The Web Proxy Autodiscovery Protocol

WPAD certainly isn't new technology. In fact, it's been around for many years. However, it seems that many system administrators are unaware of its magic. Simply put, WPAD allows you to offer proxy information to users in your network without ever touching their computers. The feature is supported by most browsers, and in general, it "just works".

Although proxy information can be sent over DHCP, unfortunately, not all clients honor those settings. For maximum compatibility, it's best to have a local DNS record that points the domain "wpad" to a Web server. You put a configuration file named wpad.dat in the root level of that Web server, and clients get proxy information automatically, assuming they're configured to do so. (Most are by default; this is what your browser refers to as automatically detecting proxy settings.)

Here's a simple wpad.dat file:

function FindProxyForURL(url, host)
{
   if (isPlainHostName(host) ||
       dnsDomainIs(host, "my.local.network.domain.org") ||
       (host=="127.0.0.1") )
       return "DIRECT";
   else
       return "PROXY my.proxy.server.address:8080";
}

 

For more detailed information on how to configure your custom wpad.dat file, check out http://en.wikipedia.org/wiki/Proxy_auto-config.

And, for more information on the Web Proxy Autodiscovery Protocol itself, see http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol.

______________________

Shawn Powers is an Associate Editor for Linux Journal. You might find him chatting on the IRC channel, or Twitter

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

security risk

Jostein's picture

WPAD is a security risk!
On a windows (AD) network it is a risk not to implement it. Or not add a dns entry called wpad.

If ordinary users are allowed to add computers to AD, it is possible to add a computer with the name wpad. Then it would get a entry in dns pointing to that computer. If the user of that computer sets up a hack proxy, he can monitor all web access (even https), without users noticing anything... Man-in-the-middle-attack!

Windows also have (or had, don't know if it is fixed) the flaw that if it didn't find address wpad.companydomain.co.uk it would try wpad.co.uk...

security of wpad implementation really depends on the admin

Anonymous's picture

While that may be true, the question becomes this: why are ordinary users allowed to add computers to AD? If you have a compromised sys admin account, that's a totally different thing. Btw, the only reason why this (what you mentioned) would work is because the AD implementation is so open: not only are ordinary users able to add hosts, but the name resolution (dns/netbios) is also foobared. For example, dynamic DNS of whatever DNS service you run is enabled (it is enabled by default on Windows DNS). Any formidable admin can fix name resolution issues, as well as ordinary users being able to add to AD - though these issues are separate and you can fix them independently of each other (one should think that adding stuff to AD is related to name resolution, but not the same topic).

And, on those last few lines, I personally don't think that's a flaw: thats how you implement department/sub-domain proxies too.

If one allows name resolution incorrectly, then that stuff you mentioned can happen. Then again, it really depends how you designed your infra.

Advanced playground

speedj's picture

Only a few gotcha's:

For maximunm compatibility you should provide that the url
http://wpad.mydomain.com/wpad.dat
is active and has to be a "application/x-ns-proxy-autoconfig" mime-type.

You can achieve some redundancy using:
return "PROXY 10.0.10.10:8080; PROXY 10.0.10.20:8080; DIRECT;"
It means that if 10.0.10.10 does not respond (not squid itself, but it seams to be wether or not the proxy host responds to icmp pings - for most implementations), use it. If not use 10.0.10.20, else go directly to the destination.

beware of pitfalls with

Anonymous's picture

beware of pitfalls with regards to IPv6 implementations on different systems and browsers. ie: firefox might return the 128bit ip6-address from myIpAddress()

Personally agree with this.

Jay Yaneza's picture

Personally agree with this. WPAD method for proxy implementation is great. Ever tried to work with Linux GW implementation + SQUID + Windows Desktops? It's a headache when you need to tell the Windows Update clients to go through proxies if all other connections need to GW is blocked with exception of the proxy IP address. With WPAD, this is seamless ... and the updates are faster since they're cached by SQUID!

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState