WPAD Setup help [Solved]

aGeekhere · Sep 17, 2015, 3:20 AM

Hi enrique.perezrul

Hmm some hard questions there, will do my best, lets start with reading from the wiki

https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

WPAD will take the domain name given to the machine, likely assigned by DHCP, and prepend wpad.. If the domain is example.com, it will look for wpad.example.com. This task may be accomplished with the DNS Forwarder/DNS Resolver in pfSense or with another internal DNS server used by client PCs.

why do you need to enable DNS forwarder

Because you need to create a Host Override for the wpad.

…set listening port to 3128

Because I wanted to use port 53 for the DNS Resolver (Will need to look more into why I used port 3128)

Also why do you need the host override if dhcp is configured with the ip address and not a domain name

Some web browsers use DNS to configure them others use dhcp so both are needed.

maverik1 · Sep 17, 2015, 7:32 PM

Looking for a well documented guide or video to help configure wpad. Do any exist?

chavarriaa · Sep 17, 2015, 7:43 PM

@maverik1:

Looking for a well documented guide or video to help configure wpad. Do any exist?

With this Post i configurate WPAD, but if you have problems, create your own post. Problems never are the same.

KOM · Sep 17, 2015, 7:45 PM

Looking for a well documented guide or video to help configure wpad. Do any exist?

Look at the post above yours, specifically the link to WPAD Autoconfigure for Squid.

maverik1 · Sep 18, 2015, 12:00 AM

I've checked that out but it's quite vague. For example, I run vlans on pfsense. My guest network is 10.0.0.0/24 and my home lan is 192.168.2.0/24.

In the wpad file what do I need to specify as the proxy address? I have configured pfsense such that guest vlan cannot access home vlan and vice versa. As I do not have a separate box I will have to host the wpad on the pfsense box.

function FindProxyForURL(url,host)
{

return "PROXY 192.168.2.1:3128"; What does this need to be to support both vlans?
}

aGeekhere · Sep 18, 2015, 1:06 AM

try this

function FindProxyForURL(url, host) 
{ 
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.local") ||
        isInNet(dnsResolve(host), "192.168.1.0",  "255.255.255.0"))
        return "DIRECT";

    return "PROXY 192.168.1.1:3128";
}

KOM · Sep 18, 2015, 1:44 PM

In the wpad file what do I need to specify as the proxy address?

Whatever the IP address is of the interface that Squid is listening on. Usually your LAN NIC.

I have configured pfsense such that guest vlan cannot access home vlan and vice versa.

Add a firewall rule above your vlan blocks that allows the guest vlan to talk to squid.

As I do not have a separate box I will have to host the wpad on the pfsense box.

So do that then. I host wpad.dat and proxy.pac on my pfSense box. Note that it won't work if you have WebGUI running in HTTPS mode.

maverik1 · Sep 18, 2015, 4:24 PM

Is there a command or configuration page to see what interface squid is listening on? As mentioned previously I have vlans running. The default LAN is disabled.

Vlan10 is admin
Vlan20 is guest
Vlan30 is home

I configured squid to bind to vlan20 and vlan30.

You mention that if WebGUI is running over https I cannot host the proxy.pac. Can this be overcome by changing the port from 443 to 444?

KOM · Sep 18, 2015, 4:38 PM

Is there a command or configuration page to see what interface squid is listening on?

Services - Proxy server - General. What's the very first thing you see, starting at the top?

Can this be overcome by changing the port from 443 to 444?

I don't think so. It's not the port that's the problem, it's the protocol.

chavarriaa · Sep 18, 2015, 4:48 PM

@maverik1:

Is there a command or configuration page to see what interface squid is listening on? As mentioned previously I have vlans running. The default LAN is disabled.
…

http://findproxyforurl.com/pac-functions/ <- shows some Function to that.

Try this. Where 192.168.0.0 is your network that you want to have direct access.

function FindProxyForURL(url,host){
if (isInNet(myIpAddress(), "192.168.0.1", "255.255.255.0"))
    return DIRECT;

return "PROXY 192.168.10.10:3128";
}

Or Services >> Proxy Server >> General >> Proxy interface(s) and choose your Networks

maverik1 · Sep 18, 2015, 10:56 PM

@KOM:

Is there a command or configuration page to see what interface squid is listening on?

Services - Proxy server - General. What's the very first thing you see, starting at the top?

Proxy interfaces shows:
Home -> "for reference only" (192.168.2.0/24)
Guest -> "for reference only" (10.0.0.0/24)

So back to my original question regarding the wpad file. Does the "return PROXY" statement need to point to the Home, Guest or both interfaces? I want both subnets going through the proxy.

maverik1 · Sep 20, 2015, 12:00 AM

I am trying to configure wpad and am testing it out but haven't got it working.

