Going serverless - What do you do about proxy settings?

[TwistedHelixis]

Currently we have a transparent pupil proxy, so everyone in the school gets this by default, but we also have a staff proxy.

 

Our LA run the Smoothwall filtering server, they supply us a proxy address for the staff, which is deployed from GPO under the user OU.

When the staff go home, they simply open the proxy settings and disable the proxy, or double click on a script I created that turns the proxy off.

When the staff log onto our domain, the GPO runs and turns the proxy back on again.

 

We are not too far off having everything in place to be able to remove our Domain Controller.

 

I was looking into how we can deploy our proxy settings after removing our DC and everything I have read so far doesn't seem to fit our needs.

 

One method seems to be using a web server to host the proxy settings, but eventually we will not have any servers.

Another suggests hosting the proxy config on a remote web server, but most of our staff also take their laptops home with them, so I am guessing it would still pick up and try to force the proxy settings even when they are not in school.

 

Is there a way of getting the staff proxy setting to only apply while the device is in school, but without any web servers?

Edited March 16, 2025 by TwistedHelixis

[slugshead]

WPAD

 

https://kb.smoothwall.com/hc/en-us/articles/360002030230-Using-Automatic-Proxy-Discovery-with-the-Smoothwall-Filter

 

If the users computer cannot see the proxy, they go direct.

[chaplic]

I had a solution for a while where I deployed IIS running locally on each PC, and hosted the proxy pac on that, then configured pac settings as http://localhost/proxy.pac.

 

The pac file also made use of myipaddress to determine if it was in school (as the subnets in use there were unusual). Sounded bonkers, but it worked.

 

intune can configure the proxy settings per WiFi (so I assume will be doable other ways) , so if you can get away with simply proxy exclusions and not need clever pac stuff then that could be an option

 

as could a remote web server with the pac file making use of myipaddress.

[dmj]

WPAD

 

https://kb.smoothwall.com/hc/en-us/articles/360002030230-Using-Automatic-Proxy-Discovery-with-the-Smoothwall-Filter

 

If the users computer cannot see the proxy, they go direct.

 

^^^ this. You've been able to automate this since the mid 90's

[tom_newton]

If you need somewhere to host the pac file, I would recommend an S3 bucket from AWS (or blob in Azure..) behind a free cloudflare instance (to make sure the blob/s3 never goes above the free tier either)

[paulkerton]

WPAD is a lovely platform to launch MitM attacks from. I'd be very cautious.

[tom_newton]

You're thinking of the WPAD dns - a specifically set pacfile is not vulnerable in that way.

[psydii]

Perhaps see if you can re-implement the filter as transparent proxy? Pretty sure this is a standard feature of most filtering systems these days.

 

This way the users see an improvement - it becomes zero config from their point of view, and from the admins, you just have to change pushing a proxy setting for pushing a MITM/TLS inspection root cert, which you probably already do because otherwise your wouldn't be able to monitor/filter 95% of your users web activities.

 

- - - Updated - - -

 

I had a solution for a while where I deployed IIS running locally on each PC, and hosted the proxy pac on that, then configured pac settings as http://localhost/proxy.pac.

 

The pac file also made use of myipaddress to determine if it was in school (as the subnets in use there were unusual). Sounded bonkers, but it worked.

 

intune can configure the proxy settings per WiFi (so I assume will be doable other ways) , so if you can get away with simply proxy exclusions and not need clever pac stuff then that could be an option

 

as could a remote web server with the pac file making use of myipaddress.

 

This is both horrific and impressive.

[tom_newton]

The challenge here is it's an LA proxy by the looks - they sometimes arent transparent (due to routing oddness between school and proxy, or the need to loadbalance, which is a lot harder transparent). Even though the smoothwall filter is capable of a transparent mode, it might not be straightforward here.

[mavhc]

Is it me or is this whole serverless thing completely ridiculous? You still have lots of servers, dhcp for example. What's with the purity pledge of having 0 servers, just making life difficult for yourself.

[gszech]

Is it me or is this whole serverless thing completely ridiculous? You still have lots of servers, dhcp for example. What's with the purity pledge of having 0 servers, just making life difficult for yourself.

 

Your router can run DHCP / DNS.

[mavhc]

So your router is a server. Just run a webserver locally already, doesn't require some £10k 1000kW multi cpu computer.

[dmj]

So your router is a server. Just run a webserver locally already, doesn't require some £10k 1000kW multi cpu computer.

 

But is much easier to run a container, give it to Google/Amazon and let them manage/scale it. We do serverless because it's easier, not because it's making life difficult !

