How it works
Many web clients have the possibility to detect proxy settings for their current network automatically. This can be done via
- manual URL configuration
Once the proxy autoconfiguration file is obtained, clients evaluate it to see how to connect to a proxy server.
The Proxy Auto Configuration (PAC) file
Getting the PAC file to the client
In order to get to the PAC file, a client can use several options.
|local file:||The pac file can be stored locally and applications can be pointed to that file|
|remote file:||Applications can be pointed to an URL which serves out the pac file.|
|DHCP:||DHCP servers can provide information where a pac file is available|
|WPAD:||following a set of conventions, clients can automagically obtain the correct pac file for the network they're currently in|
The last two options are explained in this article, because once a client is set up it can work the same way regardless which network it is in.
Web Proxy Auto-Discovery (WPAD)
WPAD works like this:
A client tries to figure out is domain name by stripping its own host name from the FQDN it got from DHCP (or wherever). It will then try to contact a HTTP server by the name of wpad.<domain>. If it can't find one, and the domain name has one ore more subdomains, it will strip the first subdomain and try again to find a server named wpad.<domain> up until the top-level domain is reached.
From those HTTP servers it will request a file called /wpad.dat which should be a PAC file like the one created above.
|First Server tried:||http://wpad.office.corporate.example.org/wpad.dat|
|Second Server tried:||http://wpad.corporate.example.org/wpad.dat|
|Last Server tried||http://wpad.example.org/wpad.dat|
Creating the PAC file
For details on which commands are supported in this file, see:
A simple PAC file looks like this:
The pacparser tool can be used to test that the PAC file is functioning correctly.
/usr/bin/pactester -p proxy.pac -u http://www.gentoo.org -h gentoo.org PROXY proxy.example.org:8118; DIRECT /usr/bin/pactester -p proxy.pac -u rsync://rsync.gentoo.org -h gentoo.org DIRECT
If the return value of the script is DIRECT, the client won't use a proxy. The line "PROXY proxy.example.org:8080; DIRECT" will tell clients to first try to use the host proxy.example.org at port 8080 as a proxy, and if that fails, go direct. Multiple PROXY strings can be provided for redundancy or load balancing.
DHCP Server configuration
Some operating systems can use information provided via DHCP to obtain the proxy autoconfiguration file. Here is how to make the ISC dhcpd server (net-misc/dhcp) serve this information:
In dhcpd.conf in the general section define a new option with code 252 and in the section for the network provide the value of the config server valid for that network.
DNS Server configuration
The responsible DNS Server must have records for the wpad.<domain> servers. How to set up an or configure a DNS server is out of scope here, but a simple modification to the records of ISC bind would look like this:
Serving the WPAD file
Now that there is a PAC file and DNS points to the correct server, all that is left is actually serving the file to clients.
To use www-servers/apache, configure a (virtual) host which will respond to the wpad server name, and serve out the PAC file.
Now all that is left is to copy our PAC file to /var/www/example.org/htdocs/. The author likes to call the file 'proxy.pac' because that name is used in lots of documentation. Add a symbolic link called wpad.dat to satisfy the WPAD naming convention.
|Firefox||In the Preferences Window, chose Advanced, go to the Network Tab, click the Settings... button.||Firefox Documentation|
|Opera||Press Alt+P to bring up the Preferences, go to the Advanced Tab, chose Networking and click the Proxy Servers... button.||Opera Documentation|
|KDE||In System Settings, search for proxy, the first section is the proxy settings.||KDE Documentation|
|GNOME||see link||-- no pic --||GNOME Documentation|
|Windows/Internet Explorer||If you use the DHCP method Windows probably does the right thing automatically. Otherwise follow the link on the right||too much of a clickfest to provide a single screenshot.||Microsoft Documentation|
To finish the setup a proxy server would be needed. Some popular proxy servers are: