New Smoothwall install - WPAD.DAT

[synaesthesia]

Happy to have a nice Smoothie installed today. It works a treat, but as far as the network is concerned only if proxy settings are directly entered into the internet connection properties. Nothing I can do with either wpad.dat or proxy.pac appears to work!

I'm fairly sure it's not a Smoothwall issue, but if there's any gotchas it'd be useful to know. I don't want to go down the route of proxy settings again in this day and age, too many mobile devices.

 

Added an alias in dns for wpad to resolve to the smoothwall host (smoothwall.schoolname.internal)

Added option 252 in DHCP for wpad pointing to http://smoothwall.schoolname.internal/wpad.dat

Automatic detect connection settings in IE turned on

Also tried configuration script via http://smoothwall.schoolname.internal/proxy.pac.

 

I can see in temporary internet files that the wpad.dat file is being downloaded however does not seem to take effect. Could it be an issue with that file? (it's the one Smoothwall generates)

[sparkeh]

Can you post the contents of the wpad.dat?

[synaesthesia]

Sure:

function FindProxyForURL(url, host)
{
var serverip = "10.12.x.x";
if ((host == serverip)
	|| localHostOrDomainIs(host, "smoothwall.schoolname.internal"))
{
	return "DIRECT";
}

if (isPlainHostName(host))
	return "DIRECT";
return "DIRECT";
}

[sparkeh]

Sure:

function FindProxyForURL(url, host)
{
   var serverip = "10.12.x.x";
   if ((host == serverip)
       || localHostOrDomainIs(host, "smoothwall.schoolname.internal"))
   {
       return "DIRECT";
   }

   if (isPlainHostName(host))
       return "DIRECT";
   return "DIRECT";
}

Perhaps I'm being dumb, but that file just returns DIRECT for every case. Don't you need to add a line to return your proxy at some point.

E.g. mine looks like this:

function FindProxyForURL(url, host)
{
if (
isInNet(host, [i]"Our IP range"[/i], "255.255.255.0") ||
isPlainHostName(host) ||
localHostOrDomainIs(host, "127.0.0.1") ||
dnsDomainIs(host, "[i]ourdomain.local[/i]") ||
dnsDomainIs(host, "[i]LA.domain[/i]") 	
   ){
return "DIRECT";
    }


else
return "PROXY [i]oursmoothieURL[/i].local:800";
}

So, if it an IP Address on our network, a plain hostname, localhost, a FQDN (on our domain) or our LA's domain then the connection is direct. Everything else is directed to the proxy.

[synaesthesia]

Cheers, I'll take a look when I'm back there. That's the one that came straight from the smoothwall which I imagine was autogenerated.

 

Thanks

[SmoothSupporter]

Hi there,

 

Did you select a proxy for the auto proxy pac config to use under web proxy >> automatic configuration?

At the bottom of the page, you can choose which proxy port you want the proxy.pac to point to,

 

Regards,

[synaesthesia]

Happy days, that's working a treat. Certificates however... working under admin logins but under pupil/staff, nada

[CyberDrac]

Did you remember to do it as "Public Key Policies/Trusted Root Certification Authorities" and "Public Key Policies/Trusted Publishers Certificates"

[synaesthesia]

The former yes, the latter no! Cheers!

[CyberDrac]

The former yes, the latter no! Cheers!

Nice to be able to provide an answer instead of a question for once

[AlanD]

I'm a bit concerned that you are having any issues with a new SMOOTHWALL setup. Not least of all, because its one of the solutions we are looking at. And we have been led to believe that they look at all our requirements and setup it up to work as we require it to work. From what you are telling me - it seems to be you doing some fairly essential configuration. BYOD and proxies are a potential nightmare. Lots of stuff - with mobile devices - either don't work - or don't work well with proxies. So, for example (and I agree - you might decide to block these anyhow) things like instragram and whatsapp may use port 80 - but not for http traffic. Typically - you would block port 80 if redirecting traffic to a proxy....but have no way of knowing if its a web fetch - or some other traffic which you want to allow. Yes - with layer 7 "visibility" - and I get the feeling Smoothwall is only just getting there with Layer 7, it is possible to be more selective. Would be really interested to know how well you get on with Smoothwall....particularly with regards to the requirements of "monitoring". ...does it generate alerts when certain words are typed in google as a search for example? And or - does it pick it up if using wrorrying voculary sent via iMessage on BYOD wireless?

[synaesthesia]

I think you're expecting a bit much for intercepting stuff from iMessage! However I shall point out again that these were not issues with Smoothwall but the network configuration that I had taken over. Smoothwall's installation and support afterwards has been absolutely top-notch.

 

Quite frankly I don't believe you'll get a better, single system. Indeed, you don't just buy it and get lumped with a virtual appliance or hardware box ready for your install and scratch your head, the purchase starts with you providing a lot of information relevant to your network, giving you the choice of the type of proxy whether it's transparent or not. If there's an issue or recommendation, they will point it out and discuss the options with you.

 

And yes, it will report on search queries, selective words as per PREVENT and general safeguarding, extremism etc. I'm not sure if it will do realtime reporting however it's very configurable so no doubt it can be set up. No huge loss if not as realtime monitoring shouldn't be primarily technological, it should be classroom control.

 

No monitoring system is going to be able to decipher the packets sent out from every messaging app for very obvious reasons, if a pupil sends an abusive message to another via some random social media thing then there's little you can do other than block connections to those sites which should be done anyway.

 

However it's early days for me with Smoothwall, and it's complicated, but their support so far has been excellent and I can't say I'm disappointed. I will therefore say with full confidence that if you have any questions regarding Smoothwall, direct them straight to the horses mouths for a decent, honest answer.

[dloudon96]

Can anyone help me, we've had smooth wall for around 3 years, it works fine, I.e, blocking websites for staff and students, i have one issue where my account (IT-ADMINS) go through port 3128 which goes through smooth wall but is un-filtered. My problem is, When I'm connected to the wifi, Facebook messenger says 'waiting to re connect'. Can anyone help me?

 

Thanks,

 

Dan