[gszech]

So your router is a server. Just run a webserver locally already, doesn't require some £10k 1000kW multi cpu computer.

 

With this logic your microwave is also a server.

[psydii]

But is much easier to run a container, give it to Google/Amazon and let them manage/scale it. We do serverless because it's easier, not because it's making life difficult !

I'm sure containers make sense when your running hundreds of them. But when you are a desktop computer technician, you are way more familiar with installing and managing apps and configurations in the traditional manner.

 

Also in this specific case - the problem is needing to configure devices so they can access the internet through a filter/firewall that is not in the control of the local IT Techs/Service. So putting the configuration on the far side of that (in AWS/GCC/Azure) doesn't seem like the best/most obvious place?

[Koldov]

double click on a script I created that turns the proxy off.

 

Does this not work in reverse?

 

Many years ago we used to have a.vbs script that did this, but we also had another one that put the proxy details back in.

 

Does the proxy address change frequently?

[psydii]

With this logic your microwave is also a server.

I was troubleshooting a door entry system today. the controllers run the following services (i.e. Servers) HTTP FTP TELNET SMTP. Since I can upload arbitrary files to the filesystem and thus make them available to any computer that can connect to TCP:80... they are actually unquestionably servers.

 

They cannot be replaced by "the cloud" because they are physically wired to the door magnets, the proximity readers and the firealarm. Maybe alternatives work by connecting out over 443 to a SAAS platform, but last time I checked, replacing all the controllers and the annual licence for keeping the SAAS element up, would cost as much as replacing the entire VM_HOSTs+SAN that ran the school for the last 10 years.

[dmj]

I'm sure containers make sense when your running hundreds of them. But when you are a desktop computer technician, you are way more familiar with installing and managing apps and configurations in the traditional manner.

 

I guarantee deploying a container is fewer clicks than managing a web server. I deployed dev platform for our marketing department last week (2 containes). It's been running for a few days and has cost them 70p so far. It took about 2 mins by hand. Of course I'll productionalise this in terraform and put a proper load balancer in front of it, but please don't try and make out that serverless is something only multi nationals do, or that desktop technicians are somehow incapable.

[FN-GM]

Currently we have a transparent pupil proxy, so everyone in the school gets this by default, but we also have a staff proxy.

 

Our LA run the Smoothwall filtering server, they supply us a proxy address for the staff, which is deployed from GPO under the user OU.

When the staff go home, they simply open the proxy settings and disable the proxy, or double click on a script I created that turns the proxy off.

When the staff log onto our domain, the GPO runs and turns the proxy back on again.

 

We are not too far off having everything in place to be able to remove our Domain Controller.

 

I was looking into how we can deploy our proxy settings after removing our DC and everything I have read so far doesn't seem to fit our needs.

 

One method seems to be using a web server to host the proxy settings, but eventually we will not have any servers.

Another suggests hosting the proxy config on a remote web server, but most of our staff also take their laptops home with them, so I am guessing it would still pick up and try to force the proxy settings even when they are not in school.

 

Is there a way of getting the staff proxy setting to only apply while the device is in school, but without any web servers?

 

 

What are you using to manage your endpoints? What will replace group policy? If it’s something like InTune could you use something like this?

[chaplic]

Does this not work in reverse?

 

Many years ago we used to have a.vbs script that did this, but we also had another one that put the proxy details back in.

 

Does the proxy address change frequently?

 

You can write a scheduled task thats triggered on change of network. Script that runs then decides if it can see the school proxy, and if so, turns it on..

[CrootUK]

Is it me or is this whole serverless thing completely ridiculous? You still have lots of servers, dhcp for example. What's with the purity pledge of having 0 servers, just making life difficult for yourself.

 

amen

 

[APMerry]

With this logic your microwave is also a server.

 

Your Microwave is also an xbox

[mavhc]

minimum, get a raspberry pi, install web server, copy 1 wpad.dat file onto it, add it to dns as wpad, set auto updates, done. 22kWh/year

[dmj]

minimum, get a raspberry pi, install web server, copy 1 wpad.dat file onto it, add it to dns as wpad, set auto updates, done. 22kWh/year

 

still more complex, more expensive, less reliable and less scalable than running serverless in free tier

 

Cloud Run pricing

Free tier

First 180,000 vCPU-seconds/month

First 360,000 GiB-seconds/month

2 million requests/month

[psydii]

minimum, get a raspberry pi, install web server, copy 1 wpad.dat file onto it, add it to dns as wpad, set auto updates, done. 22kWh/year

Or just uploaded it to the existing door controllers and use DNS to round-robin load balance.

 

Edited March 18, 2025 by psydii