What is the difference between a transparent proxy and an explicit proxy?
In a transparent proxy, the client cannot detect that there is a proxy in between the client and the real server just by looking at the destination IP address in the packets sent. If the client performs a DNS lookup in the client's network and elsewhere on the internet, the IP address in the DNS answer will be the same.
In an explicit proxy, the client can tell that there is an intermediary by looking at the destination IP address in the packets sent from the client. If the client performs a DNS lookup in the client's network and elsewhere on the internet, the IP addresses will be different.
A couple of assumptions:
- If there are geo specific IP addresses, then obviously the DNS look up else where on the internet will give different answers. If that is the case, I am assuming the client will compare the destination IP in the outgoing packet with the DNS answer for the same geo.
- If there are multiple IPs in the DNS response for the same geo, the client will have the ability to tell that it is connecting to one of them.
Usually to get the transparent proxy work, there is some routing adjustments need to be done in the proxy server and possibly in the client as well. This page gives a great overview of transparent proxy. And this page walks you through the steps needed to implement transparent proxy in Squid.
If the transparent proxy also terminates TLS connections to inspect or manipulate payload, you need to trust the certificate authority of the transparent proxy in the client. This can be done by one of the means below:
- User importing the certificate authority certificate (CA cert) in the trust store of the client.
- An agent program is running in the client that automatically updates the trust store of the client.