Using TMG Server as a Transparent Proxy

[AnnDroyd]

I am trying to set up a Microsoft TMG server to act as a transparent proxy on our network.

 

Basically I want to remove the need for the proxy setting in clients' browsers by setting the TMG server as our default gateway, then forwarding all requrests to our ISPs proxy. This is so people with mobile phones and other non-windows devices can get internet access without configuring a proxy (which depending on the device may not be possible).

 

My first question is, is this possible? Is so, how is it best done?

 

So far I have got a TMG server doing this role in a test environment. However, as well as setting the client's default gatewat to the internal IP address of the TMG server, it also has to be entered in the proxy address. This is the setting I need to be able to remove.

 

Does anyone have any suggestions on this?

[jamesfed]

We got it working by making the TMG server the default gateway - only problem is you then loose the ablity to do user level web filtering

 

So at the moment we have a kinda hybrid enviroment where there is a VLAN for our student WiFi which points at the transparent proxy (using the default gateway of the TMG server) and then our domain joined machines use proxy settings applied by GPO.

[AnnDroyd]

We got it working by making the TMG server the default gateway - only problem is you then loose the ablity to do user level web filtering

 

So at the moment we have a kinda hybrid enviroment where there is a VLAN for our student WiFi which points at the transparent proxy (using the default gateway of the TMG server) and then our domain joined machines use proxy settings applied by GPO.

 

Excellent. Any chance you could talk me through the basic setup? I'm not worried about user level filtering. All users will use go through the same upstream proxy and filtering will be controlled by web-based logins.

 

In particular, how did you get all web requests to forward to your updtream proxy without having to enter your TMG server as the client proxy?

[jamesfed]

Here we basicly have TMG 2010 running inside a Virtual Machine - one network point is dedicated to traffic to our edge switch, one to our domain joined network and a 3rd network point for our Student WiFi VLAN.

 

Our Wireless is setup so that anyone joining our student WiFi SSID gets pointed onto the VLAN and part of the WiFi software also runs a DHCP server to which the default gateway is set as the 3rd nic on the TMG server (this way anyone joining that SSID gets pointed right at the TMG server).

 

For upstream proxy on your TMG server go to Networks > Web Chaining and create a new web chain rule.

Set the action as Redirect them to a specified upstream server and in the settings put the details for your upstream server.

Then in Network Rules make sure the Internet Access rule for your assinged IP address range for your WiFi clients is set to Route instead of NAT.

[AnnDroyd]

Here we basicly have TMG 2010 running inside a Virtual Machine - one network point is dedicated to traffic to our edge switch, one to our domain joined network and a 3rd network point for our Student WiFi VLAN.

 

Our Wireless is setup so that anyone joining our student WiFi SSID gets pointed onto the VLAN and part of the WiFi software also runs a DHCP server to which the default gateway is set as the 3rd nic on the TMG server (this way anyone joining that SSID gets pointed right at the TMG server).

 

For upstream proxy on your TMG server go to Networks > Web Chaining and create a new web chain rule.

Set the action as Redirect them to a specified upstream server and in the settings put the details for your upstream server.

Then in Network Rules make sure the Internet Access rule for your assinged IP address range for your WiFi clients is set to Route instead of NAT.

 

Strange - still not working here. Again, it works if you enter the TMG server as the client's proxy but not without. I'll keep experimenting though.

[jamesfed]

What is your upstream proxy based upon? Squid?

[AnnDroyd]

What is your upstream proxy based upon? Squid?

 

I think it probably is Squid. It's the SWGfL proxy, whatever that uses. Does this make a difference?

[jamesfed]

I think it probably is Squid. It's the SWGfL proxy, whatever that uses. Does this make a difference?

 

Very much so - Squid totaly runins TMGs transparent proxy ablity (we found it out ourselves).

Theres a solution here though but it costs - SecureNAT client Guest Access

[AnnDroyd]

Very much so - Squid totaly runins TMGs transparent proxy ablity (we found it out ourselves).

Theres a solution here though but it costs - SecureNAT client Guest Access

 

Oh dear.

[jamesfed]

Yeah its a total pain - we had a kick and scream at the LEA trying to get them to get us to bypass their Squid filter but then in the end just coughed up the cash.

Give the trial version a go with the script on the site to see if its the same problem though!

[AnnDroyd]

James, another quick question if you don't mind. We've made some progress on this by using pfsense and squid to create a transparent proxy. Everything seems to work for http requests, but not for ssl sites. Have you experienced anything similar to this and were you able get around it? Thanks

[jamesfed]

James, another quick question if you don't mind. We've made some progress on this by using pfsense and squid to create a transparent proxy. Everything seems to work for http requests, but not for ssl sites. Have you experienced anything similar to this and were you able get around it? Thanks

 

SSL all appears to be working fine for us - are you using HTTPS inspection at all?

[AnnDroyd]

No we're not. Worringly, I have read elsewhere that "transparent proxying of SSL traffic cannot be done".

