grant_girdwood

You'll need to allow the CIDR notations that they use. http://www.citrixonline.com/iprange

happy days!! have fun!

actually just spotted your issue.... i think You've set squid to be transparent for port 3128...you need to have your iptables lift port 80 traffic to port 3128 make sure squid is listening on port 3128 (netstat -lptn)

Not 100% sure on the rest of your iptables rules however the above should redirect to the proxy port 8080 for HTTP traffic. You're next step would be to run wiresharks on the client device and tracing what is going on when the unit is configured to be your client DGW

You'll need to ensure the Ubuntu box is configured to do IP Forwarding. echo 1 > /proc/sys/net/ipv4/ip_forward Add the line "net.ipv4.ip_forward = 1″ to /etc/sysctl.conf Can you paste the result of "iptables-save"?

Where does the appliance sit within your network - have you placed the linux box inline?

YouTube requires youtube.com and ytimg.com to be allowed in order to function as expected

1) Office for me. 2) I'm a fan of Parallels £77.34 is a bit steep however I got it alot cheaper than that - keep an eye out on their twitter feed. You'll find regular deals from them. 3) AV I use Sophos - never had an issue as of yet. Welcome!

Best bet would be to 1) upgrade to the latest version of Joomla (2.5.7) (2) ensure permissions are correct on directories and finally (3) ensure that all passwords for accessing are nice and strong.

Hi Jack, I'm off this week, one of the guys will be able to pick it up. If you have HTTPS decryption enabled you'll need to make sure the certificate is installed on the OS X machines. We have scripts that can automate it in to the keychain otherwise if you have an OS X server it will do the trick. Cheers!

have you ran a report on the Bloxx appliance to list URLs that are requested from the IP address of the Mac? The Bloxx sendLogon utility sends a message to the Bloxx server to tell it that $User has logged on from $IP - all requests are then filtered and logged against $User.

Blocking IP address based URLs will sort this for you.

Of course! I forgot about this option, however it wouldn't then be in transparent mode but would provide http/https filtering - for those who don't want to use pac files they would only have HTTP browsing ability.

Hi Gruff, If you want to transparently capture HTTPS traffic you will need to have a HTTPS decryption tool that can perform a "safe man in the middle attack" Your connections are currently breaking because the browsers on the wireless network are unaware that a proxy server exists, due to this when your proxy transparently attempts to filter HTTPS traffic your browsers detect that a man in the middle attack is happening and stops the connection (and rightly so!) Web filtering vendors out there provide the ability for full HTTPS decryption in transparent mode, I'm not aware of any free options out there. However, in order for HTTPS decryption to work clients need to trust a spoof certificate that is generated by the web filter....this is fine for domain machines, however for BYOD machines this could present an issue. If clients don't install the certificate they will receive errors on their browser when attempting to access HTTPS sites. Clients that trust the spoof will be able to browse as normal.... Good luck!

Hi dgsmith, My guess is that the upstream proxy requires authentication - can you confirm if this is the case? If it is then you will need to use the login=PASS parameter

If you are taking a whitelist approach to allowing HTTPS sites then you will need to allow all other domains that are used to build the content of the page, for example youtube.com is really just a placeholder, all media content is served from ytimg.com - using this example if you wanted to allow https://www.youtube.com then you would need to whitelist youtube.com and ytimg.com on your ISA server...this will get messy and there are easier approaches to take. The best approach would be to invest in a web filter that is capable of filtering HTTPS traffic - you can still use the ISA server as an upstream proxy if you were to invest in a web filter. If you opt to stick to the ISA server running whitelists then you can use browser developer tools to find out the domains that are being used on HTTPS sites (You can access developer tools in IE by pressing F12) Cheers, Grant

A useful website for reference is here - FindProxyForURL I would of thought you could use a rule which checks the browser header for iPad however to the best of my knowledge I don't believe WPAD/Pac files support this Example WPAD file for you //Pac File function FindProxyForURL(url, host) { //Setting the proxy variables var proxy_yes = "PROXY 10.1.1.254:8881"; var proxy_no = "DIRECT"; var resolved_ip = dnsResolve(host); var myip = myIpAddress(); //Debug Info //alert("My Addr: " + myIpAddress() + "\nURL: " + url + "\nHost: " + host); // All ftp requests go DIRECT - can be adapted for other protocols if (url.substring(0, 4) == "ftp:") { return proxy_no; } //Bypass for local domains if (shExpMatch( host, "127.*" ) || shExpMatch( host, "localhost" ) || shExpMatch( host, "*.domain.com" ) || shExpMatch( host, "*.domain.co.uk" ) || isPlainHostName( host ) || dnsDomainIs( host, ".domain.co.uk") || dnsDomainIs( host, ".domain.com)) { return proxy_no; } //If you are on the 10.111.x.x network use the proxy if (isInNet(myip, "10.111.0.0", "255.255.0.0")) { return proxy_yes; } //if not browse direct else { return proxy_no; } } You can test your PAC/WPAD files using pactester very useful for finding errors - http://code.google.com/p/pactester/ Cheers!

It is; 1) logon to the superhub 2) click advanced settings 3) port forwarding

We use a wildcard certificate to cover our OWA and other external services we provide.