The Web Proxy Autodiscovery Protocol

WPAD certainly isn't new technology. In fact, it's been around for many years. However, it seems that many system administrators are unaware of its magic. Simply put, WPAD allows you to offer proxy information to users in your network without ever touching their computers. The feature is supported by most browsers, and in general, it "just works".

Although proxy information can be sent over DHCP, unfortunately, not all clients honor those settings. For maximum compatibility, it's best to have a local DNS record that points the domain "wpad" to a Web server. You put a configuration file named wpad.dat in the root level of that Web server, and clients get proxy information automatically, assuming they're configured to do so. (Most are by default; this is what your browser refers to as automatically detecting proxy settings.)

Here's a simple wpad.dat file:

function FindProxyForURL(url, host)
{
   if (isPlainHostName(host) ||
       dnsDomainIs(host, "my.local.network.domain.org") ||
       (host=="127.0.0.1") )
       return "DIRECT";
   else
       return "PROXY my.proxy.server.address:8080";
}

 

For more detailed information on how to configure your custom wpad.dat file, check out http://en.wikipedia.org/wiki/Proxy_auto-config.

And, for more information on the Web Proxy Autodiscovery Protocol itself, see http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol.

______________________

Shawn Powers is an Associate Editor for Linux Journal. You might find him chatting on the IRC channel, or Twitter

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

security risk

Jostein's picture

WPAD is a security risk!
On a windows (AD) network it is a risk not to implement it. Or not add a dns entry called wpad.

If ordinary users are allowed to add computers to AD, it is possible to add a computer with the name wpad. Then it would get a entry in dns pointing to that computer. If the user of that computer sets up a hack proxy, he can monitor all web access (even https), without users noticing anything... Man-in-the-middle-attack!

Windows also have (or had, don't know if it is fixed) the flaw that if it didn't find address wpad.companydomain.co.uk it would try wpad.co.uk...

security of wpad implementation really depends on the admin

Anonymous's picture

While that may be true, the question becomes this: why are ordinary users allowed to add computers to AD? If you have a compromised sys admin account, that's a totally different thing. Btw, the only reason why this (what you mentioned) would work is because the AD implementation is so open: not only are ordinary users able to add hosts, but the name resolution (dns/netbios) is also foobared. For example, dynamic DNS of whatever DNS service you run is enabled (it is enabled by default on Windows DNS). Any formidable admin can fix name resolution issues, as well as ordinary users being able to add to AD - though these issues are separate and you can fix them independently of each other (one should think that adding stuff to AD is related to name resolution, but not the same topic).

And, on those last few lines, I personally don't think that's a flaw: thats how you implement department/sub-domain proxies too.

If one allows name resolution incorrectly, then that stuff you mentioned can happen. Then again, it really depends how you designed your infra.

Advanced playground

speedj's picture

Only a few gotcha's:

For maximunm compatibility you should provide that the url
http://wpad.mydomain.com/wpad.dat
is active and has to be a "application/x-ns-proxy-autoconfig" mime-type.

You can achieve some redundancy using:
return "PROXY 10.0.10.10:8080; PROXY 10.0.10.20:8080; DIRECT;"
It means that if 10.0.10.10 does not respond (not squid itself, but it seams to be wether or not the proxy host responds to icmp pings - for most implementations), use it. If not use 10.0.10.20, else go directly to the destination.

beware of pitfalls with

Anonymous's picture

beware of pitfalls with regards to IPv6 implementations on different systems and browsers. ie: firefox might return the 128bit ip6-address from myIpAddress()

Personally agree with this.

Jay Yaneza's picture

Personally agree with this. WPAD method for proxy implementation is great. Ever tried to work with Linux GW implementation + SQUID + Windows Desktops? It's a headache when you need to tell the Windows Update clients to go through proxies if all other connections need to GW is blocked with exception of the proxy IP address. With WPAD, this is seamless ... and the updates are faster since they're cached by SQUID!

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix