WPAD Issues

[CHiLL]

Hello,

We have had our internet connection switched from our LEA (BGfL) to RM Networks. We were using WPAD/automatically detect settings to automate proxy details and it was working fine before the switch. Now it is not working.

 

We have noticed that with 'automatically detect' turned on, we can access all of the Google's search page and actually load results (but not go to the sites from the links in the results). This appears to be an RM issue, which we have raised with them. I'd just like to confirm that our WPAD setup is correct.

 

We can only access the internet if we explicitly state the proxy in the settings. Here's a low-down of our setup:

 

Ruckus ZoneDirector is the WPAD host (configured in: Configure > WLANs > WLAN Name > Advanced options > Enable Auto-Proxy configuration > ZoneDirector > http://10.22.22.9/uploaded/wpad.dat)

URL of WPAD.dat: http://10.22.22.9/uploaded/wpad.dat.

WPAD.dat contents:

Function FindProxyForURL(url, host)
{
if (isInNet(host, "10.22.0.0", "255.255.0.0"))
	return "DIRECT";
else
	return "PROXY sslfilter.proxy.rmplc.co.uk:8080";
}

DHCP is setup with scope options for 252 WPAD (pointing to http://10.22.22.9/uploaded/wpad.dat) on each of our scopes.

 

I am now at my knowledge limit with WPAD and stuck!

 

Can anybody advise?

Edited April 11, 2016 by CHiLL

[Michael]

I don't know if you're aware, but BGfL have operated a transparent proxy since late last year which removes the need for WPAD altogether.

 

I can't see anything wrong with the above, but I presume you can resolve it by typing the URL into IE for example? Typically it should prompt to download, which demonstrates it can be seen over the network.

[CHiLL]

I don't know if you're aware, but BGfL have operated a transparent proxy since late last year which removes the need for WPAD altogether.

 

I can't see anything wrong with the above, but I presume you can resolve it by typing the URL into IE for example? Typically it should prompt to download, which demonstrates it can be seen over the network.

Thanks for the reply. Yeah, we knew BGfL had transparent proxy, but our WPAD was implemented before that went live. Now our new provider hasn't yet enabled transparent proxy, meaning that our iPads and other proxy-unaware devices aren't able to access the internet.

[Michael]

I guess maybe a question to ask RM as to their recommendations?

[Steve21]

When you say you can't get to the sites is it actually showing an error or just not loading?

 

That sounds more like the certificates for SSL inspection aren't installed or there's a URL being blocked.

 

If you control-click the link it'll open in a second page and show as blocked even if it's not when you click on it

 

Steve

[Michael]

I'm speculating the WPAD file is being hosted locally within an IIS instance (which is fine), but normally typing in the path (within the IE browser bar), it should prompt you to download the WPAD or PAC file, which demonstrates the network can see the file and that IIS is configured correctly.

 

IIS these days is heavily locked down, a bit like SQL and Windows Server, so you have to re-enable all services required.

[CHiLL]

Update:

We have now had the transparent proxy feature enabled and it appears to be working for the most part.

 

As for WPAD, I was able to download the WPAD file using the URL, though still couldn't access websites.

[Michael]

I presume your DNS forwarders are in place? Then again, I'd expect all web traffic to fail otherwise...

[CHiLL]

Thought I'd wrap this thread up. With transparent proxy, we have been able to disable WPAD and have all of our devices still connect to the internet.

 

Thanks for the replies.