[ipad] Does the itunes app store work behind a proxy

[SimpleSi]

I'm having a bad day

Are Ipads normally able to connect to the App Store in schools behind proxies?

 

Mine wouldn't connect via school wifi (yes - I set the proxy settings in wifi and it browses internet fine using Safarii) so I used my phone as portable hotspot and it connected to the App Store OK.

 

I've switched back to school wifi and although I'm not getting cannot connect to itunes msgs now - half the apps are greyed out (as if its using some sort of half-filled cache!)

 

regards

Simon

PS This is in Lancs CLEO land BTW

[tmcd35]

Just double-checked on my iPhone and it's working here. I can browse the app store and I just did a quick update for 1 app to test downloading, all fine. Behind a several proxies.

[SYNACK]

If I recall correctly it does not work and requires exceptions to prevent needing auth and maybe even transparent proxy:

3.Test using another network. ◾Connect your computer or device to another network and testing helps determine the next step. This is also helpful if multiple devices are affected.

◾If your device can connect to Wi-Fi and a cellular network, larger downloads may not be possible over the cellular network.

◾If the issue disappears while connected to another network, you may need to work with your support options to open access to: ◾itunes.apple.com

◾ax.itunes.apple.com

◾ax.init.itunes.apple.com

◾albert.apple.com

◾gs.apple.com

◾ax.phobos.apple.com.edgesuite.net

◾mzstatic.com

 

◾Note: iTunes may use the fully qualified version of these addresses for additional security.

 

4.iTunes uses well known ports and these ports may need to be opened for iTunes: 80, 443, 3689, 5297, 5298, 5353, 8000-8999, and 42000-42999.

iTunes: Advanced iTunes Store troubleshooting

 

plus:

 

I had a similar experience when blocking "Entertainment - MP3 and Audio Download services" which blocked Apple devices accessing the App Store and iTunes. Allowing the category wasn't an option so we added http://itunes.apple.com and http://phobos.itunes.com under a custom allowed category.

 

This got the apple store working but purchases wouldn't go through.

 

We're using the Network Agent and blocks were occurring for subnets in 17.X.X.X networks at the time of testing. Supposedly the whole of 17.0.0.0/8 is allocated to Apple. Apple use a whole heap of different addresses on different subnets of that scope so we couldn’t just add each of them as an exception. i.e. https://17.8.25.94:443, https://17.8.79.45:443 etc.

 

We ended up using “Recategorize URL” and then “Advanced” to add a Regular Expression of “^https://17\.” (without quotation marks) .This allowed all of 17.0.0.0 as a custom allow category.

 

If you want to be more security conscious you can do a “Investigative Report” and use the search for textbox for “Destination IP” of “17.” and maybe track down the main subnets in use. Bear in mind that the running too many Regular Expressions may have a performance impact.

 

My logs so far indicate that the Apple stores use ~140 unique ip addresses, on 23 different /24 networks, on 8 different /16 networks.

 

If you wanted to go the route of only allowing the smaller subnets such as the 17.149.156.0/24 subnet you’d use a Regular Expression of “^https://17\.149\.156\.” (without quotation marks).

 

My limited explanation of this is that the ^ means ‘at the start of the line’. It then matches https://17. Next comes the \, in regular expression use the full stop is a special character so there’s a backslash before it to say ‘the next character should be taken literally’. Then it matches 149, and then another full stop, etc, etc.

 

Alternately you can keep checking the logs and put all of the hits you see in the format previously suggested by Susie, https://X.X.X.X:443. You'd have to make sure to keep an eye on this though, if you miss an address or a new server is added then users will have intermittent issues until you add it.

iTunes Store

 

 

I think I remember Smoothwall having to scramble to add a new category when people started deciding to try and use iPads in schools.

 

 

The exception on the managed provider may not be global so you may have to ask them to enable the hole to allow Apple stuff to through without supervision.

Edited November 23, 2012 by SYNACK

[SimpleSi]

I've come to another school and it works there so must have been something specific to this mornings school

Simon

[j224]

Hi SimpleSi,

 

We don't have iPads but our Touches work with the app store when connected to the school proxy connection. I can download apps from the device.

 

However, I was having trouble downloading apps from my laptop (connected to the same wifi). I'm having to use Proxomitron to get around the issue that the proxy server is creating.

[sparkeh]

Yeah iTunes and proxies are not a happy combination.

I know from looking into a simlilar problem last week, authenticating proxies are a particular issue.

[Marci]

HTTPS for the AppStore, so down to how the proxy is configured (bearing in mind that iOS only asks for details for HTTP proxy, not HTTPS, thus there is no username / password sent for HTTPS queries until your proxy rejects HTTPS without the auth, thus causing device to prompt for auth, which will be stored for a relatively short amount of time - 20 mins or so)

[zag]

Works fine on our sophos proxy

[SimpleSi]

Came back to orig non-working school and still not working so I've given county support a call and we'll see what they say.

 

Must remember to try it out in all my schools to see if any pattern.

 

Simon