Fri May 27, 2016 10:07 pm
The only way to use the proxy to filter out HTTPS websites is to have each client configure the proxy settings for their computers, then you can have the necessary accept and deny rules. The reason for this is because you cannot intercept HTTPS traffic transparently, the computer will detect this and throw a warning up, as it should since you are in essence doing a man in the middle attack.
There are a couple of other options open to you, neither is perfect.
1.) Force the end users to use your DNS servers and configure the DNS server in such a way that it will only return valid IP addresses for domains that you want, and an invalid IP for domains you don't want. This can be bypassed however by the end user putting the IP address directly into their browser, or them editing their host file.
2.) Figure out the IP address of the server(s) you want to allow, and deny everything else.