This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WPAD vs Manual Configuration - Firefox

Hi guys,

I am actually planning a fast an easy to implement my proxy on firefox using FirefoxADM (To manage firefox from GPO) and WPAD file.

So I have my proxy actually configured in Transparent mode and a profile configured in AD SSO (This is the profile that my users are going to use when they will have they browers configured. I am already using as for testing). But I see something pretty odd. When I configure firefox using the manual proxy configuration :

I can see the usernames passing in the HTTP/S live log. (Which is correct). But when I use the automatic proxy configuration URL pointing to my WPAD file containing :


function FindProxyForURL(url, host) {



// Skip the proxy application for the following url's



	if (shExpMatch(url, "*.arborite.com:*/*") ||

		shExpMatch(url, "*.microsoft.com") ||

		shExpMatch(url, "*.windowsupdate.com") ||

		shExpMatch(url, "*.symantec.com"))

	{

		return "DIRECT";

	}

	else 

		return "PROXY monfw01.arborite.com:8080; DIRECT;"; //Fail-over order

}

I do not see the usernames in the HTTP/S live log. Only the IP addresses.

Any ideas? I would surely like more to use the wpad file so we can skip our internal addresses from passing into the astaro...

Thanks,
MojoQC

This thread was automatically locked due to age.

Parents

0 wingman over 15 years ago
Hi guys,

I am actually planning a fast an easy to implement my proxy on firefox using FirefoxADM (To manage firefox from GPO) and WPAD file.

So I have my proxy actually configured in Transparent mode and a profile configured in AD SSO (This is the profile that my users are going to use when they will have they browers configured. I am already using as for testing). But I see something pretty odd. When I configure firefox using the manual proxy configuration :

I can see the usernames passing in the HTTP/S live log. (Which is correct). But when I use the automatic proxy configuration URL pointing to my WPAD file containing :

function FindProxyForURL(url, host) {

// Skip the proxy application for the following url's

if (shExpMatch(url, "*.arborite.com:*/*") ||
shExpMatch(url, "*.microsoft.com") ||
shExpMatch(url, "*.windowsupdate.com") ||
shExpMatch(url, "*.symantec.com"))
{
return "DIRECT";
}
else
return "PROXY monfw01.arborite.com:8080; DIRECT;"; //Fail-over order
}

I do not see the usernames in the HTTP/S live log. Only the IP addresses.

Any ideas? I would surely like more to use the wpad file so we can skip our internal addresses from passing into the astaro...

Thanks,
MojoQC

I would propose to use the following

function FindProxyForURL(url, host)
{
// variable strings to return
var proxy_yes = "PROXY monfw01.arborite.com:8080";
var proxy_no = "DIRECT";
if (shExpMatch(url, "*.arborite.com")) { return proxy_no; }
if (shExpMatch(url, "*.microsoft.com")) { return proxy_no; }
if (shExpMatch(url, "*.symantec.com")) { return proxy_no; }
if (shExpMatch(url, "*.windowsupdate.com")) { return proxy_no; }
// Proxy if PC is on local LAN
if (isInNet(myIpAddress(), "192.168.5.0", "255.255.255.0"))
return "PROXY monfw01.arborite.com:8080";
else
return "DIRECT";
}

that will also check whether the proxy should be turned on (it will be on if you are part of the 192.168.5.0 [:)] )
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 wingman over 15 years ago
Hi guys,

I am actually planning a fast an easy to implement my proxy on firefox using FirefoxADM (To manage firefox from GPO) and WPAD file.

So I have my proxy actually configured in Transparent mode and a profile configured in AD SSO (This is the profile that my users are going to use when they will have they browers configured. I am already using as for testing). But I see something pretty odd. When I configure firefox using the manual proxy configuration :

I can see the usernames passing in the HTTP/S live log. (Which is correct). But when I use the automatic proxy configuration URL pointing to my WPAD file containing :

function FindProxyForURL(url, host) {

// Skip the proxy application for the following url's

if (shExpMatch(url, "*.arborite.com:*/*") ||
shExpMatch(url, "*.microsoft.com") ||
shExpMatch(url, "*.windowsupdate.com") ||
shExpMatch(url, "*.symantec.com"))
{
return "DIRECT";
}
else
return "PROXY monfw01.arborite.com:8080; DIRECT;"; //Fail-over order
}

I do not see the usernames in the HTTP/S live log. Only the IP addresses.