[tom_newton]

Transparent proxying for HTTPS cannot *usually* be done. This is because the traffic is ciphertext by the time it hits the tproxy, so the proxy doesn't know where the traffic is headed.

 

There are a couple of ways round this.. and of course your proxy needs to support them:

 

1) Reverse DNS - look up the IP and see if it has a reverse dns entry, and block based on that

- this is slow, but it works for all connections. It gives only domain blocking. It is unreliable, as many sites have no, or incorrect reverse DNS (incorrect in that it wouldn't give us the info we want, it is probably perfectly correct to the site owner!)

doing MITM off reverse dns is probably mad. AFAIK websense support this?

 

2) SNI

Modern browsers support the SNI extension which includes the destination domain as cleartext.

- this is fast and reliable, but it needs support from the browser. Notable absentee is any version of IE on XP. Most browsers work ok vista and above. You only get domain level blocking (not URL) but you can do MITM and get URL/contnet blocking. Smoothwall Guardian3 supports this.

[AnnDroyd]

James, thanks for your help with this one. We're now running TMG server with ISA script as a transparent proxy. Everything seems fine, including access to HTTPS sites.

[matthewc]

Hi,

 

We're also trying to setup TMG as a transparent proxy however we're having problems with HTTPS traffic. We also have a squid based RM proxy (SEGfL) and have specified it as an upstream proxy for external connections (proxy.segfl.ifl.net). We've purchased IsaScript and entered the script recommended in the previous post which seems to be working properly with HTTP traffic but we get timeouts when trying anything HTTPS.

 

For the upstream proxy we've tried the default of 8443 for SSL and also changed it to 8080 but it doesn't seem to make any difference. We've also set TMG to route the traffic from our WiFi network to the External connection but this hasn't had any effect either. Is there anything else we may need to change to get this working?

 

Any ideas anyone?

 

 

Cheers

[chrisjako]

I'm also trying to setup a transparent proxy with seperate VLAN network & IP range on an open SSID, when i direct the default gateway via DHCP to the forefront TMG server i get this on on an open client device:

 

 

We're using ubiquiti unifi APs and the physical server running the controller software has two network cards 10.11.216.1 (open) and 10.11.227.14 (secure) - its also my DHCP server for the open network of which the gateway is set to 10.11.216.2 that is the third network card i setup in my TMG server, should I at least be getting http traffic with this setup?

[K.C.Leblanc]

Strange - still not working here. Again, it works if you enter the TMG server as the client's proxy but not without. I'll keep experimenting though.

 

I can't remember where I read it, but I saw somewhere that TMG doesn't work as a Transparent proxy with web chaining is the upstream proxy is running squid. I'm assuming your on SWGfL who use squid.

[matthewc]

Have you setup a rule to NAT the traffic from the seperate VLAN to your external connection?

[chrisjako]

yes the source network is "sjwifi" and set to route relation

 

[richwil]

We have a similar problem with TMG acting as a transparent proxy for our guest wifi. We have a direct Internet connection so don't have any of the upstream issues that some are facing but still have an issue with SecureNAT clients accessing secure websites. http works fine. I wonder if Jamesfed or Jwood or anyone else who has this sorted are able to offer any assistance on this? We're beginning to think that we will have to require clients to enter proxy settings which as far as I can see would mean that Android users wouldn't be able to use the wifi.

 

Many thanks,

 

Richard

[jamesfed]

Sorry I only have experiance with the problems that Squid gave us - maybe it would be worth getting a trial of ISA Script and seeing if the script thats in a link in my previous posts will work?

 

All the same over the past few months we've noticed a decline in the number of Droid users with phones that don't support proxys so I can imagine within the next 6months-1 year we will be rid of this problem anyway.

[richwil]

Thanks for responding. I will have a look at the script and see if that helps. We are already using some software called captivate by the same company to get the SecureNAT clients to authenticate before they access the Internet.

 

I had a look at what devices were using the guest network and only about 13% were running Android. My understanding is that it's only Ice Cream Sandwich that supports proxy settings on Android or have you found that earlier versions allow users to put in Proxy info?

 

Cheers.

[sven]

I'm going to try and revive this thread, as I am having the EXACT same issues, but with no apparent solution.

 

I want to make TMG transparent so that users with mobile devices can simply "automatically detect settings" within their browsers without having to edit the LAN settings and populate it with proxy details (which isn't even possible on some mobile devices). When I do, it does the same as reported in here, whereby HTTPS pages simply do not work. I have contacted the local council that run the upstream proxy, and they have confirmed that it does indeed run SQUID. I have tried using the ISASCRIPT but I get the exact same result. I successfully completed the "Hello World" tutorial in the documentation but the script listed here doesn't seem to change anything. I have used HTTPWatch and it's still getting stuck on the SSL. Is there anything anyone can suggest, or does this NEED to be looked at by the council that provide the upstream server?

 

This is seriously keeping me up at night