Weird smoothwall issue

[cogrady84]

I'm looking for some help shedding light on a weird problem i'm having with wpad/dhcp/ie11/byod.

 

I recently setup a VPN which required WPAD/Proxy.pac/DHCP option 252 setting up to allow vpn clients to detect whether they were on site or not and what proxy settings to apply. This all works great, if the laptop is on site it picks up the smoothwall and offsite it just automatically detects whatever settings it needs on the wifi.

 

I only specified this DHCP option on one scope, which is linked to a particular wifi SSID.

 

Now, I recently had some users with BYOD devices, which were connected to this SSID by mistake, picked up the proxy and started demanding authentication, despite them not being on our domain. This was resolved and they were moved over to a different SSID where dhcp isn't deploying option 252. The weird thing is, since then, when IE is launched it still tries to go through the proxy. I've checked DHCP and the option is definately not being deployed. I've cleared the browser cache, cleared all linked registry entries and i've been running wireshark and watching as the connection comes up and DNS queries are immediately sent to my DC's looking for smoothwall.local, even though the option isn't specified.

 

Does anyone have any idea why a BYOD device, which is not on the domain, no policies applied and connected to a DHCP scope without option 252 deployed, would be sending out dns queries for WPAD/smoothwall.local? Unchecking automatically detect settings in IE fixes the problem, so its something to do with the proxy discovery service. But this only applies to IE, doesn't happen with chrome....

 

Thanks!

[ibpalle]

Interesting. If the DHCP is not giving out the option then th only way it can be done is via DNS - using the wpad hostname. Automatic discovery works on IE using either DHCP or DNS. On other browsers it's just DNS. I would assume this happens due to wpad being available as a hostname for autodiscovery of proxy.

 

Since that can't be removed if you want other browsers than IE to pick up auto settings, one way of avoiding at least authentication issues for BYOD is define a location for the SSID IP range and set that location to have different auth options in the proxy.

Edited April 8, 2019 by ibpalle

[cogrady84]

Interesting. If the DHCP is not giving out the option then th only way it can be done is via DNS - using the wpad hostname. Automatic discovery works on IE using either DHCP or DNS. On other browsers it's just DNS. I would assume this happens due to wpad being available as a hostname for autodiscovery of proxy.

 

Since that can't be removed if you want other browsers than IE to pick up auto settings, one way of avoiding at least authentication issues for BYOD is define a location for the SSID IP range and set that location to have different auth options in the proxy.

 

After some further investigation, I set a static IP to rule out DHCP, which made no difference, I also tried it wired instead of wireless and still the proxy persists.

 

Wireshark shows the following:

 

DNS Standard query A wpad.domain.internal

DNS Standard query A smoothwall.domain.internal

DNS Standard query response No such name A wpad.domain.internal

DNS Standard query response A smoothwall.domain.internal A 192.168.0.1

 

So it queries DNS for wpad, and there is no record for it, so responds as such. Then inexplicably queries for smoothwall, which the DC returns the record for. This is where i'm stuck, I can't for the life of me figure out what is telling this BYOD device to query for the smoothwall. DHCP has been eliminated.

 

Immediately after these DNS queries, all further packets are sent to the smoothwall, which begins deploying proxy.pac and challenging for credentials.

 

I've sanitised names/IP's in this post

 

This all happens as the connection is coming up, before IE is even launched. But Chrome respects my configuration to not use a proxy, IE doesn't.

 

In relation to the last part of your post. This is only happening on BYOD devices, that were incorrectly connected to the corporate wifi instead of the byod wifi, and then subsequently removed and put on the guest wifi. So there is little point in me configuring a network location for BYOD because normally this shouldn't happen, it was just a mistake. However i'm now scratching my head as to why this is behaving in such a way, and I want to eliminate it, because it doesn't make sense.

Edited April 8, 2019 by cogrady84

[ibpalle]

The query for the Smoothwall is likely the pac file proxy hostname it tries to resolve. Where it's getting that from though is the mystery. Is this on all browsers or just IE? If autodiscover is turned off do you see the same behaviour?

[cogrady84]

The query for the Smoothwall is likely the pac file proxy hostname it tries to resolve. Where it's getting that from though is the mystery. Is this on all browsers or just IE? If autodiscover is turned off do you see the same behaviour?

 

Just IE, chrome just works. yes it picked up a proxy.pac initially after connecting to the corporate wifi, and then after getting it on the byod wifi and clearing cache, removing registry entries etc it still seems to have the pac file in memory somewhere and I cannot get rid of it without basically blowing away the entire operating system, which is obviously not ideal.