Any ideas? I would surely like more to use the wpad file so we can skip our internal addresses from passing into the astaro...

Thanks,
MojoQC

I would propose to use the following

function FindProxyForURL(url, host)
{
// variable strings to return
var proxy_yes = "PROXY monfw01.arborite.com:8080";
var proxy_no = "DIRECT";
if (shExpMatch(url, "*.arborite.com")) { return proxy_no; }
if (shExpMatch(url, "*.microsoft.com")) { return proxy_no; }
if (shExpMatch(url, "*.symantec.com")) { return proxy_no; }
if (shExpMatch(url, "*.windowsupdate.com")) { return proxy_no; }
// Proxy if PC is on local LAN
if (isInNet(myIpAddress(), "192.168.5.0", "255.255.255.0"))
return "PROXY monfw01.arborite.com:8080";
else
return "DIRECT";
}

that will also check whether the proxy should be turned on (it will be on if you are part of the 192.168.5.0 [:)] )
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 ratz over 15 years ago in reply to wingman

Use the following PAC file template if you only have 1 lan segment the proxy is hosting and you want the ftp proxy to work as well.

[HTML]
function FindProxyForURL(url, host)
{

// PAC file to make FTP work in web browsers.
// To make this work set your ASG FTP Proxy mode to "both".

//**** Set these variables as needed don't forget your " "'s  ****

var astaro_ip_address = "192.168.100.254";
var astaro_proxy_port = "8080";
var local_subnet = "192.168.100.0";
var local_mask = "255.255.255.0";

// array of non-local host domains to not proxy for aka proxy incompatible.
var bypass_hosts = ["*.local*","*domain.com*"];

// Set to 1 if you use any transparent http modes in combination with authentication.
// Set to 0 if you ONLY use authentication modes on your HTTP proxy.
var use_browser_failover = 1;

//**** Stop editing here unless you know what you are doing. ****

// Build the strings we need.
var proxy_yes = "PROXY " + astaro_ip_address + ":" + astaro_proxy_port;
var proxy_yes_with_failover = proxy_yes + "; DIRECT";
var proxy_no = "DIRECT";

// Array of commonly used private networks that can't be outside the proxy
var privateNets = ["192.168.0.0", "10.0.0.0", "172.16.0.0",  "127.0.0.0"];
var privateMasks= ["255.255.0.0","255.0.0.0", "255.240.0.0", "255.255.255.0"];

// If URL has no dots in host name, send traffic direct.
if (isPlainHostName(host)) { return proxy_no; }

// If specific URL needs to bypass proxy, send traffic direct.
for ( var chk_host in bypass_hosts )
{
if (shExpMatch(url,chk_host)) { return proxy_no; }
}

// If IP address is internal or hostname resolves to internal IP, send direct.
var resolved_ip = dnsResolve(host);
for (i=0; i, privateMasks)) {return proxy_no;}
}

// If the url is an FTP request then force it direct so it uses transparent ftp proxy.
if (shExpMatch(url, "ftp:*"))  { return proxy_no; }

// If not on internal/LAN IP address, send traffic direct.
if (!isInNet(myIpAddress(), local_subnet, local_mask)) { return proxy_no; }

// All other traffic uses proxies, in fail-over order if specified.
if ( use_browser_failover == 1)
return proxy_yes_with_failover;
else
return proxy_yes;

}

[/HTML]

If your proxy serves multiple discrete LANs that are isolated from each other then use this pac file template.

[HTML]
function FindProxyForURL(url, host)
{

// PAC file to make FTP work in web browsers.
// To make this work set your ASG FTP Proxy mode to "both".
// This template support proxying for multiple isolated LANs.

