The Web Proxy Autodiscovery Protocol

WPAD certainly isn't new technology. In fact, it's been around for many years. However, it seems that many system administrators are unaware of its magic. Simply put, WPAD allows you to offer proxy information to users in your network without ever touching their computers. The feature is supported by most browsers, and in general, it "just works".

Although proxy information can be sent over DHCP, unfortunately, not all clients honor those settings. For maximum compatibility, it's best to have a local DNS record that points the domain "wpad" to a Web server. You put a configuration file named wpad.dat in the root level of that Web server, and clients get proxy information automatically, assuming they're configured to do so. (Most are by default; this is what your browser refers to as automatically detecting proxy settings.)

Here's a simple wpad.dat file:

function FindProxyForURL(url, host)
{
   if (isPlainHostName(host) ||
       dnsDomainIs(host, "my.local.network.domain.org") ||
       (host=="127.0.0.1") )
       return "DIRECT";
   else
       return "PROXY my.proxy.server.address:8080";
}

 

For more detailed information on how to configure your custom wpad.dat file, check out http://en.wikipedia.org/wiki/Proxy_auto-config.

And, for more information on the Web Proxy Autodiscovery Protocol itself, see http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol.

______________________

Shawn Powers is an Associate Editor for Linux Journal. You might find him chatting on the IRC channel, or Twitter

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

security risk

Jostein's picture

WPAD is a security risk!
On a windows (AD) network it is a risk not to implement it. Or not add a dns entry called wpad.

If ordinary users are allowed to add computers to AD, it is possible to add a computer with the name wpad. Then it would get a entry in dns pointing to that computer. If the user of that computer sets up a hack proxy, he can monitor all web access (even https), without users noticing anything... Man-in-the-middle-attack!

Windows also have (or had, don't know if it is fixed) the flaw that if it didn't find address wpad.companydomain.co.uk it would try wpad.co.uk...

security of wpad implementation really depends on the admin

Anonymous's picture

While that may be true, the question becomes this: why are ordinary users allowed to add computers to AD? If you have a compromised sys admin account, that's a totally different thing. Btw, the only reason why this (what you mentioned) would work is because the AD implementation is so open: not only are ordinary users able to add hosts, but the name resolution (dns/netbios) is also foobared. For example, dynamic DNS of whatever DNS service you run is enabled (it is enabled by default on Windows DNS). Any formidable admin can fix name resolution issues, as well as ordinary users being able to add to AD - though these issues are separate and you can fix them independently of each other (one should think that adding stuff to AD is related to name resolution, but not the same topic).

And, on those last few lines, I personally don't think that's a flaw: thats how you implement department/sub-domain proxies too.

If one allows name resolution incorrectly, then that stuff you mentioned can happen. Then again, it really depends how you designed your infra.

Advanced playground

speedj's picture

Only a few gotcha's:

For maximunm compatibility you should provide that the url
http://wpad.mydomain.com/wpad.dat
is active and has to be a "application/x-ns-proxy-autoconfig" mime-type.

You can achieve some redundancy using:
return "PROXY 10.0.10.10:8080; PROXY 10.0.10.20:8080; DIRECT;"
It means that if 10.0.10.10 does not respond (not squid itself, but it seams to be wether or not the proxy host responds to icmp pings - for most implementations), use it. If not use 10.0.10.20, else go directly to the destination.

beware of pitfalls with

Anonymous's picture

beware of pitfalls with regards to IPv6 implementations on different systems and browsers. ie: firefox might return the 128bit ip6-address from myIpAddress()

Personally agree with this.

Jay Yaneza's picture

Personally agree with this. WPAD method for proxy implementation is great. Ever tried to work with Linux GW implementation + SQUID + Windows Desktops? It's a headache when you need to tell the Windows Update clients to go through proxies if all other connections need to GW is blocked with exception of the proxy IP address. With WPAD, this is seamless ... and the updates are faster since they're cached by SQUID!

Free Dummies Books
Continuous Engineering

Learn:

  • What continuous engineering is
  • How to continuously improve complex product designs
  • How to anticipate and respond to markets and clients
  • How to get the most out of your engineering resources

Get your free book now

Sponsored by IBM

Free Dummies Books
Service Virtualization

Learn to:

  • Define service virtualization
  • Select the most beneficial services to virtualize
  • Improve your traditional approach to testing
  • Deliver higher-quality software faster

Get your free book now

Sponsored by IBM