Can someone check my proxy PAC file quickly please?

exonetsystems · October 9, 2015

Hi all, would someone in the know mind just going over my very simple Proxy PAC file please to make sure I'm doing this correctly before deployment?

Basically our network is 10.130.113.0, and I want it to use the proxy settings if the local machine has a school IP address - and if it doesn't then don't use the proxy settings (this part is for when they take laptops home). An exception to this rule is to not apply proxy settings to any local address on the network.

function FindProxyForURL(url, host)

{

if (isInNet(myIpAddress(), "10.130.113.0", "255.255.255.0")

return "PROXY sslfilter.proxy.swgfl.org.uk:8080";

else

return "DIRECT";

if (isInNet(host, "10.130.113.0", "255.255.255.0"))

return "DIRECT";

}

Many thanks in advance, and have a good weekend all!

grant_girdwood · October 9, 2015

seems ok, use pactester to test it out.

https://github.com/manugarg/pactester

so you know the recent windows versions are broken - there are older version downloads there.

exonetsystems · October 10, 2015

seems ok, use pactester to test it out.

https://github.com/manugarg/pactester

so you know the recent windows versions are broken - there are older version downloads there.

Thanks for your help, but unfortunately I can't seem to get my head around pactester or pacparser!

Alis_Klar · October 10, 2015

I used http://utmtools.com/PacMagic then tested in school with 3G modem to simulate home network

grant_girdwood · October 10, 2015

Thanks for your help, but unfortunately I can't seem to get my head around pactester or pacparser!

If you download the windows version and extract it to somewhere on your C:\ drive e.g. C:\wpad - also throw a copy of your PAC file in that folder...will make it easier in the command prompt...

Open up your CMD prompt
cd in to the directory you created
interrogate the file using pactester, just run pactester and it'll tell you how to use it
e.g. pactester -p proxy.pac -u http://google.com -c 192.168.10.1
where -p is the file -u is the URL and -c is the client IP address

It will list the output (proxy or direct) and highlight any syntax errors..

A handy tool!

Edited October 10, 2015 by grant_girdwood
Removed auto link conversion

edutech4schools · October 10, 2015

BTW swgfl can enable transparent proxy for free, just call them.

grant_girdwood · October 12, 2015

Ok, so there is a syntax error, you've missed out a closing bracket at the end of line 3

Once correcting that it looks good to go.

See below;

1) requesting google.com with no client IP specified, result = DIRECT

2) requesting google.com with a client IP within range specified, result = PROXY

3) requesting google.com with a client IP outwith range specified, result = DIRECT

grant_girdwood · October 12, 2015

p.s. here is the download link to the tool for windows - https://github.com/pacparser/pacparser/releases/tag/1.2.7

exonetsystems · October 20, 2015

BTW swgfl can enable transparent proxy for free, just call them.

Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer

- - - Updated - - -

If you download the windows version and extract it to somewhere on your C:\ drive e.g. C:\wpad - also throw a copy of your PAC file in that folder...will make it easier in the command prompt...

Open up your CMD prompt

cd in to the directory you created

interrogate the file using pactester, just run pactester and it'll tell you how to use it

e.g. pactester -p proxy.pac -u http://google.com -c 192.168.10.1

where -p is the file -u is the URL and -c is the client IP address

It will list the output (proxy or direct) and highlight any syntax errors..

A handy tool!

Star! Thank you very much sir!

Michael · October 20, 2015

Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer

- - - Updated - - -

Star! Thank you very much sir!

I'm not surprised. It's probably because they're inspecting all secure traffic, so whatever device(s) they're using are probably being hammered.

edutech4schools · October 20, 2015

Thanks for your suggestion! We have the transparent proxy, but it appears to make browsing so much slower and less reliable. So unfortunately it's a bit of a bum steer http://awscdn.cdngeek.net/images/smilies/frown.png

I have 2 schools that use transparent and 2 that do not and I have never seen any difference in browser speed.

exonetsystems · October 21, 2015

I have 2 schools that use transparent and 2 that do not and I have never seen any difference in browser speed.

Interesting! Is that with the SWGfL? I have signed up to text alerts from RM (something I deeply regret doing as I get bombarded) informing me whenever they're having issues, and every other day it's something to do with the transparent proxy!

edutech4schools · October 21, 2015

No SEGFL but would have thought they use the same servers. I don't get any emails about transparent proxy issues but do get a lot about server / router upgrades etc.

Opendium_Steve · October 22, 2015

Interesting! Is that with the SWGfL? I have signed up to text alerts from RM (something I deeply regret doing as I get bombarded) informing me whenever they're having issues, and every other day it's something to do with the transparent proxy!

SWGfL have been having a lot of issues with their HTTPS transparent proxy this year (they've been blaming iOS update traffic, but I'm unconvinced). One of our customers just opted out of the SWGfL filtering entirely, since they already had a separate filter anyway, as it was way too slow to be usable at times. I think they've said they're working on a solution, but not exactly a speedy response since these problems have been going on since the start of term.

exonetsystems · October 28, 2015

Okay, so here's a weird one then. My machine is on the 10.130.113.0 range (.1 to be exact), and when I run the pacparser I just can't get it to use the proxy unless I use the -c switch and set it manually. It just wants to go DIRECT.

