[android tablet] Proxy still stuffed on 3.1

[SimpleSi]

Google need shooting

Ive got a galaxy tab 10.1 which is the current best droid tablet available

 

Ive waited till now as obviouly you need proxy capability in a school

 

Well the tab has some capability but its minimilistic

 

Yiu can brosw the net but not bypass for local ips

 

 

And yiu cant dowload from the market, i have to switch to using my phone as hotspot to dowload edu apps for testing

 

Its a b....y disgrace

 

Shame on you google/Samsung

 

Keybords not grate ither

Si

[plexer]

I use wireless at work with internet via a proxy on my galaxy s in it's stock form, I did notice not being able to get on the market via it though.

 

Ben

[LosOjos]

The keyboard looks blxxdy awful! The pedant in me is crying to re-type that post for you!

 

It is infuriating that Google are being so closed minded about the need for proxy - it's the one major let down for the Android system in my opinion and they're painting themselves in a bad light by refusing to listen to the masses of people who have been asking for this since day one!

 

[NOTE: is it just me or did that come off as management speak? Got to stop helping the missus with her NVQ...]

[sted]

I can get apps to work no problem and market as long as i have opened browser and logged into proxy. Does seem to ignore exceptions though

 

For what diff it makes transformer running 3.2

[tom_newton]

Google's Outlook plugin for Appsync is also crap with proxies (it doesn't like authenticating much). I am not the biggest fan of mr Google.

 

OTOH, the newer builds of Android support SNI, so are much more suitable for transparent proxying than their predecessors.

[Blue_Cookeh]

Sounds like my iPad, I can only get Safari working at work on that, when it comes to the App Store or Apps I have to switch to our unproxied backup ADSL line.

 

Bit ridiculous considering both 'droid and iOS are now being targeted at enterprise environments.

[CyberNerd]

We had some students bring us android pads to connect last week- we're one of those 'open' schools that many on here hate the idea of, where kids bring in their own stuff and we just provide the infrastructure.

 

Anyway, most windows based devices pick up the proxy automatically - but the android 3's didn't (ipads don't either). We just gave the kids the proxy settings and they hooked up first time. All their courses, email etc is http/https and that worked fine through the proxy (pac file through smoothwall, auth to AD). The citrix client worked fine with the proxy settings, but access to the market wasn't available, so adding the client was the most traumatic bit - presumably android doesn't use https for market.

[SimpleSi]

@losojos

I've found it comes with swype and I've changed it to use that as the default keyboard so at least that's one thing I've got working better

[mavhc]

Annoyingly the iPhone Config Utility will let you sent wifi passwords to a iOS device, but not proxy settings. Seems like the only way forward is transparent proxies, what's the easiest way to set that up?

[tom_newton]

Annoyingly the iPhone Config Utility will let you sent wifi passwords to a iOS device, but not proxy settings. Seems like the only way forward is transparent proxies, what's the easiest way to set that up?

 

Make a proxy your default gateway for wireless devices. You can happily make the proxy's default gateway your "real" default gateway, and a well configured proxy should ignore all non-http(s) traffic and pass it to the real deal.

[CyberNerd]

Make a proxy your default gateway for wireless devices. You can happily make the proxy's default gateway your "real" default gateway,

 

How does this work in practice? does squid listen on port 80 and 443 or do you redirect 80/443 through squid?

 

Also, should note that many LA firewalls will block non-http/s traffic, which doesn't help things.

[SimpleSi]

Make a proxy your default gateway for wireless devices.

 

You can happily make the proxy's default gateway your "real" default gateway,

 

and a well configured proxy should ignore all non-http(s) traffic and pass it to the real deal.

 

Can you go over that slowly please

 

Simon

PS And name a product for the job

[tom_newton]

How does this work in practice? does squid listen on port 80 and 443 or do you redirect 80/443 through squid?

 

Also, should note that many LA firewalls will block non-http/s traffic, which doesn't help things.

 

Iptables (or WCCP in a pinch) is used to hijack the HTTP/S traffic and then something like TPROXY to help it on its way through squid. This is the sort of naff implementation detail you dont need to worry about if you have a filtering vendor to help out tho

[tom_newton]

Can you go over that slowly please

 

Simon

PS And name a product for the job

 

 

I guess you can work out which product I can name.

