Litmus Forward Proxy

overview the forward proxy is a containerized http/https proxy with a web ui machines on a restricted network route outbound traffic through it instead of reaching the internet directly from the browser you set which source networks may connect, which domains are blocked, and see what traffic is flowing the engine is squid every change is validated before it is saved, so a bad edit cannot take the proxy offline use it to give a plant network one controlled exit point a single host allowed outbound at the firewall, only approved source networks permitted, every request logged, and repeated downloads served from a local cache getting started run on any litmusedge device docker run d name forwardproxy restart unless stopped p 3128 3128 p 3130 3130 v squid conf /etc/squid v squid logs\ /var/log/squid v squid cache /var/spool/squid v viewer data /var/lib/squidviewer e ui username=admin e ui password=\<your password> us docker pkg dev/litmus customer facing/litmus solutions/forwardproxy 0 5 0 navigate to the {edgeurl} 3130 and sign in with the username and password you set clients point at {edgeurl} 3128 , which is the proxy itself notes on the command above set a real password there is no default, and an empty ui password starts the ui unauthenticated pin the version tag an orchestrator that caches latest will serve an older build and report success keep all four volumes , or rules, logs, and the password are lost when the container is recreated add platform linux/amd64 on an arm host container ports are fixed at 3128 and 3130 if litmus edge maps them itself, use the host ports from the container detail view how to route traffic through the proxy step 1 allow your client networks on the rules page, add the networks permitted to use the proxy, then click reload squid the shipped configuration allows 10 0 0 0/8 , 172 16 0 0/12 , 192 168 0 0/16 , and 127 0 0 1/32 , and clients outside those ranges are refused with 403 a cidr network or a single address is accepted, ipv4 or ipv6 step 2 pointing litmus edge itself at the proxy follow configure an https proxy docid\ baykou6xos i8n9h1uigb navigate to system > network , select the proxy tab, click add proxy on the tile for each component you need (device management, authentication, licensing), and enter http //\<edge ip> 3128 two related behaviors litmus edge manager registration does a raw tls dial that ignores the proxy, so it needs one time direct reachability to the lem, and wireguard remote access uses udp port 51820 and cannot traverse an http proxy step 3 verify curl x http //\<edge ip> 3128 http //example com curl x http //\<edge ip> 3128 https //example com both should return the page, and both should appear on the logs page a tcp denied/403 line means the proxy received the request and refused it, almost always because the client address is not in an allowed network step 4 block domains (optional) on the rules page, add domains the proxy should refuse even for an allowed client, then click reload squid paste a full url and the domain is extracted for you a leading dot matches subdomains, so example com blocks everything beneath it other deployment options docker compose cd docker compose , cp env example env , set ui password , then docker compose up d env holds ui username , ui password , squid publish port , and ui publish port air gapped host docker load i forwardproxy tar gz on the target the ui fetches no external assets, so it works fully offline lem marketplace upload forwardproxy tar gz to the lem docker registry, import the listing under features > marketplace , then deploy supplying ui password web ui page what it does rules allowed source networks and blocked domains config full squid conf editor validate parses, save writes only if it parses, reload squid applies also sets the configuration path, log path, and proxy address stats requests, bytes, cache hit ratio, top domains, methods, and status codes, over the last 20,000 log lines logs live tail of the access log, last 200 lines by default password set or change the sign in password a configuration squid would reject is never written if a reload fails, the page shows squid's first fatal line and the proxy keeps serving its previous configuration a password set in the ui is stored hashed and takes precedence over ui password , so an operator can secure a deployment without touching the container changing it signs out every session, including your own troubleshooting connection refused wrong host or port confirm the published port with docker ps request denied with 403 the client address is outside the allowed networks add it on the rules page, then reload squid nat changes the source address, so take it from the log line one site denied, others work the domain is blocked, or the site uses a port other than 80 or 443 web ui not reachable run docker exec forwardproxy supervisorctl c /etc/supervisor/conf d/supervisord conf status and expect squid , viewer , and logrotate all running changes saved but behavior unchanged click reload squid locked out of the ui recreate the container with a new ui password and remove the settings volume, since a stored password takes precedence rules or logs lost after redeploy a volume was not mounted to separate a client problem from a proxy problem, test from the proxy host itself a 200 means the proxy works and the problem is between the client and the proxy docker exec forwardproxy curl s o /dev/null w '%{http code}\n' x http //127 0 0 1 3128 http //example com security considerations the web ui is an administrative tool for a trusted operator on a trusted network do not expose the proxy port to the internet an open forward proxy will be found and abused do not expose the ui port outside a trusted network bind it to localhost and reach it over ssh or a vpn, or put it behind an authenticating tls reverse proxy terminate tls in front of the ui the credential is sent in the clear over plain http with tls in front, set session cookie secure=1 anyone with ui access controls the proxy the blast radius is the container it mounts no docker socket and holds no host credentials no rate limiting or account lockout on sign in reference defaults setting value proxy port 3128 web ui port 3130 configuration /etc/squid/squid conf access log /var/log/squid/access log , rotated daily, 5 generations kept cache /var/spool/squid , 500 mb, 2 mb maximum object size allowed sources 10 0 0 0/8 , 172 16 0 0/12 , 192 168 0 0/16 , 127 0 0 1/32 allowed ports 80 for http, 443 for https connect image us docker pkg dev/litmus customer facing/litmus solutions/forwardproxy , linux/amd64 only environment variables variable default description ui username admin sign in username ui password (unset) sign in password unset serves every page unauthenticated superseded by a password set in the ui session max age 43200 session lifetime in seconds session cookie secure (unset) set to 1 when the ui is served over https log lines 200 log lines shown by default max log lines 5000 upper bound on the lines query parameter stats lines 20000 log lines analyzed for the stats page the configuration path, log path, and proxy address have variables too ( squid conf path , squid log path , squid host , squid port ), but the config page sets them, persists them, and overrides the variable volumes mount holds /etc/squid squid conf the shipped default is restored if the volume is empty /var/log/squid access log , what logs and stats read /var/spool/squid disk cache /var/lib/squidviewer paths set from the ui, and the hashed password anything not on a volume is lost when the container is recreated