Allow Outlook to Work Through SafeSquid

Problem

Security teams need predictable control over app and web usage to reduce policy bypass and data-risk exposure.

Benefits

You can enforce policy decisions consistently with SafeSquid while preserving legitimate business workflows.

Advantages

You keep actionable policy control close to operations, with verifiable outcomes in logs and policy behavior.

Call to action

Use the steps in this guide to implement the control, then validate behavior with a real user-flow test.

Problem: Outlook fails when proxy authentication or SSL inspection is enabled

MS Outlook often fails when SafeSquid has authentication (Negotiate or Basic) and/or SSL inspection enabled. SafeSquid is typically deployed behind a firewall that allows only ports 80 and 443; other traffic is blocked. Outlook uses not only HTTP/HTTPS but also SMTP(S), IMAP(S), POP(S), DNS (UDP), and LDAP (389, 636). Blocking those ports or failing to allow them through the firewall breaks Outlook. Outlook supports proxy authentication (Negotiate and Basic) and SSL negotiation with a certificate deployed in Internet Explorer. The fix is to allow the necessary Outlook-related traffic (mail, DNS, LDAP, etc.) in the firewall or on the SafeSquid server and block the rest.

Key benefits

Outlook works through SafeSquid with authentication and SSL inspection enabled. Mail flow continues without weakening proxy policy. Administrators can use iptables on the SafeSquid server or configure the organization firewall to allow the required ports.

Prerequisites

SafeSquid with authentication and/or SSL inspection enabled.
Root or sufficient privilege to configure iptables on the SafeSquid server, or access to the organization firewall to allow the ports listed below.

Call to action

The findings in allowing the Outlook traffic using the iptables rules are shown below: This rule is to allow the established incoming connections to the server

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

This rule is to allow the loopback connections to the server

iptables -A INPUT -i lo -m comment --comment "Allow loopback connections" -j ACCEPT

This rule is to allow the incoming ping requests to the server

iptables -A INPUT -p icmp -m comment --comment "Allow Ping to work as expected" -j ACCEPT

This rule is to allow the incoming connections on the following ports to the server, 22(SSH), **25(SMTP), 53(DNS), 110(POP), 389(LDAP), 587(SMTPS), 636(LDAPS), 953(RNDC), 993(IMAPS), 995(POP3S)

iptables -A INPUT -p tcp -m multiport --dports 22,25,53,110,389,465,587,636,953,993,995 -j ACCEPT

This rule is to allow the incoming connections on the following ports to the server, 1023(Reserved), **3268(MSGC), 3269(MSGCS), 5222(XMPP client connections), 5269(XMPP server-to-server), 5280(XMPP over synchronous HTTP), 8080(SafeSquid port)

iptables -A INPUT -p tcp -m multiport --dports 1023,3268,3269,5222,5269,5280,8080 -j ACCEPT

:::note Note that both the above rules are one and the same excepting the ports. iptables will not allow us to add all the above-mentioned ports at one go, which is the reason to separate them into two rules ::: This rule is to allow the incoming UDP connections to the server on the following ports, 53(DNS), 953(RNDC)

iptables -A INPUT -p udp -m multiport --dports 53,953 -j ACCEPT

This rule is to allow the established outbound connections from the server

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

This rule is to allow the loopback connections from the server

iptables -A FORWARD -i lo -m comment --comment "Allow loopback connections" -j ACCEPT

This rule is to allow the ping outside from the server

iptables -A FORWARD -p icmp -m comment --comment "Allow Ping to work as expected" -j ACCEPT

This rule is to allow the connections on the following ports from the server, 22(SSH), 25(SMTP), 53(DNS), 110(POP), 389(LDAP), 587(SMTPS), 636(LDAPS), 953(RNDC), 993(IMAPS), 995(POP3S) iptables -A FORWARD -p tcp -m multiport —dports 22,25,53,110,389,465,587,636,953,993,995 -j ACCEPT This rule is to allow the connections on the following ports from the server, 1023(Reserved), 3268(MSGC), 3269(MSGCS), 5222(XMPP client connections), 5269(XMPP server-to-server), 5280(XMPP over synchronous HTTP), 8080(SafeSquid port)** iptables -A FORWARD -p tcp -m multiport —dports 1023,3268,3269,5222,5269,5280,8080 -j ACCEPT** This rule is to allow the UDP connections from the server on the following ports 53(DNS), 953(RNDC)

iptables -A FORWARD -p udp -m multiport --dports 53,953 -j ACCEPT

This rule is to DROP the remaining input traffic to the server

iptables -P INPUT DROP

This rule is to drop the forward output traffic from the server

iptables -P FORWARD DROP

The above iptables rules are enough for Outlook to work in an environment where authentication and/or SSL inspection in SafeSquid are enabled.

SSL Inspection

Authentication

Profiling Engine

DNS Security

Malware Scanning

Access Restriction

Content Modifier

Cookie Inspection

Header Rewrite

URL Redirection

Data Leakage Prevention

Audit & Forensics

Integrations

Performance Acceleration

Customisation

Allow Outlook to Work Through SafeSquid

Problem

Benefits

Advantages

Call to action

Problem: Outlook fails when proxy authentication or SSL inspection is enabled

Key benefits

Prerequisites

Call to action

​Problem

​Benefits

​Advantages

​Call to action

​Problem: Outlook fails when proxy authentication or SSL inspection is enabled

​Key benefits

​Prerequisites

​Call to action

Problem

Benefits

Advantages

Call to action

Problem: Outlook fails when proxy authentication or SSL inspection is enabled

Key benefits

Prerequisites

Call to action