//**** Set these variables as needed don't forget your " "'s  ****

var astaro_proxy_port="8080";

// local subnets and their masks that we want to proxy for.
var local_subnets = ["192.168.100.0","192.168.253.0"];
var local_masks = ["255.255.255.0","255.255.255.0"];

// Astaro proxy ip Address on each subnet respectively
var astaro_ip_address=["192.168.100.254","192.168.253.1"];

// array of non-local host domains to not proxy for aka proxy incompatible.
var bypass_hosts = ["*.local*","*domain.com*"];

// Set to 1 if you use any transparent http modes in combination with authentication.
// Set to 0 if you ONLY use authentication modes on your HTTP proxy.
var use_browser_failover = 1;

//**** Stop editing here unless you know what you are doing. ****

// Build the strings we need.
var proxy_no = "DIRECT";

// array of commonly used private networks that can't be outside the proxy
var privateNets = ["192.168.0.0", "10.0.0.0", "172.16.0.0",  "127.0.0.0"];
var privateMasks= ["255.255.0.0","255.0.0.0", "255.240.0.0", "255.255.255.0"];

// If URL has no dots in host name, send traffic direct.
if (isPlainHostName(host)) { return proxy_no; }

// If specific URL needs to bypass proxy, send traffic direct.
for ( var chk_host in bypass_hosts )
{
if (shExpMatch(url,chk_host)) { return proxy_no; }
}

// If IP address is internal or hostname resolves to internal IP, send direct.
var resolved_ip = dnsResolve(host);
for (i=0; i, privateMasks)) {return proxy_no;}
}

// If the url is an FTP request then force it direct so it uses transparent ftp proxy.
// Make sure ASG FTP proxy mode is set to both.
if (shExpMatch(url, "ftp:*"))  { return proxy_no; }


// If on an internal/LAN IP address, send traffic to proxy.
for (i=0; i , local_masks))
{
if ( use_browser_failover == 1)
return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port + "; DIRECT");
else
return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port);
}
}

// All other traffic uses direct.
return proxy_no;

}
[/HTML]
Cancel
Vote Up 0 Vote Down

Cancel

0 ratz over 15 years ago in reply to ratz

It never fails post some code and you'll immediately find a new bug, usually an Internet Explorer bug. And so I've re-written code to be more robust

Note: Yes these could be tighter; but they are meant to be readable and maintainable by people that come after you. Our testing shows no measurable performance hit from having these more readable versions.

If you host only 1 lan segment here's the template:


function FindProxyForURL(url, host)
{
	// PAC file to make FTP work in web browsers. 
	// To make this work set your ASG FTP Proxy mode to "both".
	// This template supports proxying for a single LAN

	// Note: This is very universal JavaScript as validated by http://jslint.com
	// if you know your environment, you could optimize this to be much denser
	// code but on modern CPUs You will hardly notice the impact.

	/*global isPlainHostName: false, shExpMatch: false, dnsResolve: false, isInNet: false, myIpAddress: false */

	//**** Set these variables as needed don't forget your " "'s  ****

	var astaro_proxy_port = "8080",
	local_subnet = "192.168.0.0",
	local_mask = "255.255.255.0",	
	astaro_ip_address = "192.168.0.1",
	
	 // array of non-local host domains to not proxy for aka proxy incompatible.
	bypass_hosts = [ "*.local*", "*domain.com*"], 
	
	// Set to 1 if you use any transparent http modes in combination with authentication.
	// Set to 0 if you ONLY use authentication modes on your HTTP proxy.
	use_browser_failover = 1,   
	
	// Set to 1 to run traffic from machine with misconfigured host files through the proxy
	// Set to 0 to run traffic direct or through the Transparent Proxy.
	proxy_misconfigured_hostfile = 1, 
	
	//**** Stop editing here unless you know what you are doing. ****
	


	// Build the strings we need.
	i = 0,
	resolved_ip = "",
	host_ip = "",
	chk_host = "",
	proxy_no = "DIRECT",

	// Array of commonly used private networks that can't be outside the proxy
	privateNets = ["192.168.0.0", "10.0.0.0", "172.16.0.0",  "127.0.0.0"],
	privateMasks = ["255.255.0.0", "255.0.0.0", "255.240.0.0", "255.255.255.0"];

	// If URL has no dots in host name, send traffic direct.
	if (isPlainHostName(host)) {
		return proxy_no; 
	}

	// If specific URL needs to bypass proxy, send traffic direct.
	for (chk_host in bypass_hosts) {
		if (shExpMatch(url, chk_host)) {
			return proxy_no;
		}
	}

