WPAD + DNS + APPLE = ???

[CHR1S]

I deliver my wpad file via DNS, it works everywhere, just not on the ipads/phones.

 

Can anyone else confirm this for me please?

 

Thanks

[CHR1S]

Or any mobile device for that matter, seems not to work on my S3 either

[sparkeh]

Have you tried using the DHCP option as well?

Can't remember off the of my head which devices support which but I know that not all devices support it via DNS, its worth having both enabled.

[CHR1S]

Its only IE/Chrome that works with DHCP.

 

If I point the ipad at the wpad url it works perfectly. Just not the auto DNS way

[Michael]

I can confirm if you host a proxy.pac file on Server 2008 R2 via IIS 7.5 it then works correctly for iPads.

[sparkeh]

I did read about some success with changing the auto config url to http://wpad/wpad.dat? for apple devices.

[CHR1S]

I can confirm if you host a proxy.pac file on Server 2008 R2 via IIS 7.5 it then works correctly for iPads.

 

But do you point it at the wpad file with a URL or use DNS to deliver it?

[CHR1S]

I did read about some success with changing the auto config url to http://wpad/wpad.dat? for apple devices.

 

The URL if entered manually works fine, I want no user interaction so in BYOD situations they just connect to the wireless and DNS does the rest.

[sparkeh]

The URL if entered manually works fine, I want no user interaction so in BYOD situations they just connect to the wireless and DNS does the rest.

Oh I realise that, just trying to help with some troubleshooting, I was reading about Apple devices that could resolve http://wpad/wpad.dat if entered into a browser but not if trying to do it via DNS, it was reported that changing the auto config url to http://wpad/wpad.dat? solved the problem. I know that you don't want to have to do this on every device.

[CHR1S]

it was reported that changing the auto config url to http://wpad/wpad.dat? solved the problem. I know that you don't want to have to do this on every device.

 

So if I host two wpad.dat files - wpad.dat and wpad.dat? on the server the ipads will pick them up?

 

Or am I missing your point?

[CyberNerd]

So if I host two wpad.dat files - wpad.dat and wpad.dat? on the server the ipads will pick them up?

 

Or am I missing your point?

 

symbolic link them.

[CHR1S]

symbolic link them.

 

Its the last day of term, im gonna need the big picture version today!!

[Michael]

But do you point it at the wpad file with a URL or use DNS to deliver it?

 

On the iPad for example under proxy you specify Auto then enter: http://SERVERNAME:8082/proxy.pac for example.

[CHR1S]

But thats exactly what im trying to avoid doing.

[Michael]

But thats exactly what im trying to avoid doing.

 

I know, but as far as I'm aware Apple doesn't support it via the DNS method. Alternatively in an ideal world a transparent proxy would resolve these sort of issues.

[CyberNerd]

Its the last day of term, im gonna need the big picture version today!!

 

lol. Rather than have two files - you create a symbolic link so that if one file is edited so is the other!

 

example

ln -s wpad.dat wpad.dat? 

[CHR1S]

I know, but as far as I'm aware Apple doesn't support it via the DNS method. Alternatively in an ideal world a transparent proxy would resolve these sort of issues.

 

That was my thinking.

 

The transparent proxy is where im heading, just wanted this as a stop gap. Works great for laptops etc tho.

[Michael]

That was my thinking.

 

The transparent proxy is where im heading, just wanted this as a stop gap. Works great for laptops etc tho.

 

I've mentioned or hinted to Link2ICT/BGfL about a transparent proxy numerous times... Maybe I need to shout louder lol

[Jon_boy1984]

There is a registry entry on Server 2008+ that blocks DNS querys for wpad. Look on your server for the follow:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

 

Remove wpad entry.

 

Not saying this will work, but it might help.

 

Jon

[CHR1S]

I've mentioned or hinted to Link2ICT/BGfL about a transparent proxy numerous times... Maybe I need to shout louder lol

 

Got a call open with them

 

 

There is a registry entry on Server 2008+ that blocks DNS querys for wpad. Look on your server for the follow:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

 

Remove wpad entry.

 

Already done mate, thanks tho

[limbo]

Hey Chr1s - we have got a transparent proxy setup here if you wanted to pop over and see it in the New Year.

 

One SID setup on our wireless specifically for BYOD which takes you to a separate DHCP server on an internal VLAN with a transparent proxy that then points to the BGfL proxy.

 

No need for BGfL to need to do anything and none of the devices can see anything of the rest of the network.

 

We have then setup a section of our VLE where students can register the MAC address of their device which gets entered into a radius server for authentication onto the SID. No need for intervention from us for them to gain connectivity, but secure.

 

We went down this route because it also works with older Android and Kindle devices that do not support proxies at all.

[CHR1S]

@limbo - Might have to do that, thanks!

 

What is the setup of the transparent proxy?

[limbo]

It is a squid box, relatively standard setup - the majority of the work is done by the wireless network, the DHCP server, the radius box and the switches to route everything in the right way.

[Duke5A]

It is a squid box, relatively standard setup - the majority of the work is done by the wireless network, the DHCP server, the radius box and the switches to route everything in the right way.

 

How did you overcome HTTPS issues with Squid running in transparent mode? For mine I setup a splash portal in Squid and forced people to click an acceptance button on the TOS page before it would pass HTTP requests. After clicking the acceptance button directions are listed for using the proxy.pac file. If users bother to read through it and set it up they'll get functional HTTPS, if not, they're stuck with HTTP.

[grant_girdwood]

Check your windows DNS server - as a security issue a WPAD entry in DNS was blocked by microsoft however there is a work around provided by MS