Internet Proxt via WPAD and PAC files

[Kitkatninja]

Hi All,

 

Just wondering has anyone used WPAD and PAC files in their organization here, instead for pushing out a set proxy to access the internet? Have you experienced any pros and cons with Windows 10 using IE, Edge, firefox, etc...?

 

Thanks

 

-Ken

[Arthur]

I used to, but stopped due to the various security issues.

 

• https://googleprojectzero.blogspot.co.uk/2017/12/apacolypse-now-exploiting-windows-10-in_18.html
  
• https://auth0.com/blog/heads-up-https-is-not-enough-when-using-wpad/
  
• https://threatpost.com/wpad-flaws-leak-https-urls/119582/
  

[jonathan.lees]

We use WPAD and PAC so that SEN laptops that go home don't have our proxy configured as the kids can't change it due to GPO's and they wouldn't have web access with out it. If anyone knows a better way of doing this, please let me know. Only downside I've seen to running it in school is that services are WPAD aware and want to use the proxy and fail due to authentication issues, I got around it by adding false dns entries for wpad in the etc/hosts file.

[jthompson]

We use it, with staff machines configured to pick it up (configured by a GPO to have the automatic proxy detection option enabled). It means that when staff laptops go home, they're not needing any proxy settings altered by the user. Students' proxy settings on the network are all done explicitly by GPO, as we put them through a different proxy (i.e. not the one advertised by WPAD).

 

Our guest network also uses it, as we still have to steer all of the guest devices through a proxy. iOS is much friendlier to end users than Android when it comes to configuring for proxy detection.

[Roberto]

We used to do this but found that with the large number of different devices we had to support within the college (e.g. Windows, MacOS, iOS, Android, Linux) plus BYOD devices where proxy auth would be an issue, we simply don't use a traditional proxy server at all. We simply route traffic through a UTM firewall as the only route out to the internet and watch what goes by on the wire.

 

Much more robust and reliable.

[LeMarchand]

Our main internet connection is via an LEA mandated proxy that they host. We just point all laptops and desktops to it directly via GPO. When the laptops go home they can't get to the proxy and so automatically fallback to direct with no further configuration our end. I'd suggest testing this before worrying about wpad.

 

We do self host a few pac files for specialist functions (no internet at certain times, only whitelisted sites allowed) but don't use wpad as nearly 100% Windows and it's just as easy to manually configure the few non-domain/Windows by hand and do the main proxy pacs via GPO. If you have a lot of devices that you can't use GPO to configure YMMV.

[mavhc]

How do you get Windows to ignore the proxy when at home?

 

I use wpad, mostly works, main problem is if you change it and desktops don't bother reloading it.

 

Then there's a few programs that try to read the IE proxy settings, and don't work because they're set automatically.

[LeMarchand]

How do you get Windows to ignore the proxy when at home?

 

I don't - it just seems to happen automatically as they can't reach the proxy outside of the LEA network. I only have the second option down (use the following address?) checked.

[mavhc]

Maybe if it can't resolve it, I can resolve the Nottinghamshire 1c1n one, but not connect to it

[LeMarchand]

Maybe if it can't resolve it, I can resolve the Nottinghamshire 1c1n one, but not connect to it

 

Could be that. I just checked on my phone (WiFi off!) and can't resolve the pac. You could copy the pac and host it on a server at school, then change the GPO to point it there.

[mavhc]

Oh, you're pointing them to a PAC file, not manually setting the proxy. Makes sense then, that's how PAC files work. WPAD is just a putting a PAC file at http://wpad/wpad.dat