	// If IP address is internal or hostname resolves to internal IP, send direct.
	// Resolve host to ip address to work around IE 8 bug.
	resolved_ip = dnsResolve(host);
	for (i = 0; i , privateMasks)) {
			return proxy_no;
		}
	}

	// If the url is an FTP request then force it direct so it uses transparent ftp proxy.
	if (shExpMatch(url, "ftp:*"))  {
		return proxy_no; 
	}

	// If on an internal/LAN IP address, send traffic to proxy.
	host_ip = myIpAddress();	             
	if (isInNet(host_ip, local_subnet, local_mask)) {
		if (use_browser_failover) {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port + "; DIRECT");
		} else {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port);
		}
	}
	
	// Test for a misconfigured host file where: "machineName -> 127.0.0.1" assume we want to proxy
	// 127.0.0.1 should only ever be tied to "localhost" some software vendors don't seem to understand
	// that. INTEL being one of the chief culprits with their AMT Software.
	if ((host_ip = "127.0.0.1") && (proxy_misconfigured_hostfile = 1)) {
		if (use_browser_failover) {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port + "; DIRECT");
		} else {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port);
		}
	}
	
	// All other traffic uses direct.
	return proxy_no;
}

[/CODE]




If you host multiple lan segments.



function FindProxyForURL(url, host)
{
	// PAC file to make FTP work in web browsers. 
	// To make this work set your ASG FTP Proxy mode to "both".
	// This template support proxying for multiple isolated LANs.
	
	// Note: This is very universal JavaScript as validated by http://jslint.com
	// if you know your environment, you could optimize this to be much denser
	// code but on modern CPUs You will hardly notice the impact.
	
	/*global isPlainHostName: false, shExpMatch: false, dnsResolve: false, isInNet: false, myIpAddress: false */
	
	//**** Set these variables as needed don't forget your " "'s  ****
	
	var astaro_proxy_port = "8080",
	
	// local subnets and their masks that we want to proxy for.
	local_subnets = [ "192.168.0.0", "192.168.4.0" ],
	
	local_masks = [ "255.255.255.0", "255.255.255.0" ],	
	
	// Astaro proxy ip Address on each subnet respectively
	astaro_ip_address = [ "192.168.0.1", "192.168.4.1" ],
	
	 // array of non-local host domains to not proxy for aka proxy incompatible.
	bypass_hosts = [ "*.local*", "*domain.com*", "*foo.net*" ], 
	
	// Set to 1 if you use any transparent http modes in combination with authentication.
	// Set to 0 if you ONLY use authentication modes on your HTTP proxy.
	use_browser_failover = 1,   
	
	// Set to 1 to run traffic from machine with misconfigured host files through the proxy
	// Set to 0 to run traffic direct or through the Transparent Proxy.
	proxy_misconfigured_hostfile = 1, 
	
	//**** Stop editing here unless you know what you are doing. ****
	
	
	
	// Build the strings we need.
	i = 0,
	resolved_ip = "",
	host_ip = "",
	chk_host = "",
	proxy_no = "DIRECT",
	
	
	// array of commonly used private networks that can't be outside the proxy
	privateNets = ["192.168.0.0", "10.0.0.0", "172.16.0.0", "127.0.0.0"],
	privateMasks = ["255.255.0.0", "255.0.0.0", "255.240.0.0", "255.255.255.0"];
	
	// If URL has no dots in host name, send traffic direct.
	if (isPlainHostName(host)) {
		return proxy_no;
	}
	
	// If specific URL needs to bypass proxy, send traffic direct.
	for (chk_host in bypass_hosts) {
		if (shExpMatch(url, chk_host)) {
			return proxy_no;
		}
	}
	
	// If URL Host IP address is internal or hostname resolves to internal IP, send direct.
	// Resolve host to ip address to work around IE 8 bug.
	resolved_ip = dnsResolve(host);
	for (i = 0; i , privateMasks)) {
			return proxy_no;
		}
	}
	
	// If the url is an FTP request then force it direct so it uses transparent ftp proxy.
	// Make sure ASG FTP proxy mode is set to both.
	if (shExpMatch(url, "ftp:*")) {
		return proxy_no;
	}
	
	hostip = myIpAddress();	             
	// If on an internal/LAN IP address, send traffic to proxy.
	for (i = 0; i , local_masks)) {
			if (use_browser_failover) {
				return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port + "; DIRECT");
			} else {
				return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port);
			}
		}
	}
	
