switch is deactivated, unrecognized protocols are blocked. | |
| CA-Certificate: | CA-SSL-Interception | Here, a CA must be selected that can re-encrypt the connection after decryption (and scanning). The public key of the CA must be installed on all client computers that are to use SSL Interception. Download can be done here directly with . notempty
| |
| The public key should be installed on the clients that are going to use SSL interception to avoid certificate errors. | |||
| Peer verification: not for Only webfilter based Is set in the global configuration profile |
On | This should definitely be enabled! With this, the HTTP proxy checks whether the certificate of the called page is trustworthy. Since the browser only sees the local certificate, a check by the browser is no longer possible. | |
Exceptions for SSL-Interception Exceptions for SSL-Interception | |||
| Enabled | Off | It is possible to define exceptions in the format of Regular Expressions. However, since only https can arrive here, it is not filtered for protocols, unlike the virus scanner. New exceptions can be added directly in the input field. So an exception for www.securepoint.de would be:
.*\.securepoint\.de" notempty
The following applies to the behaviour of regex exceptions in transparent mode when SSL interception is set to Always:
| |
| Compare exceptions with the SNI: Only available if salidate SNI is active. |
Off | Applies Server Name Indication validation only to activated Exceptions of SSL-Interception . | |
| Exceptions: Only in Always mode |
.*\.ttt-point\.de Predefined in the Global Configuration Profile .*\.ikarus\.at.*\.mailsecurity\.at .*91\.212\.136\..* |
Define exceptions here for ttt-point.de | |
Peer verification exceptions Peer verification exceptions only if peer verification is active | |||
| Enabled | Off | Here exceptions for certificate verification in regex format can be added.
| |
Captive Portal
The Captive Portal is configured since v12.1 in its own menu under . There is a separate Wiki-article for this.