This is not a bug but intended behavior of standard and user authenticated mode proxies. The standard mode proxy will only proxy services on the allowed target services list when the client browser is set to point to the ASG as a proxy address with the designated proxy port (1024 - 65535 range) default of 8080.
If you want port 80 transparently proxied set the http proxy to transparent mode.
I am trying to determine why some of the applications don't work, don't have errors in either the PF or the http/s logs. The only answer I could workout is that they ignore proxy setting.
Back to the drawing board.
Ian M Maybe I am looking for the wrong thing. Window 7 automatic updates send packets out on ports 80 and 443 even though it is configured to use the http proxy. Some of the traffic goes out through the proxy, but not all.
Ian, if you're not using transparent mode, how about trying the following?
- Duplicate the settings in 'HTTP/S' in a Profile.
- Change 'HTTP/S' to "Transparent mode" and lock it down do that nothing gets through.
- Stop allowing 'Internal (Network) -> Websurfing -> Any' traffic with a packet filter rule.
- Watch the 'Content Filter (HTTP)' log to see what you need to unblock in 'HTTP/S'.
Still, I'm surprised that Microsoft would release a program that doesn't use the LAN settings in Internet Options.
Cheers - Bob
PS I'm glad we have brave souls like RFCat_vk to test new Microsoftware!
My standard Packet filter rule is 1030:65535 - 1:65535 eg nothing below 1030 gets out without using a proxy or a special rule.
My experiments don't show anything in the http log but rejected packets for ports 80 and 443 in the PF log.
While the attached snapshot shows green packets I did that to allow my W7 PC to update. My son is actually using the W7 64 bit for his gaming PC and he is very happy with it, very reliable especially compared to my Vista 64 PC.
Doing it with packet filter rules certainly works: 'Internal (Network) -> [80,443] -> [203.206.0.0/16]'.
I only made the HTTP/S suggestion because I was looking for more input on an overall theory for implementing Web Security. My current thinking is that the base/default always should be in transparent mode, and that it should include the strictest limitations. I don't feel like I've tested that idea enough though.