	// Test for a misconfigured host file where: "machineName -> 127.0.0.1" assume we want to proxy
	// 127.0.0.1 should only ever be tied to "localhost" some software vendors don't seem to understand
	// that. INTEL being one of the chief culprits with their AMT Software.
	
	if ((hostip = "127.0.0.1") && (proxy_misconfigured_hostfile = 1)) {
		if (use_browser_failover) {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port + "; DIRECT");
		} else {
			return ("PROXY " + astaro_ip_address + ":" + astaro_proxy_port);
		}
	}
	
	// All other traffic uses direct.
	return proxy_no;
	
}
[/CODE]




A slightly tighter version of the 1 segment code for those that are stubborn.


function FindProxyForURL(url, host)
{
	// PAC file to make FTP work in web browsers. 
	// To make this work set your ASG FTP Proxy mode to "both".
	// This template supports proxying for a single LAN

	/*global isPlainHostName: false, shExpMatch: false, dnsResolve: false, isInNet: false, myIpAddress: false */


	//**** Set these variables as needed don't forget your " "'s  ****

	var local_subnet = "192.168.0.0",
	local_mask = "255.255.255.0",	
	proxy_yes = "PROXY 192.168.0.1:8080; DIRECT",
	proxy_no = "DIRECT",

	 // array of non-local host domains to not proxy for aka proxy incompatible.
	bypass_hosts = [ "*.local*", "*domain.com*"], 
		
	//**** Stop editing here unless you know what you are doing. ****




	// Build the strings we need.
	i = 0,
	resolved_ip = "",
	host_ip = "",
	chk_host = "",
	
	// Array of commonly used private networks that can't be outside the proxy
	privateNets = ["192.168.0.0", "10.0.0.0", "172.16.0.0",  "127.0.0.0"],
	privateMasks = ["255.255.0.0", "255.0.0.0", "255.240.0.0", "255.255.255.0"];

	// If URL has no dots in host name, send traffic direct.
	if (isPlainHostName(host)) {
		return proxy_no; 
	}

	// If specific URL needs to bypass proxy, send traffic direct.
	for (chk_host in bypass_hosts) {
		if (shExpMatch(url, chk_host)) {
			return proxy_no;
		}
	}

	// If IP address is internal or hostname resolves to internal IP, send direct.
	// Resolve host to ip address to work around IE 8 bug.
	resolved_ip = dnsResolve(host);
	for (i = 0; i , privateMasks)) {
			return proxy_no;
		}
	}

	// If the url is an FTP request then force it direct so it uses transparent ftp proxy.
	if (shExpMatch(url, "ftp:*"))  {
		return proxy_no; 
	}

	// If on an internal/LAN IP address, or hostfile is misconfigured send traffic to proxy.
	host_ip = myIpAddress();	             
	if (isInNet(host_ip, local_subnet, local_mask) || (host_ip = "127.0.0.1")) {
		return proxy_yes;
	}
		
	// All other traffic uses direct.
	return proxy_no;
}

[/CODE]

0 BangkokBob over 13 years ago in reply to ratz

Hi Ratz,

It appears you have some experience with these things!  Perhaps I can ask a question that I can't see answered elsewhere.

If I want to use a wpad.dat file as per Astaro's recommendations, I need to put port http://firewall_address:8080/wpad.dat in the string in the user's browser, however whilst I can get this to work I really need to have auto configuration, which according to what I have read means we need a DNS "A" record for wpad pointing to the firewall and the rest is automatic.  By having to configure the location of the wpad file, it is not automatic, and certainly having to put a non standard port for the connection seems like it can never be automatic, as that is not something I can set in DNS.  If I have users from different offices, with different configurations, this seems to come down to a very manual exercise.

Would you know whether my understanding is correct? or do you deploy in some other automatic way?  I read where there are limitations with the wpad approach, but seemingly Astaro having a non standard port would mean automatic configuration will never work?

Any advice appreciated.
Cancel
Vote Up 0 Vote Down

Cancel