Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [WPAD] Need some help

    Scheduled Pinned Locked Moved Cache/Proxy
    17 Posts 8 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM
      last edited by

      Another point: to me, you test aiming at testing http://pfsense.localdomain/wpad.dat is irrelevant (unless I'm wrong, of course  ;D)

      No, it's not irrelevant.  One of the steps to validating a WPAD config is making sure you can fetch the wpad.dat file via http://autodiscover.yourdomain.ext/wpad.dat.  If you can't get the javascript file then nothing will work.

      1 Reply Last reply Reply Quote 0
      • C
        chris4916
        last edited by

        @KOM:

        Another point: to me, you test aiming at testing http://pfsense.localdomain/wpad.dat is irrelevant (unless I'm wrong, of course  ;D)

        No, it's not irrelevant.  One of the steps to validating a WPAD config is making sure you can fetch the wpad.dat file via http://autodiscover.yourdomain.ext/wpad.dat.  If you can't get the javascript file then nothing will work.

        what I wanted to highlight with my comment, but apparently I failed  :-[, is that autodiscovery will [b]not (once again unless I'm wrong, feel free to correct me) search for http://pfsense.yourdomain.ext/wpad.dat

        of course it may help to check that accessing wpad.dat file works  ;D  what I suggest is to search with the right server name: wpad  ;)
        other either A records or CNAME will not be used by WPAD process.

        Am I correct ?

        Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

        1 Reply Last reply Reply Quote 0
        • KOMK
          KOM
          last edited by

          Am I correct ?

          Yes, and I'm the dummy.  I was thinking about autodisovery of Exchange and my eye skipped over that, but I suspect it was a typo on his part anyway since he followed ever other part of the guide exactly.

          1 Reply Last reply Reply Quote 0
          • D
            dnikky
            last edited by

            6. Configure DHCP :
            enable DHCP
            Add BOOTP/DHCP option
            Code: [Select]
            number: 252 type: string value: "http://192.168.1.1/wpad.dat"
            number: 252 type: string value: "http://192.168.1.1/wpad.da"
            number: 252 type: string value: "http://192.168.1.1/proxy.pac"

            I do not understand this step. I use the dhcp relay. How can choose the "Add BOOTP / DHCP"

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by

              @dnikky:

              I do not understand this step. I use the dhcp relay. How can choose the "Add BOOTP / DHCP"

              Set up the options on the DHCP server you relay to instead. (And no, I don't think you should have 3 of them… one for wpad.dat or proxy.pac is just enough. If it ain't honored, then none of the other filenames will be honored either.)

              1 Reply Last reply Reply Quote 0
              • C
                chris4916
                last edited by

                @KOM:

                but I suspect it was a typo on his part anyway since he followed ever other part of the guide exactly.

                I think so  ;)

                Still there is room for further improvement in what he achieved, IMHO.

                • e.g. there is no need for multiple wpad.dat files in /usr/local/www/
                  One single file with logical links will ease maintenance.

                • As highlighted by doktormotor, pushing one single DHCP option 252 is enough and here I would use fqdn instead of IP address (personal choice).

                • Some client side implementation may rely on DNS service. If goal is to ensure best WPAD coverage,  DNS should look like something like this:

                wpad            IN      A      192.168.1.1  (your wpad address here… if CNAME is not used)
                                  IN      TXT    "service: wpad:http://wpad.yourdomain/proxy.pac"
                _wpad._tcp    IN      SRV    0 0 80 wpad.yourdomain.

                Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  @chris4916:

                  • Some client side implementation may rely on DNS service. If goal is to ensure best WPAD coverage,  DNS should look like something like this:

                  wpad            IN      A      192.168.1.1  (your wpad address here… if CNAME is not used)
                                    IN      TXT    "service: wpad:http://wpad.yourdomain/proxy.pac"
                  _wpad._tcp    IN      SRV    0 0 80 wpad.yourdomain.

                  Also - if using Windows DNS servers - it won't answer the wpad zone queries by default at all: Removing WPAD from DNS block list

                  1 Reply Last reply Reply Quote 0
                  • KOMK
                    KOM
                    last edited by

                    • e.g. there is no need for multiple wpad.dat files in /usr/local/www/
                      One single file with logical links will ease maintenance.

                    My understanding was that different systems/apps rely on different standards, eg. WPAD vs Proxy AutoConfig, and that's why you need wpad.dat and proxy.pac at least.  This is for situations where you don't know the clients.  In a corp network where you do know the clients, you can select which method to support.  I've also seen references to wpad.da for IE6 browsers, and wspad.dat.

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      @KOM:

                      • e.g. there is no need for multiple wpad.dat files in /usr/local/www/
                        One single file with logical links will ease maintenance.

                      My understanding was that different systems/apps rely on different standards, eg. WPAD vs Proxy AutoConfig, and that's why you need wpad.dat and proxy.pac at least.

                      I guess he's referring to symlinking instead of multiple copies of the file…

                      1 Reply Last reply Reply Quote 0
                      • KOMK
                        KOM
                        last edited by

                        I missed the 'logical links'.  I think I need to renew my Adderal prescription.  I'm missing too many small clues lately.

                        1 Reply Last reply Reply Quote 0
                        • C
                          chris4916
                          last edited by

                          @KOM:

                          I missed the 'logical links'.  I think I need to renew my Adderal prescription.  I'm missing too many small clues lately.

                          8)  don't worry, I'm getting old too  :P

                          Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                          1 Reply Last reply Reply Quote 0
                          • S
                            srk3461
                            last edited by

                            Add this rule at the top of our lan network. Please refer the screenshot.

                            The ports Aliases is nothing but to disable the direct access on port 80 and 443.

                            Capture.JPG
                            Capture.JPG_thumb

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.