Squid can be configured as a MitM SSL Bump proxy and it can filter URL's, content type, mime-types, etc... but you have to generate your own self signed CA cert

Squid can be configured as a MitM SSL Bump proxy and it can filter URL's, content type, mime-types, etc... but you have to generate your own self signed CA cert and install it on the devices that would be using it. The configuration varies by version a little so try to find examples specific to the version of Squid that is available in your OS repository. Here [1] are some basic instructions that include a few version config diffs. The few sites that do public key pinning will not work with this and will have to be configured in Squid as NoBump. Paypal, a few google sub-domains, eff.org. Most sites have abandoned public key pinning. Squid can be installed on most operating systems and it does not have to be the home or business router. One can configure DHCP to tell specific devices by mac address or vendor type to use a different gateway. Those devices will need your self signed CA cert. [1] - https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBum...