PatRamsden Posted January 12, 2012 Posted January 12, 2012 Hi guys, Hoping you can help, I am having some trouble setting up WPAD on a network I look after. They have only just got a wireless network so they now want to be able to use smartphones and the likes so this means that setting the proxy through GPO wont work. The network is the following Windows Server 2008 R2 Server Windows XP Clients Various Smartphones Ruckus Wifi network using Zonedirector 1100 and Zoneflex 7363 APs I have so far done the following- Set up a WPAD website with IIS Set up DNS so you can browse to the wpad.dat file by typing in wpad/wpad.dat Create a wpad.dat file. function FineProxyForURL (url,host) { return "PROXY proxy1.equinoxsoltuions.com:80; DIRECT"; } As you can tell from what i have posted they are part of LGFL and use the equinoxsolutions proxy. The problem i am having is that when i set a web browser to auto config it just hangs and nothing happens. Any help you can give is greatly appreciated. Cheers Pat
Mr_Mac Posted January 12, 2012 Posted January 12, 2012 Have you set DHCP option 252? search google for wpad dhcp 252
PatRamsden Posted January 13, 2012 Author Posted January 13, 2012 should be wpad.yourdomain/wpad.dat iirc When I browse to wpad.mydomain.local/wpad.dat I can also find the file. I am not really wanting to use DHCP for it because I want it to work on smartphones and also other web browsers than IE. Is my wpad.dat file correct? This is my 1st time setting this up so am insure weather I am even going in the right direction.
Mr_Mac Posted January 13, 2012 Posted January 13, 2012 You had FineProxyForURL and not FindProxyForURL try function FindProxyForURL (url,host) { return "PROXY proxy1.equinoxsoltuions.com:80; DIRECT"; }
White_Fi Posted January 20, 2012 Posted January 20, 2012 FYI, Ruckus 9.3 can support delivery of the wpad file directly from the ZD to the client at association level.
PatRamsden Posted January 20, 2012 Author Posted January 20, 2012 FYI, Ruckus 9.3 can support delivery of the wpad file directly from the ZD to the client at association level. Is there a guide on how to do this anywhere? I couldnt find it on the Rukus site or in the documentation. Im fairly new to Ruckus so still learning my way around.
White_Fi Posted January 20, 2012 Posted January 20, 2012 As long as you are running 9.3: 1) Configure 2) WLANs 2) Edit or Create new WLAN 3) Expand advanced options 4) Upload WPAD file or point to the server holding the WPAD file (useful for unauthorized clients needing the proxy)
Tallwood_6 Posted January 20, 2012 Posted January 20, 2012 So the file is then on the http://name or ip of zonedirector/uploaded/wpad.dat what do you then need to add to DNS and DHCP for it to automatically detect the settings bareing in mind that the wpad.dat isnt saved at teh root of the zonedirector?
White_Fi Posted January 20, 2012 Posted January 20, 2012 Its is one or the other. If you add the wpad to the ZD then the ZD delivers it to the client upon association. If you chose to deliver it via DNS or DHCP then you do not need to add anything into the ZD unless you want unauthenticated clients to obtain the WPAD file, which is useful for web-portal activation if a proxy is required for the ZD redirect
Tallwood_6 Posted January 20, 2012 Posted January 20, 2012 Umm it doesnt seem to be working for me on a test win7 laptop using ie9. The wpad.dat appears to be ok as if i check 'Use automatic configuration script' and point it at the address on the zonedirector everything works fine?
White_Fi Posted January 20, 2012 Posted January 20, 2012 Is the WPAD working when taking the ZD out of the equation, i.e deliver it via dhcp or dns? 9.3 has only just been released so i am not aware of any bugs yet nor am i aware of anyone using this feature yet so feedback is nice.
Iain Posted January 20, 2012 Posted January 20, 2012 Have you added the MIME type for the .dat extension in IIS? I don't think it is installed by default. If it's not listed, add it as: Extension: .dat MIME type: application/x-ns-proxy-autoconfig
Tallwood_6 Posted January 20, 2012 Posted January 20, 2012 I'm going to test delivery via DNS i just need to remove wpad from the DNS block list which MS seems to have added in a 2003 security update. I'm positive there is nothing wrong with the wpad.dat though, i've tried 2 versions one is a renamed proxy.pac that works for clients elsewhere and one i created from fresh which is much more basic but works when you point to it under 'Use automatic configuration script'. Has anyone else got it working from the zonedirector yet?
PatRamsden Posted January 20, 2012 Author Posted January 20, 2012 As long as you are running 9.3: 1) Configure 2) WLANs 2) Edit or Create new WLAN 3) Expand advanced options 4) Upload WPAD file or point to the server holding the WPAD file (useful for unauthorized clients needing the proxy) Thanks, I will give this a try Have you added the MIME type for the .dat extension in IIS? I don't think it is installed by default. If it's not listed, add it as: Extension: .dat MIME type: application/x-ns-proxy-autoconfig I have done this, also unblocked the wpad setting in DNS
IrritableTech Posted January 20, 2012 Posted January 20, 2012 Has anyone else got it working from the zonedirector yet? Just downloaded the new firmware. Going to install it this weekend and give this feature a try. We've already got wpad working on our domain, but I like the thought of it being on the controller, and a different file for each wlan.
Tallwood_6 Posted January 23, 2012 Posted January 23, 2012 I've setup wpad to be delivered via DNS to test and this works fine for firefox and and internet explorer via a wired connection however it only seems to work for firefox via wireless which i'm slightly baffled by. The wireless WLAN i'm testing with has no ACL configured, no Enable captive portal/Web authentication or Client Isolation so i cant workout whats teh cause. The ZoneDirector auto config i still cant get to work for firefox or IE though.
Jamo Posted January 23, 2012 Posted January 23, 2012 Isn't DHCP the preferred choice these days? I believe most things support this. The DNS method was not preferred as someone could easily bring their own machine named WPAD into a domain and cause some interesting problems with your network!!!
Tallwood_6 Posted January 23, 2012 Posted January 23, 2012 The DNS method is more widely supported across browsers apparently. You would have to have a machine joined to the domain called wpad, have removed the DNS exclusion for wpad and not have an existing record wpad in DNS for that exploit to work surely?
Jamo Posted January 23, 2012 Posted January 23, 2012 Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia You are correct on that DHCP only really supported by IE and Chrome! Looks like the DNS method is still insecure though. DNS lookup removes the first part of the domain name (presumably the client identifier) and replaces it with wpad. Then, it "moves up" in the hierarchy by removing more parts of the domain name, until it finds a WPAD PAC file or leaves the current organisation.
Tallwood_6 Posted January 23, 2012 Posted January 23, 2012 Well i've ascertained that there is nothing up with either of my two wpad.dat files anyway so the problem looks to be with the ruckus delivery to the clients.
januttall Posted January 23, 2012 Posted January 23, 2012 i know this isnt useful but i used a transparent proxy between the clients and the NGFL proxy wich works nicely. uthenticated users use one vlan (Enterprise security) and unathenticated (WPA-PSK) is vlaned to the transparent proxy wich ports them directly to NGFL so they cant see our internal anything, and get fully filterd. As unauthenticated users they will need to get information from dhcp as they need corect ip addresses to function so not allowing them access to some form of dhcp is a desatrous idea.
TechieWils Posted January 23, 2012 Posted January 23, 2012 They have only just got a wireless network so they now want to be able to use smartphones and the likes so this means that setting the proxy through GPO wont work. From my experience only Ipones/Ipads can pick WPAD settings and apply them. If you using an Android (unless rooted) or blackberry you cannot set a proxy into them and your WPAD will be ignored. I ended up setting up a transparent proxy to allow basic access for smartphones. If I'm wrong then I apologies.
PatRamsden Posted January 23, 2012 Author Posted January 23, 2012 I havent had a chance to try this yet, will be trying tomorrow when I am on site. I have a feeling some people will have Android devices, I know some have Blackberrys. How would I go about setting up a transparent proxy?
Guest Posted December 3, 2013 Posted December 3, 2013 hi if it helps i have the same setup @PatRamsden I am using the latest 9.6.1.0 build 15, i have hosted the wpad.dat file on the ZoneDirector, created a DHCP entry for 252 and in the string value i entered the zonedirector ip and dat file i.e. "http://x.x.x.x/wpad.dat" then unblcked the wpad from DNS, created a cname entry for the server hosting this wpad with WPAD and the server ip addresss i have just try this and works fine on windows laptops! just having trouble with android now, somehow need them to authenticate with the zone director so they can get the wpad file.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now