 

So.. lets say you have your wireless clients on a particular IP range, 192.168.7.0/24

Their gateway is a firewall on 192.168.7.254

They get to know of this gateway via the eternal miracle of DHCP

 

1. You get a "Product X" filter (see how amazingly unbiased he is, marvel at his bias free words... )

2. You put it on 192.168.7.253, and say "please be a transparent proxy, thanks, your gateway is 192.168.7.254"

3. You change DHCP so the wireless devices get 192.168.7.253 as their gateway

4. (optional, more secure) you configure your gateway firewall to only allow http(s)connections from 253

5. Cackle slightly evilly as folk get their internets filtered

 

Note: this only works for HTTPS traffic for clients which support SNI. See Wiki for list. Notable baddies: IE on XP, Older Android, iphone3 and below.

[SimpleSi]

So.. lets say you have your wireless clients on a particular IP range, 192.168.7.0/24

Their gateway is a firewall on 192.168.7.254

They get to know of this gateway via the eternal miracle of DHCP

 

But how is this miracle performed? How do the server gods know which clients are wireless???

 

Si

[SimpleSi]

this only works for HTTPS traffic for clients which support SNI.

 

???

 

what would be the point then if it wouldn't work for normal web stuff????

 

I'm just trying to get T'internet stuff to go via county filters and lan stuff (local webservers) not

 

Si

[tom_newton]

But how is this miracle performed? How do the server gods know which clients are wireless???

 

Si

 

Tricky one. One option is to do it for all clients - those with a proxy set won't send ANY http(s) traffic, and as such won't see a difference. Other options are have your Access Points on a separate VLAN? Anyone think of any more cunning plans?

 

There is another method, which requires a bridging device between your AP/the switch your APs are attached and the internet...

[tom_newton]

???

 

what would be the point then if it wouldn't work for normal web stuff????

 

I'm just trying to get T'internet stuff to go via county filters and lan stuff (local webservers) not

 

Si

 

 

Sorry, I am being unclear - perhaps due to sometimes writing posts while on the phone

 

It *always* works for "regular http", sometimes it just doesn't play ball with https, in the case of smoothwall, it means that clients that DONT support SNI get blocked from accessing HTTPS, but everyone gets HTTP regardless.

[CyberNerd]

But how is this miracle performed? How do the server gods know which clients are wireless???

 

Si

 

I'd also go with separate VLAN, and if you are thinking along the lines of user/home equipment needing a transparent proxy then this is probably the best method as you can firewall this vlan from your internal network - which is what we do.

 

question I have now - suppose we set the default route (in the public WIFI VLAN DHCP) to one of our smoothwalls, then presumably traffic (such as DNS requests) from the internal LAN would not be sent back to the internal LAN if smoothwall is just sitting as a proxy in the DMZ (with core switch doing the routing, and Cisco doing the firewalling). So how would I get around this, using smoothwall?

[tom_newton]

DNS requests should go to your internal dns server in any case. For other stuf, the smoothie will send an ICMP reply that says "actually, the gateway's over there, but dont tell the web browser"

[tom_newton]

If anyone has cisco kit knocking about WCCP is a great way to do transparent stuff

[CyberNerd]

DNS requests should go to your internal dns server in any case. For other stuf, the smoothie will send an ICMP reply that says "actually, the gateway's over there, but dont tell the web browser"

 

Yes the DNS does go to the internal DNS server, but the Smoothwall is in a DMZ - 192.168.x.x and the internal address is on a different subnet, so how will the DNS requests get to the the internal DNS server if the default route is that of a smoothwall server, rather than the firewall - I'm guessing DNS caching on smoothie, or will the ICMP reply deal with that. I have a sneaky it's going to be a bit of a headache to setup and I'll be building another smoothwall to get it working ok.

 

If anyone has cisco kit knocking about WCCP is a great way to do transparent stuff

ok, I'll have a look at that.

[tom_newton]

Default route is the smoothie only for the clients, and they can still happily have a route that lets them get to the DNS server (which has a route to the "real" gw). WCCP is the shiz tho, as you can let the cisco do the heavy lifting, you just need the wccp device to be on the path that the clients you need to proxy are taking to the internets, then redirect 80/433 based on src ip, and bob's your mother's brother.

 

Unfortunately it carries the usual cisco learning curve (more of a learning cliff)

[SimpleSi]

I'm sneeking out the door - too complicated for me

 

Si

[SimpleSi]

I'm sorted in my schools as I'd forgotton that the server that Espresso is loaded on is also a proxy server

 

So setting its address as the proxy server in the wi-fi settings means the default browser can be used for Internet and Espresso

Si