exonetsystems Posted October 9, 2015 Posted October 9, 2015 Hi all, would someone in the know mind just going over my very simple Proxy PAC file please to make sure I'm doing this correctly before deployment? Basically our network is 10.130.113.0, and I want it to use the proxy settings if the local machine has a school IP address - and if it doesn't then don't use the proxy settings (this part is for when they take laptops home). An exception to this rule is to not apply proxy settings to any local address on the network. function FindProxyForURL(url, host) { if (isInNet(myIpAddress(), "10.130.113.0", "255.255.255.0") return "PROXY sslfilter.proxy.swgfl.org.uk:8080"; else return "DIRECT"; if (isInNet(host, "10.130.113.0", "255.255.255.0")) return "DIRECT"; } Many thanks in advance, and have a good weekend all!
grant_girdwood Posted October 9, 2015 Posted October 9, 2015 seems ok, use pactester to test it out. https://github.com/manugarg/pactester so you know the recent windows versions are broken - there are older version downloads there. 1
exonetsystems Posted October 10, 2015 Author Posted October 10, 2015 seems ok, use pactester to test it out. https://github.com/manugarg/pactester so you know the recent windows versions are broken - there are older version downloads there. Thanks for your help, but unfortunately I can't seem to get my head around pactester or pacparser!
Alis_Klar Posted October 10, 2015 Posted October 10, 2015 I used http://utmtools.com/PacMagic then tested in school with 3G modem to simulate home network 1
grant_girdwood Posted October 10, 2015 Posted October 10, 2015 (edited) Thanks for your help, but unfortunately I can't seem to get my head around pactester or pacparser! If you download the windows version and extract it to somewhere on your C:\ drive e.g. C:\wpad - also throw a copy of your PAC file in that folder...will make it easier in the command prompt... Open up your CMD prompt cd in to the directory you created interrogate the file using pactester, just run pactester and it'll tell you how to use it e.g. pactester -p proxy.pac -u http://google.com -c 192.168.10.1 where -p is the file -u is the URL and -c is the client IP address It will list the output (proxy or direct) and highlight any syntax errors.. A handy tool! Edited October 10, 2015 by grant_girdwood Removed auto link conversion 1
edutech4schools Posted October 10, 2015 Posted October 10, 2015 BTW swgfl can enable transparent proxy for free, just call them.
grant_girdwood Posted October 12, 2015 Posted October 12, 2015 Ok, so there is a syntax error, you've missed out a closing bracket at the end of line 3 Once correcting that it looks good to go. See below; 1) requesting google.com with no client IP specified, result = DIRECT 2) requesting google.com with a client IP within range specified, result = PROXY 3) requesting google.com with a client IP outwith range specified, result = DIRECT 1
grant_girdwood Posted October 12, 2015 Posted October 12, 2015 p.s. here is the download link to the tool for windows - https://github.com/pacparser/pacparser/releases/tag/1.2.7 1
exonetsystems Posted October 20, 2015 Author Posted October 20, 2015 BTW swgfl can enable transparent proxy for free, just call them. Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer - - - Updated - - - If you download the windows version and extract it to somewhere on your C:\ drive e.g. C:\wpad - also throw a copy of your PAC file in that folder...will make it easier in the command prompt... Open up your CMD prompt cd in to the directory you created interrogate the file using pactester, just run pactester and it'll tell you how to use it e.g. pactester -p proxy.pac -u http://google.com -c 192.168.10.1 where -p is the file -u is the URL and -c is the client IP address It will list the output (proxy or direct) and highlight any syntax errors.. A handy tool! Star! Thank you very much sir!
Michael Posted October 20, 2015 Posted October 20, 2015 Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer - - - Updated - - - Star! Thank you very much sir! I'm not surprised. It's probably because they're inspecting all secure traffic, so whatever device(s) they're using are probably being hammered.
edutech4schools Posted October 20, 2015 Posted October 20, 2015 Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer http://awscdn.cdngeek.net/images/smilies/frown.png I have 2 schools that use transparent and 2 that do not and I have never seen any difference in browser speed.
exonetsystems Posted October 21, 2015 Author Posted October 21, 2015 I have 2 schools that use transparent and 2 that do not and I have never seen any difference in browser speed. Interesting! Is that with the SWGfL? I have signed up to text alerts from RM (something I deeply regret doing as I get bombarded) informing me whenever they're having issues, and every other day it's something to do with the transparent proxy!
edutech4schools Posted October 21, 2015 Posted October 21, 2015 No SEGFL but would have thought they use the same servers. I don't get any emails about transparent proxy issues but do get a lot about server / router upgrades etc.
