Proxy Settings & Working from home

[Gobstopper]

Hey Folks,

I manage a number of schools which use a VPN (SSTP) for remote access. This is managed by RRAS and NPS. Connectivity wise, everything is working well.

When a member of staff logs in from home they have been taught to use the Network Sign-on option on the W10 logon screen. So far so good.

Once logged in they have been told to disable the proxy settings via the Change Manual Proxy Server Settings. Once done, everything is good to go and works fine.

The problem staff are experiencing however is that the proxy server settings enable again seemingly on there own and at random. Staff know this has happended when they are unable to browse in IE or Chrome. I have checked the VPN logs and at no point has anyone disconnected and access to the shares remain active. Once the proxy settings have been disabled again everything then works fine, once browsers have been closed and re-opened.

 

At first I thought this might caused by Group Policy refreshing in the background, so as a test, I disabled this function. This has had no effect.

 

Has anyone else had behaviour like this before?

[markwilfan]

Just out of interest, why don't you use a PAC file for proxy settings?

[jthompson]

My guess would be that it's still down to Group Policy applying the proxy settings from GPOs.

 

If I were testing this, I'd create new GPO containing some garbage proxy settings (i.e. something that can only have come from this GPO) and apply it to a test machine. If the garbage settings keep appearing on that machine in spite of manually disabling the proxy, then you know that Group Policy refresh is causing it.

[Gobstopper]

Markwilfan,

I would love to deploy a PAC file and have been trying to get it done but I guess I must be doing something wrong. I created a basic PAC file below

 

function FindProxyForURL(url,host)

{ if(isPlainHostName(host) ||

isInNet(host,"10.0.0.0","255.255.255.0")) return "DIRECT";

else return "PROXY proxy.org.uk:8080; DIRECT";

}

 

I have added this to our IIS installation and can successfully download the file externally by entering https:///proxy.pac so I know it's accessible.

 

If I put the "https:///proxy.pac" in the auto config script field in IE it just doesn't seem to work. Any advice on this would be greatly appreciated!

 

jthompson,

I hear what your saying so I have put a user in a different OU without the IE policy in question and the member of staff is going to test it for me by manually turning the proxy on and off when needed to see if this behaviour continues.

[Katy]

Markwilfan,

I would love to deploy a PAC file and have been trying to get it done but I guess I must be doing something wrong. I created a basic PAC file below

 

function FindProxyForURL(url,host)

{ if(isPlainHostName(host) ||

isInNet(host,"10.0.0.0","255.255.255.0")) return "DIRECT";

else return "PROXY proxy.org.uk:8080; DIRECT";

}

 

I have added this to our IIS installation and can successfully download the file externally by entering https:///proxy.pac so I know it's accessible.

 

If I put the "https:///proxy.pac" in the auto config script field in IE it just doesn't seem to work. Any advice on this would be greatly appreciated!

Tried it on a http server (not https)? Pretty sure it doesn't work over HTTPS.

[Gobstopper]

To be honest Katy that did occur to me this evening as most (if not all) of the info I have seen on this seems to refer to the use of http. I will give it a try.

[chazzy2501]

With the proxy pac I assume you've done the other ground work like making a wpad entry in DNS pointing to your server hosting a wpad.dat file. Also just let ie and other browsers use automatic settings. if your VPN tunnels the (internet) DNS requests then the dat you've made is correct.

 

This site has a useful tool you can run and easy setups https://findproxyforurl.com/deploying-wpad/

 

note: you can use either DNS or DHCP (probably both) I recommend DNS (its worked with every device I tested, all mobiles, ipads and windows)

Edited June 21, 2018 by chazzy2501

[Foresthippy]

With the proxy pac I assume you've done the other ground work like making a wpad entry in DNS pointing to your server hosting a wpad.dat file. Also just let ie and other browsers use automatic settings. if your VPN tunnels the (internet) DNS requests then the dat you've made is correct.

 

This site has a useful tool you can run and easy setups https://findproxyforurl.com/deploying-wpad/

 

note: you can use either DNS or DHCP (probably both) I recommend DNS (its worked with every device I tested, all mobiles, ipads and windows)

 

I think DNS/DHCP support for WPAD is down to browser. I understand DNS is generally more supported.

[Gobstopper]

OK, please excuse my ignorance here. If I explain the ground work I have done for the PAC file and my understanding of how this worked hopefully you guys can correct me

 

1. I created the PAC file above

2. Using IIS on our Web Server I used the add MIME type to add the .pac extension and add the application/x-ns-proxy-autoconfig MIME Type.

3. Tested both internally and externally that I was able to access (download) the .pac file I had created.

4. Added the https:///proxy.pac to the config script field of IE.

5. It didn't work

6. Googled a bit more

7. Had a beer

8. Gave up and went to bed

 

In terms of ground work that is all I have done.

[jthompson]

Markwilfan,

If I put the "https:///proxy.pac" in the auto config script field in IE it just doesn't seem to work. Any advice on this would be greatly appreciated!

 

What happens if you just give IE this as a proxy.pac?

 

function FindProxyForURL(url,host) {
return "PROXY proxy.org.uk:8080";
}

[chazzy2501]

go here: https://findproxyforurl.com/deploying-wpad/ follow the 3 instructions.

 

all you need to do in summary is add a new mime type (.dat) on the iis (and convert your .pac file, create a dns entry called wpad and a group policy making the browser use autoconfig not a script path.