I have configured the following discovery file:

[2.2.4-RELEASE][root@pfSense.localdomain]/root: cat /usr/local/www/wpad/proxy.pac
FindProxyForURL(url,host)
{
  if(isPlainHostName(host))
  {
    return "DIRECT";
  }

  if(isInNet(host,"127.0.0.1","255.255.255.0"))
  {
    return "DIRECT";
  }

  return "PROXY 10.0.3.1:3128";        

}

ls -la
-rw-r–r-- 1 root wheel 200 Sep 19 17:01 proxy.pac
lrwxr-xr-x 1 root wheel 9 Sep 19 15:06 wpad.da -> proxy.pac
lrwxr-xr-x 1 root wheel 9 Sep 19 15:05 wpad.dat -> proxy.pac

I copied and made some changed to lighttpd configuration file and put it in /usr/local/www/wpad. The changes I made were:

server.document-root = "/usr/local/www/wpad/"
server.errorlog = "/var/log/lighty-proxy-wpad.log"

Added file types:
".dat" => "application/x-ns-proxy-autoconfig",
".da" => "application/x-ns-proxy-autoconfig",
".pac" => "application/x-ns-proxy-autoconfig",

server.bind = "10.0.3.1"
server.port = 80

Verified it worked by starting second lighttpd instance:
[2.2.4-RELEASE][root@pfSense.localdomain]/usr/local/www/wpad: ps aux | grep -i "lighttpd"
root 26067 0.0 0.2 13152 6012 - S 4:08PM 0:00.86 /usr/local/sbin/lighttpd -f /var/etc/lighty-webConfigurator.conf
root 45296 0.0 0.2 13152 4968 - S 5:32PM 0:00.02 /usr/local/sbin/lighttpd -f /usr/local/www/wpad/lighty-proxy-wpad.conf

I created a hosts override option in DNS Fowarder, configured necessary settings in dhcp "bootp/dhcp" section.

I am able to browse in firefox to 10.0.3.1/wpad and wpad.localdomain/wpad.dat. However, nslookup on wpad.localdomain doesnt work. Not sure if it needs to. I can ping it though.

I have squid3 installed. Its bound to Guest Interface (10.0.3.0/24) on port 3128. Allow users on this interface enabled. Transparent HTTP Proxy is Disabled and so is SSL MiTM. In ACLs tab I entered: 10.0.3.0/24

For testing purposes, I have crated a fw rule that allows anything from this network to pass so I can get internet. When I put in the proxy auto configure url in firefox the internet no longer works.

Any suggestions? This process is very frustrating

chris4916 · Sep 20, 2015, 4:18 AM

@maverik1:

I am able to browse in firefox to 10.0.3.1/wpad and wpad.localdomain/wpad.dat. However, nslookup on wpad.localdomain doesnt work. Not sure if it needs to. I can ping it though.

I'm not sure your browser will try to load any wpad.* file but rather proxy.* file

WPAD acronym covers the auto discovery stuff while proy.pac (or .dat) describes browser behaviour: what is accessed directly (i.e. local files) vs. what must be accessed through proxy.

If you can resolve this name, I wonder how you can browse it ???

In order not to face all potential problems together, I would suggest, once your proxy.pac file is ready, to test it by manually configuring your browser to load this page. This bypasses the discovery step en ensures, if it works ;), that proxy.pac behaves as expected.

maverik1 · Sep 20, 2015, 6:59 AM

I understand how wpad works. I was making sure I had access to it. In FF I have specified http://wpad.syndicate.com/wpad.dat in the Automatic Proxy Configuration URL. It's not working as I am not getting any once doing so. I look at the squid logs and do not see anything from that network. So apparently it's not going through. I don't know where to start troubleshooting from.

I've simplified the proxy.pac to:

FindProxyForURL(url,host)
{

  return "PROXY 10.0.3.1:3128";        

}

Don't believe it should be this complicated

chris4916 · Sep 20, 2015, 7:12 AM

@maverik1:

I look at the squid logs and do not see anything from that network.

Before looking at Squid log, you should start with web server side.
If you don't see any access to thsi web server (for this page), no surprise if it doesn't work.
Of course, this means that, from your browser, you can resolve this URL ;)

aGeekhere · Sep 20, 2015, 8:38 AM

try

http://pfsense.syndicate.com/wpad.dat

Go through post 1 again, let me know how it went.

maverik1 · Sep 20, 2015, 8:24 PM

@aGeekHere:

try
http://pfsense.syndicate.com/wpad.dat
Go through post 1 again, let me know how it went.

I've gone through this several times. My setup is a bit different. I have implemented vlans and there is not one main LAN that all the traffic is passing through. The following are my networks which must be passed through proxy.

10.0.0.0/24 Administrative VLAN
10.0.2.0/24 Local User VLAN
10.0.3.0/24 Guest VLAN

Because I basically have three separate LANs, I am not sure what the proxy address needs to be. Do I need three? Do I also need three DNS Host Overrides?

http://pfsense.syndicate.com/wpad.dat

This doesn't resolve anything in browser, However, the following three are resolved and I am prompted to download the file.


http://wpad.syndicate.com/wpad.dat
http://wpad.syndicate.com/wpad.da
http://wpad.syndicate.com/proxy.pac

chris4916 · Sep 20, 2015, 6:16 PM

@maverik1:

Because I basically have three separate LANs, I am not sure what the proxy address needs to be. Do I need three? Do I also need three DNS Host Overrides?

You need one you can resolve and reach ;)
If your VLAN are isolated, then you need 3 accesses 8)

maverik1 · Sep 20, 2015, 8:28 PM

If your VLAN are isolated, then you need 3 accesses 8)

The problem is I don't if it's possible to have three separate proxy.pac files. I'm hosting thus file on the same server as pfsense with lighttpd.

aGeekhere · Sep 20, 2015, 11:35 PM

try something like this

function FindProxyForURL(url, host) 
{ 
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.local") ||
        isInNet(dnsResolve(host), "10.0.0.0",  "255.0.0.0") ||
        isInNet(dnsResolve(host), "10.0.2.0",  "255.0.0.0") ||
        isInNet(dnsResolve(host), "10.0.3.0",  "255.0.0.0")) ||

    return "PROXY 10.0.0.0:3128";
}

Not sure with vlans.