Smoothwall IOS off prem filtering - Global proxy and Intune/Endpoint

[ibpalle]

I believe there is a proxy directive that sets proxy based on client subnet. If it's internal, use one proxy, if not, use the other. That should be something like:

 

// If the IP address of the local machine is within a defined

// subnet, send to a specific proxy.

if (isInNet(myIpAddress(), "10.10.5.0", "255.255.255.0"))

return "PROXY 1.2.3.4:8080";

 

// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.

return "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080";

 

https://findproxyforurl.com/example-pac-file/ is a good resource.

[jblackburnHWGA]

I believe there is a proxy directive that sets proxy based on client subnet. If it's internal, use one proxy, if not, use the other. That should be something like:

 

// If the IP address of the local machine is within a defined

// subnet, send to a specific proxy.

if (isInNet(myIpAddress(), "10.10.5.0", "255.255.255.0"))

return "PROXY 1.2.3.4:8080";

 

// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.

return "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080";

 

https://findproxyforurl.com/example-pac-file/ is a good resource.

 

Great stuff, thanks that may well work!

[ibpalle]

And that does not require the hostname to be the same for internal and external proxy.

[Brimstone]

Here's a question for the Smoothwall people....

 

Do schools have to use your very much out of date iOS Radar web browser (last update to this was August 2014 for iOS12) rather than Safari with this solution? It's very poor and doesn't work with a slew of different apps that schools have paid for?

[Primus]

Here's a question for the Smoothwall people....

 

Do schools have to use your very much out of date iOS Radar web browser (last update to this was August 2014 for iOS12) rather than Safari with this solution? It's very poor and doesn't work with a slew of different apps that schools have paid for?

 

If you're using the global proxy and sending everything back via your on premise appliance then no, you don't.

[Brimstone]

If you're using the global proxy and sending everything back via your on premise appliance then no, you don't.

But that's very impractical, I would guess nearly 90% of schools don't have a fast upspeed proxy.

[Primus]

But that's very impractical, I would guess nearly 90% of schools don't have a fast upspeed proxy.

 

You don't think most schools now have a symmetrical connection? I'd think most do tbh.

[jblackburnHWGA]

We got the global proxy pretty much working now for the iPads. Most the work involved was around changing our smoothwall setup as it wasn't set up in the best way to facilitate the global proxy and pac file.

We are going to use Securly however as they can match O365 credentials so we can get reports on activity next to student something Smoothwall are yet to have

[ibpalle]

can get reports on activity next to student something Smoothwall are yet to have

 

Just a question - if the global proxy is in use for the iPads it normally requires users to authenticate. If that is being done you should get usernames with your activity reports so just wondering.

[jblackburnHWGA]

theres no option for the username to be collected. it uses a cert to allow the device to be filtered then the filtering is pushed through student filtering policies by port

[ibpalle]

There are options - they are manu8la but they are there. A redirect to the login page is available on the global proxy - unfortunately the transparent auth methods NTLM and Kerberos will not work. Proxy auth may be an option but not really secure.