Opendium_Steve Posted October 22, 2015 Posted October 22, 2015 Interesting! Is that with the SWGfL? I have signed up to text alerts from RM (something I deeply regret doing as I get bombarded) informing me whenever they're having issues, and every other day it's something to do with the transparent proxy! SWGfL have been having a lot of issues with their HTTPS transparent proxy this year (they've been blaming iOS update traffic, but I'm unconvinced). One of our customers just opted out of the SWGfL filtering entirely, since they already had a separate filter anyway, as it was way too slow to be usable at times. I think they've said they're working on a solution, but not exactly a speedy response since these problems have been going on since the start of term.
exonetsystems Posted October 28, 2015 Author Posted October 28, 2015 Okay, so here's a weird one then. My machine is on the 10.130.113.0 range (.1 to be exact), and when I run the pacparser I just can't get it to use the proxy unless I use the -c switch and set it manually. It just wants to go DIRECT. What could be the cause of this, if you don't mind me asking? Cheers.
exonetsystems Posted October 28, 2015 Author Posted October 28, 2015 C:\Users\Administrator\Downloads\pacparser-1.2.7-win32\pacparser-1.2.7-win32>pac tester.exe -p wpad.dat -u http://10.130.113.253 -c 10.130.113.1 PROXY sslfilter.proxy.swgfl.org.uk:8080 Even weirdererer!
grant_girdwood Posted October 28, 2015 Posted October 28, 2015 C:\Users\Administrator\Downloads\pacparser-1.2.7-win32\pacparser-1.2.7-win32>pac tester.exe -p wpad.dat -u http://10.130.113.253 -c 10.130.113.1 PROXY sslfilter.proxy.swgfl.org.uk:8080 Even weirdererer! It will just assume you have an IP that isn't listed in your PAC rules, so if it doesn't match else where it will hit your default/capture all rule at the end of your PAC file which bty the sounds of it is is direct. 1
grant_girdwood Posted October 28, 2015 Posted October 28, 2015 P.s. let me know what you want from a PAC file and I'll throw one together for you. e.g. if you're in network X use proxy, or not, if you're making a request to a local domain (e.g. something.internal) not to use the proxy etc. 1
exonetsystems Posted October 28, 2015 Author Posted October 28, 2015 P.s. let me know what you want from a PAC file and I'll throw one together for you. e.g. if you're in network X use proxy, or not, if you're making a request to a local domain (e.g. something.internal) not to use the proxy etc. Grant, you're my hero! Basically our local network is 10.130.113.0, subnet 255.255.255.0. Anything inside the local network should use the proxy server 'sslfilter.proxy.swgfl.org.uk:8080' unless they're trying to access another local 10.130.113.0 IP address, in which case it should use no proxy. When they take devices home (so they'll be on any other network with any other IP range) they should not use the proxy. Hope this helps, I really owe you one!
grant_girdwood Posted October 28, 2015 Posted October 28, 2015 Grant, you're my hero! Basically our local network is 10.130.113.0, subnet 255.255.255.0. Anything inside the local network should use the proxy server 'sslfilter.proxy.swgfl.org.uk:8080' unless they're trying to access another local 10.130.113.0 IP address, in which case it should use no proxy. When they take devices home (so they'll be on any other network with any other IP range) they should not use the proxy. Hope this helps, I really owe you one! Not a problem - here you go; function FindProxyForURL(url, host) { // Bypass proxy for local servers. if(isPlainHostName(host) || dnsDomainIs(host, ".internal.local") || isInNet(dnsResolve(host), "10.130.113.0", "255.255.255.0")) { return "DIRECT"; } if (isInNet(myIpAddress(), "10.130.113.0", "255.255.255.0")) return "PROXY sslfilter.proxy.swgfl.org.uk:8080"; else return "DIRECT"; } http://i.imgur.com/s888z0F.png At line 5 if you change internal.local to match the internal domain name e.g. bloxx.local whatever the set up, just means if someone attempts to get access to something via DNS and it's internal it won't hit the proxy. I've also set it up so that if there is a local DNS request (e.g. localhost) it won't hit the proxy 1
grant_girdwood Posted October 28, 2015 Posted October 28, 2015 Also just looking at your original file I can see where you went wrong, WPAD/PAC files work in a top down manner and as soon as it matches a rule it won't look any further, so as you had specified the network first it meant that any rquest from the internal network would always hit the proxy regardless of what was being requested. 1
exonetsystems Posted October 28, 2015 Author Posted October 28, 2015 Absolute star, thanks mate! Hopefully this will sort the issues we're having! Sorry to be a pain, but one more thing - if I try a local IP address and not hostname, it tries the proxy and doesn't get there opening the page. Not a massive issue as we can just set one machine up manually with the proxy to bypass the 10.130.113.0 range, but helpful nonetheless if I could overcome that. Thanks again for all your help, only my first try with wpad.dat and pac files. Brendan
exonetsystems Posted October 28, 2015 Author Posted October 28, 2015 Just realised you set that up what I needed above. Do you have any ideas why local IP addresses (switches, wlan management etc) don't open with the wpad.dat in place? Thanks again, Brendan
grant_girdwood Posted October 28, 2015 Posted October 28, 2015 Just realised you set that up what I needed above. Do you have any ideas why local IP addresses (switches, wlan management etc) don't open with the wpad.dat in place? Thanks again, Brendan They should do, are they within the 10.130.113.x range and is that how you're accessing them (e.g. http://10.130.113.50)? 1
exonetsystems Posted October 29, 2015 Author Posted October 29, 2015 My bad on this one, seems like a reboot of the machine made the new wpad.dat spring into life. Thanks again!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now