DirectAccess and WPAD

[sparkeh]

For a long time we have used WPAD to simplify teachers moving their laptops between home and school and its worked very well. However, we are now implementing DirectAccess and its become apparent that when machines connect at home, they pick up the WPAD settings and all Internet traffic is routed through our gateway/filter/firewall (which we don't want to do).

 

I can't really think of a way to stop this so wondered if anyone had any ideas?

 

If not, how do others deal with proxy settings when moving between home and school?

[JoHimself]

Bit "Quick n Dirty" but could you prevent access to wpad from DirectAccess clients using a firewall rule?

[sparkeh]

Thanks, that's something to think about.

 

However, after doing some reading it seems that when a DA client connects it doesn't contact DHCP to get its address, meaning that I could distribute the WPAD settings via DHCP rather than DNS (as currently) so remote clients shouldn't get the WPAD settings.... i think

[sparkeh]

Yep distributing WPAD settings via DHCP only does the trick

 

Hope this helps someone.

[IrritableTech]

Some if statements depending on the current host ip address...

 

if (isInNet(myIpAddress(), "10.10.1.0", "255.255.255.0"))

return "PROXY 10.10.5.1:8080";

 

Taken straight from PAC Functions | FindProxyForURL

 

Sorry - missed the resolution; although this may help someone too!

Edited November 25, 2015 by IrritableTech

[sparkeh]

Some if statements depending on the current host ip address...

 

if (isInNet(myIpAddress(), "10.10.1.0", "255.255.255.0"))

return "PROXY 10.10.5.1:8080";

 

Taken straight from PAC Functions | FindProxyForURL

 

Sorry - missed the resolution; although this may help someone too!

Yeah we have a check in our wpad file for the host IP, however, it appears this didn't help.

 

I think its because with DirectAccess your remote client will actually present an internal IP, not your local IP, so according to the wpad function you are 'on network' with an internal IP so it tells the browser to route traffic through the on-site proxy.

 

However, with wpad the client checks DHCP, then DNS for the location of the wpad file, so the remote client won't get a wpad location from the local DHCP and (now I've removed the entry) won't get it from DNS. When the laptops come back on-site they will get the wpad location from DHCP

[MattPrime]

I ran in to the same problem recently, our browsers were able to locate the PAC file via wpad.mydomain.com using auto discovery when connected via DirectAccess.

 

The suggestions here pointed me in the right direction, but I decided to do something different. I added a Name Resolution Policy Table (NRPT) exception to the DirectAccess configuration so that DirectAccess clients were unable to locate wpad.mydomain.com via a DNS lookup. Add your wpad FQDN to the NRPT and leave the DNS server address blank.

 

Browsers are now still set to auto discover, but cannot locate proxy settings when connected via DA. Connect back to the company LAN and auto detect still works.

[CoolsMK2]

I dont see an issue of letting the staff from home go via the school if you have filtering and AV scanning in place at the school it just another step to stop them letting there kids use the laptop at home and surf sites they should not be going to, we all have a teacher that does that you might not know about it.

[chazzy2501]

@MattPrime, I need to do this exact thing! Do you have more detailed instructions? I could edit the GPO directly but that is not supported by M$ and I can't find it in the Wizard am I blind?

 

Cheers!

[CoolsMK2]

An option you have is to use IPv6 with DA and not IPv4 and still have the PAC file in place so it look up an IPv4 as there will be no matching IP for this on DA then it will go direct. (been years since I last used DA)

 

 

PAC

 

function FindProxyForURL(url, host) {

// If the hostname matches, send direct.

if (dnsDomainIs(host, "intranet.domain.com") ||

shExpMatch(host, "(*.abcdomain.com|abcdomain.com)"))

return "DIRECT";

// If the protocol or URL matches, send direct.

if (url.substring(0, 4)=="ftp:" ||

shExpMatch(url, "http://abcdomain.com/folder/*"))

return "DIRECT";

// If the requested website is hosted within the internal network, send direct.

if (isPlainHostName(host) ||

shExpMatch(host, "*.local") ||

isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||

isInNet(dnsResolve(host), "172.16.0.0", "255.240.0.0") ||

isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0") ||

isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0"))

return "DIRECT";

// If the IP address of the local machine is within a defined

// subnet, send to a specific proxy.

if (isInNet(myIpAddress(), "10.10.5.0", "255.255.255.0"))

return "PROXY 1.2.3.4:8080";

// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.

return "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080";

}

[chazzy2501]

I found the exception, durr… Strange however the laptops became sluggish and still had issues. I've gone the DHCP route. Now I have to manually add proxy settings to my servers!

[RobD]

Have you enabled split tunneling on DA? I.e. force all work traffic over the DA tunnel and then everything else just goes local.

 

Its what I'm doing, seems ok.

[chazzy2501]

yes, split tunnelling is on and recommended. The second I removed the DNS entry for wpad the clients started working much better. (its always been hit and miss) never occurred to me that the wpad was being accessed over DA. (Doh!)