[Smoothwall] Devices that have a pre-configured proxy

[timbo343]

We have a couple of guest devices that are used at our place which are part of the NHS. They have recently been re-configured by the NHS to use the NHS proxy systems and the end user is unable to remove these settings.

 

Is there a way to get these devices to work through a Smoothwall device so the users don't have to keep tethering their devices to their mobile phones as we have a fairly rubbish phone signal where they are based in school.

 

I have tried to look at the firewall logs and the web filter logs but nothing is showing up for these devices.

 

The connectivity to the web is working fine on the SSID as i have tried it on a test device and managed to get out without any issues.

 

As i say, it seems that the devices configured proxy settings are preventing the device from accessing the net. Having an expection for this device or a forward rule for these devices to talk to the NHS proxy server would be great.

[robyholmes]

Are these like the NYCC devices with a program on them that VPNs the proxy traffic. We reserve the IP and just put them in Auth Exceptions so nothing is filtered etc.

 

This was agreed with the head and as it requires a manual step to setup, it's not a additional risk.

[chaplic]

This is hacky-as-hell but would work assuming the machines will use whatever proxy server

 

1) Figure out the name of the NHS proxy server and what port, e.g. proxy.blah.nhs.gov.uk 8080

 

2) On your own DNS server, set a zone blah.nhs.gov.uk and an A record proxy. If the ports for your proxy and the nhs proxy are the same, then just enter the IP of your proxy. If the ports are different, then you would have to stand up a proxy listening on that port and chain it to your smoothwall.

 

Another approach might be to setup something responding to WPAD or even DHCP option 252, but these will affect other devices.

 

 

Edit: Just realised you'll also need to install the SSL interception cert for your proxy on the laptops too, if possible.

Edited April 26, 2021 by chaplic

[ibpalle]

Chaplics suggestion would seem to be the right one if you cannot change the proxy settings. Would be nice if NHS devices could use automatic proxy discovery - that would allow you to setup the wpad alias for the Smoothwall and have the laptop dynamically adjust proxy settings based on location but ...

[timbo343]

What about if the SSID is on a VLAN and the VLAN IP addresses are controlled by the Smoothwall. Surely i just add the zone to the Smoothwall's local DNS and allow port 3128 through the web proxy?

 

I've got the information for the NHS server and the port is 3128.

 

- - - Updated - - -

 

Are these like the NYCC devices with a program on them that VPNs the proxy traffic. We reserve the IP and just put them in Auth Exceptions so nothing is filtered etc.

 

This was agreed with the head and as it requires a manual step to setup, it's not a additional risk.

 

Might have to try that to see if it works as a work around.

[ibpalle]

If the clients on the network is using Smoothwall as DNS then yes, you should be able to add the hostname to the Smoothwall DNS override.

[timbo343]

Are these like the NYCC devices with a program on them that VPNs the proxy traffic. We reserve the IP and just put them in Auth Exceptions so nothing is filtered etc.

 

This was agreed with the head and as it requires a manual step to setup, it's not a additional risk.

 

Thanks for this, works a treat!