[23h2] PAC File

[newpersn]

Hello,

 

Is anyone using a PAC File on Windows 10/11. Could anyone share a file with me so i can understand it and write one for us.

 

Also - Where do you save it?

 

We are still with SWGFL... (Looking to move at some point when contract expires) Trying to make life easier for staff so they dont have to turn proxy on and off..

 

Thanks

Newp

[Steve21]

You should be able to get SWGFL to turn on transparent proxy so you won't need either options as well

 

Steve

[LeMarchand]

We used to put our PACs in C:\inetpub\wwwroot of our WSUS server as http:///.pac seemed to work.

 

You're way better off going transparent if you can. If not, the pac used to have a "Check IP address and if at school use proxy, if not, go direct" flow. I could only find later ones that occasionally get used to block access for particular users or at certain times. If you can't go transparent I can see if I can dig a more relevant one up.

 

Edit: I was bored.

 

function FindProxyForURL(url, host)
{
//Variable strings to return
var proxy_no = "DIRECT";
//If specific URL needs to bypass proxy, send traffic direct
//	if (shExpMatch(url, "http://Wherever")) { return proxy_no; }
       if (shExpMatch(url, "http://corp-intranet.LEA*")) { return proxy_no; }	
// If at school, use proxy
if (isInNet(myIpAddress(), "***.***.***.***", "SubnetMask"))
	return "PROXY Proxy:PORT";
else
	return "DIRECT";
}

Edited July 24, 2024 by LeMarchand

[newpersn]

There is still some bits that are filtered that staff need access to. We do have transparent working.

 

I have created a PAC file and saved it accessible but unsure if working, Code underneath for checking

 

function FindProxyForURL(url, host)
{
//Variable strings to return
var proxy_no = "DIRECT";
//If specific URL needs to bypass proxy, send traffic direct
//	if (shExpMatch(url, "http://servhdsk")) { return proxy_no; }
       if (shExpMatch(url, "http://servprinting")) { return proxy_no; }
if (shExpMatch(url, "servhdsk/osTicket")) { return proxy_no; }	
// If at school, use proxy
if (isInNet(myIpAddress(), "10.7.x.0", "255.255.252.0"))
	return "PROXY sslfilter.staffproxy.swgfl.org.uk:8080";
else
	return "DIRECT";
}

Edited July 29, 2024 by newpersn

[LeMarchand]

My code had a wildcard at the end of each potential match, e.g.:

 

//If specific URL needs to bypass proxy, send traffic direct//    if (shExpMatch(url, "http://servhdsk*")) { return proxy_no; }

 

Thinking about it, that should also mean

 

    if (shExpMatch(url, "servhdsk/osTicket")) { return proxy_no; }    

 

is redundant.

 

I also had a couple of "local" exceptions:

 

if (shExpMatch(url, "http://Sch.ool.IP.*")) { return proxy_no; }
   if (shExpMatch(url, "http://localhost*")) { return proxy_no; }

 

Otherwise that seems OK, unless you need to use https as well these days. I'm sure that, even back then, the LA stuff was on https and that PAC seemed fine.

 

IIRC the pac needed to be addressable as http/s: as some browsers didn't like file/UNC paths. I used to test on a laptop and the hotspot to my phone to simulate "home" use.

[newpersn]

 

Should be working?.

[LeMarchand]

Possibly turn off auto-detect and test?

 

IIRC if you use the URL of the PAC, it should show the contents in the browser.

[Steve21]

Not sure if that's a typo or you meant to show it like that as security etc, but I don't think that will work: "10.7.x.0"

 

It needs to be a valid range, so not wildcard attempts allowed etc

 

Seve

[newpersn]

Possibly turn off auto-detect and test?

 

IIRC if you use the URL of the PAC, it should show the contents in the browser.

I get a 404 when I got to the url. But I see the text file that's in the same directory.

[newpersn]

Not sure if that's a typo or you meant to show it like that as security etc, but I don't think that will work: "10.7.x.0"

 

It needs to be a valid range, so not wildcard attempts allowed etc

 

Seve

That was on purpose. But do I need to put 10.7.x.1 instead of .0?

[LeMarchand]

Not sure if that's a typo or you meant to show it like that as security etc, but I don't think that will work: "10.7.x.0"

 

 

I assumed it was to obscure the real IP, but good point if not.

 

I get a 404 when I got to the url. But I see the text file that's in the same directory.

 

I used http://NameOfServer/NameOfPAC.pac and got this:

 

 

[LeMarchand]

That was on purpose. But do I need to put 10.7.x.1 instead of .0?

 

I used 0.

[newpersn]

Working now - I had to update MINE types in IIS and also use full domain name.

 

Thank you

[newpersn]

Now - I got a issue with GP wont apply any IE updates.. so i'm trying to set it in Edge

 

 

Does that look right?

[LeMarchand]

Never done it in Edge. Do you need the < brackets >?

[newpersn]

Tried that - If i try and add it manually in to settings it crashes out. (same in IE Options)

 

2 computers with the same issues.

[LeMarchand]

Not on site this week to have a play, which probably isn't much help to you!

[Steve21]

Haven't used PAC for a while, but in terms of setting it via GPO it used to be like:

 

{"ProxyMode": "pac_script", "ProxypacUrl": "http://MyServer:8080/proxy.pac"}

 

etc

 

Steve