When an Astaro (Sophos UTM) Security Gateway runs its web proxy in standard mode, every browser has to be pointed at the proxy. With more than a handful of computers, configuring each one by hand isn’t practical, and static settings cause other problems: laptops need the proxy in the office but not on the road, some websites break when proxied, and you may want internal sites to skip the proxy entirely. The answer is a dynamic proxy configuration.
Use the Web Proxy Auto-Discovery Protocol (WPAD)
WPAD is widely supported by all major browsers and lets administrators push dynamic proxy policies to users. At its core is a configuration script, usually named proxy.pac or wpad.dat, containing one JavaScript function, FindProxyForURL. The browser calls it for every URL and it returns whether to use a proxy, and which one, based on the site or the client’s network location.
Sample PAC Script
This example covers the two most common needs: skip the proxy for certain domains, and use the proxy only when the client is on specific networks. Lines starting with // are comments.
function FindProxyForURL(url, host)
{
// The following domains will not be proxied
if (dnsDomainIs(host, "domain.com")
|| dnsDomainIs(host, "company.com")
|| dnsDomainIs(host, "intranet.mycompany.com")
// Add new domains by customizing the line below:
|| dnsDomainIs(host, "your.domain.here"))
return "DIRECT";
// If the client is on one of these networks, use the proxy
if (isInNet(myIpAddress(), "192.168.0.0", "255.255.0.0"))
return "PROXY 192.168.0.1:8080";
if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0"))
return "PROXY 192.168.0.1:8080";
// Add new networks by customizing and uncommenting these lines:
// if (isInNet(myIpAddress(), "172.16.1.0", "255.255.255.0"))
// return "PROXY 192.168.0.1:8080";
// Clients on any other network connect directly
return "DIRECT";
}
Save the script as proxy.pac or wpad.dat and host it on a web server every workstation can reach. Google’s pactester tool (originally at http://code.google.com/p/pactester/) is handy for testing a script if it isn’t behaving.
How Browsers Find the Script
Browsers offer two automatic options. Either works.
A) Automatic configuration script URL (“Automatic proxy configuration URL” in Firefox, “Use automatic configuration script” in Internet Explorer). The simplest option: enter the full URL of the script, such as http://www.mydomain.com/proxy.pac. The browser downloads it at launch.
B) Auto-detect (“Auto-detect proxy settings for this network” in Firefox, “Automatically detect settings” in IE). The browser discovers the script on its own in one of two ways:
- DNS (most common): create a DNS record named
wpad in your clients’ default domain, pointing to a web server with wpad.dat in its root. If the clients’ domain is internal.mydomain.com, browsers will request http://wpad.internal.mydomain.com/wpad.dat.
- DHCP: configure DHCP option 252 as a text option containing the script URL. Clients receive it with their DHCP lease. This is less common and not every DHCP server supports custom options.
Rolling the Setting Out to Browsers
Whichever method you pick, each browser may still need its setting changed. Here are three approaches.
1. Ask users to make the change. Where users can change their own settings, a clear email with simple instructions works surprisingly well, even for non-technical staff. For example: “Two weeks from today, we’re making a firewall change that requires a browser setting. Without it, you won’t be able to browse the web after the cutoff, but you can make the change any time before then. Please follow these simple instructions…”
2. Active Directory Group Policy. AD administrators can push proxy auto-configuration to Internet Explorer on every domain-joined Windows machine from a central GPO, for users, OUs, or the whole domain. Firefox can be managed the same way with third-party tools: the free FirefoxADM and Wetdog projects provide ADM templates (applied through login scripts or an executable), and FrontMotion offers commercial Firefox MSI packages that read Group Policy settings.
3. Login scripts. This also works in other environments, such as Novell eDirectory. For Internet Explorer, distribute the settings as a registry file, either hard-coded proxy settings or the auto-configuration URL. Include only the lines you need:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000001
"ProxyServer"="10.129.0.1:8080"
"ProxyOverride"="*.local;<local>"
"AutoConfigURL"="http://192.168.0.1/wpad.dat"
Save it as proxy.reg and merge it silently from a login script:
regedit.exe /s proxy.reg
Related: creating a PKCS12 certificate for Sophos UTM 9.
