- [Instructor] Squid is an open source application
proxy firewall software solution
for hypertext transfer protocol or HTTP.
It has many features
but we'll focus on the website blocking functionality.
What is an application proxy firewall?
Static packet filtering or SPF
and stateful packet inspection or SPI firewalls
are not able to inspect application data
in a network packet.
They only look at the heathers of the network packets.
If they should also inspect the payload
or content of the packets,
it's simply too much data to handle
for these SPF and SPI firewalls.
This is why we need a separate firewall
dedicated to looking at only the data segment of the packets
that is application firewalls
focus on examining the application data
delivered by each network packet.
One more thing to note
is that these application firewalls
are also application or protocol specific.
In the case of Squid it's specialty is HTTP.
Here's a diagram we can use to think more deeply about
what an application proxy firewall does.
The architecture consists of three elements,
HTTP client, HTTP proxy and HTTP server.
Three HTTP client that is usually
a web browser like Microsoft edge.
An HTTP proxy looks like a web server.
To the HTTP or web server,
an HTTP proxy looks like a client or a web browser.
Therefore the HTTP proxy is acting like a middleman
intercepting HTTP request from an HTTP client
and passing it on to an HTTP server.
At the same time from the HTTP server
it will be receiving packets just like HTTP clients
and then passing them on to the actual HTTP client.
After all that's why Squid is called HTTP proxy.
Proxy servers monitor application message exchanges,
examine the message content,
and take actions based on security rules.
An example of such an action is blocking a website.
If you don't want your employees
to do online shopping during their work hours,
you can install a proxy server to monitor the HTTP traffic.
When the proxy server detects
an unwanted domain name in the HTTP packet,
it can intercept the HTTP request
and respond to the web browser
by displaying a message like
you're prohibited to visit an XYZ site.
In our example network,
the best place for an HTTP proxy firewall
is within the DMZ
because the HTTP proxy will be
exposed to the outside HTTP servers.
When it delivers the HTTP packets from the HTTP clients,
we cannot completely isolate it
which is why we keep it in our DMZ.