Lion Cipher Lab
Control outbound traffic with a Squid egress proxy
- Cyber / Security Engineer
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most networks are wide open on the way OUT. Firewalls are configured to keep bad traffic from coming IN, but by default they let a host talk to anything on the internet. That default is exactly how an intrusion turns into a breach: malware 'phones home' to a command-and-control (C2) server to get instructions, and stolen data is exfiltrated out to an attacker-controlled endpoint. Both are OUTBOUND connections. Egress control flips the default from allow-anything to default-deny: a host may reach only an approved list of destinations, and everything else is refused and logged. A forward proxy…
What you'll learn
- what egress control is and why default-deny outbound cuts off C2 and exfiltration
- what a forward proxy is and how it differs from DNS filtering and firewall egress rules
- running Squid as a disposable forward proxy in a Docker container on port 3128
- measuring egress reachability before/after with `curl -x` through the proxy
- writing a dstdomain ACL that reads an allowed-domains file
- the top-down http_access rule order and why `http_access deny all` must come last
- reading /var/log/squid/access.log: TCP_.../200 for allowed vs TCP_DENIED/403 for denied
- the hard limits: a proxy only sees traffic CONFIGURED to use it, and HTTPS path invisibility without SSL-bump
- why an allowlist beats a blocklist for egress, and why a proxy must be paired with a DROP-all-else firewall
Steps in this lab
- What egress control is, and why a forward proxy is one way to do it
- When a proxy is the right tool for egress — and when it is not
- Stand up a disposable Squid forward proxy in Docker
- BEFORE: measure egress — two arbitrary sites are reachable
- AFTER: write the allowlist — an allowed-domains file and a dstdomain ACL
- AFTER: measure egress again — only the allowlisted domain gets through
- PROVE it and read the evidence: access.log
- The hard limits — and why a proxy is never the whole wall