[ibpalle]

Obviously. What if you remove autodiscover in the settings - still the same behaviour?

[cogrady84]

The query for the Smoothwall is likely the pac file proxy hostname it tries to resolve. Where it's getting that from though is the mystery. Is this on all browsers or just IE? If autodiscover is turned off do you see the same behaviour?

 

Yeah if I turn off automatically detect settings it works. But presumably this would break the laptops in question in other sites that rely on that box being ticked.

 

This was smoothwall support official response to just untick the box. but i'm not keen on doing that. I want to understand what is going on

[ibpalle]

Yes it would. So sounds like the pac info is stored and used even if there is no autodiscover results. That is weird - or wIErd...

Does resetting IE fix it? Again, not a fix per se, just for information to make sure it is an IE stored info somewhere.

[cogrady84]

I absolutely agree that it is very wIErd. problem being that they are using things like Office365 which also respect IE config, so as soon as they launch an office application, or onedrive or something, it prompts for auth also and it will NOT go away, just keeps popping up like an excited jack russell terrier.

 

When you say reset IE, do you mean just internet options, advanced, reset IE settings? If so, then yes, just tried that, didn't change anything

[ibpalle]

Until that is fixed, the location workaround is likely the best option to avoid auth issues. Is the SSID on the same IP address range? If it is, can you change it?

[cogrady84]

Until that is fixed, the location workaround is likely the best option to avoid auth issues. Is the SSID on the same IP address range? If it is, can you change it?

 

To be honest, I think I already ended up doing the location thing with a couple of the BYOD devices because it was the only solution I could think of at the time. No, all segmented with seperate subnets.

 

I've exhausted google looking for methods to clear out all the different caches, registry entries, temp files that would possibly be causing this and the only thing that fixes it is wiping the OS and starting again without ever connecting to that SSID (tried with one of my dept laptops). But I can't do this with these other BYOD devices.

Edited April 8, 2019 by cogrady84

[cogrady84]

Doing some more testing this morning. wpad discovery is blocked via dns, so it's not picking it up from a dns query. It is not a cached proxy.pac file, as I have actively made changes to the file on smoothwall to add exception sites to the list and upon reconnecting the laptop to the subnet which shouldn't be trying to use a proxy, it picks up the changes and allows direct access to the exception domains.

 

Something is actively hijacking the wpad and telling it to use smoothwall, even though wpad discovery is blocked and the dhcp scope it's connecting to doesn't stipulate option 252.

 

Any ideas?

[cogrady84]

So i've completely wiped the laptop and rebuilt it, put it in it's own ou and blocked inheritance. So no GPOs applied at all.

 

Just tried this again and flipped between multiple subnets without option 252 deployed and it works fine, I then connect to the subnet with option 252 and it picks up proxy.pac as expected and begins auth challenge, then as soon as I move back to another subnet without option 252 it still remembers the proxy and continues to challenge....

 

Is anyone able to replicate this?

 

Doesn't appear to be IE as this is happening as the connection comes up without IE launched, tracing through wireshark I see the DNS queries for smoothwall.domain.internal. This is something to do with the winhttp autoproxy discovery service, seperate to IE.

Edited April 9, 2019 by cogrady84

[cogrady84]

Oh wow... I think i've sussed it.

 

Bottom post on this thread:

 

https://social.technet.microsoft.com/Forums/office/en-US/535e5bdd-dda2-41e1-b4e2-ea5656ecc2f7/wpad-location-in-windows-81?forum=ieitprocurrentver

 

Upon monitoring this key, if connecting to a subnet with option 252 specified an additional string is applied to the key called "WpadDetectedUrl" with the proxy.pac location value. It appears this string is not removed upon connection to a different subnet without option 252 specified.

 

Deleting the entire key before reconnecting stops the proxy challenge. WOW... this has taken me weeks and weeks to figure out, can't believe it. Is this by design or a bug? What a nightmare!!

 

Thank you random internet stranger!

[ibpalle]

Wow, good to know. Seems a bit random to leave that hanging around. Glad you found this and thanks for posting it.

[cogrady84]

Wow, good to know. Seems a bit random to leave that hanging around. Glad you found this and thanks for posting it.

 

Just whilst your here, is it possible to add an argument to the proxy.pac on smoothwall to bypass proxy and go direct if you are a specific host/ip?

 

Thanks

[ibpalle]

Hmm, not directly on the GUI but it should be possible to add something like that to a custom pac file and upload that to be served from the Smoothwall. A good resource for pac file writing is linked in this KB article

 

https://kb.smoothwall.com/hc/en-us/articles/360002921479