What could be the cause of this, if you don't mind me asking? Cheers.

exonetsystems · October 28, 2015

C:\Users\Administrator\Downloads\pacparser-1.2.7-win32\pacparser-1.2.7-win32>pac

tester.exe -p wpad.dat -u http://10.130.113.253 -c 10.130.113.1

PROXY sslfilter.proxy.swgfl.org.uk:8080

Even weirdererer!

grant_girdwood · October 28, 2015

C:\Users\Administrator\Downloads\pacparser-1.2.7-win32\pacparser-1.2.7-win32>pac
tester.exe -p wpad.dat -u http://10.130.113.253 -c 10.130.113.1
PROXY sslfilter.proxy.swgfl.org.uk:8080

Even weirdererer!

It will just assume you have an IP that isn't listed in your PAC rules, so if it doesn't match else where it will hit your default/capture all rule at the end of your PAC file which bty the sounds of it is is direct.

grant_girdwood · October 28, 2015

P.s. let me know what you want from a PAC file and I'll throw one together for you.

e.g. if you're in network X use proxy, or not, if you're making a request to a local domain (e.g. something.internal) not to use the proxy etc.

exonetsystems · October 28, 2015

P.s. let me know what you want from a PAC file and I'll throw one together for you.

e.g. if you're in network X use proxy, or not, if you're making a request to a local domain (e.g. something.internal) not to use the proxy etc.

Grant, you're my hero! Basically our local network is 10.130.113.0, subnet 255.255.255.0. Anything inside the local network should use the proxy server 'sslfilter.proxy.swgfl.org.uk:8080' unless they're trying to access another local 10.130.113.0 IP address, in which case it should use no proxy. When they take devices home (so they'll be on any other network with any other IP range) they should not use the proxy.

Hope this helps, I really owe you one!

grant_girdwood · October 28, 2015

Grant, you're my hero! Basically our local network is 10.130.113.0, subnet 255.255.255.0. Anything inside the local network should use the proxy server 'sslfilter.proxy.swgfl.org.uk:8080' unless they're trying to access another local 10.130.113.0 IP address, in which case it should use no proxy. When they take devices home (so they'll be on any other network with any other IP range) they should not use the proxy.

Hope this helps, I really owe you one!

Not a problem - here you go;

function FindProxyForURL(url, host)
{
// Bypass proxy for local servers.
   if(isPlainHostName(host)
|| dnsDomainIs(host, ".internal.local")
|| isInNet(dnsResolve(host), "10.130.113.0", "255.255.255.0"))
{
           return "DIRECT";
}

if (isInNet(myIpAddress(), "10.130.113.0", "255.255.255.0"))
return "PROXY sslfilter.proxy.swgfl.org.uk:8080";
else
return "DIRECT";
}

http://i.imgur.com/s888z0F.png

At line 5 if you change internal.local to match the internal domain name e.g. bloxx.local whatever the set up, just means if someone attempts to get access to something via DNS and it's internal it won't hit the proxy. I've also set it up so that if there is a local DNS request (e.g. localhost) it won't hit the proxy

grant_girdwood · October 28, 2015

Also just looking at your original file I can see where you went wrong, WPAD/PAC files work in a top down manner and as soon as it matches a rule it won't look any further, so as you had specified the network first it meant that any rquest from the internal network would always hit the proxy regardless of what was being requested.

exonetsystems · October 28, 2015

Absolute star, thanks mate! Hopefully this will sort the issues we're having! Sorry to be a pain, but one more thing - if I try a local IP address and not hostname, it tries the proxy and doesn't get there opening the page. Not a massive issue as we can just set one machine up manually with the proxy to bypass the 10.130.113.0 range, but helpful nonetheless if I could overcome that.

Thanks again for all your help, only my first try with wpad.dat and pac files.

Brendan

exonetsystems · October 28, 2015

Just realised you set that up what I needed above. Do you have any ideas why local IP addresses (switches, wlan management etc) don't open with the wpad.dat in place?

Thanks again,

Brendan

grant_girdwood · October 28, 2015

Just realised you set that up what I needed above. Do you have any ideas why local IP addresses (switches, wlan management etc) don't open with the wpad.dat in place?

Thanks again,
Brendan

They should do, are they within the 10.130.113.x range and is that how you're accessing them (e.g. http://10.130.113.50)?

exonetsystems · October 29, 2015

My bad on this one, seems like a reboot of the machine made the new wpad.dat spring into life.

Thanks again!

Can someone check my proxy PAC file quickly please?

Recommended Posts

exonetsystems

grant_girdwood

exonetsystems

Alis_Klar

grant_girdwood

edutech4schools

grant_girdwood

grant_girdwood

exonetsystems

Michael

edutech4schools

exonetsystems

edutech4schools

Opendium_Steve

exonetsystems

exonetsystems

grant_girdwood

grant_girdwood

exonetsystems

grant_girdwood

grant_girdwood

exonetsystems

exonetsystems

grant_girdwood

exonetsystems

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

Confirm acknowledgement of parental consent requirement for the Additional Google services

Lenovo Tablet Firmware

Outloook 365 - Classic

Home

Forums

What's New