ProxyAutoConfig

= How it works =

Many web clients have the possibility to detect proxy settings for their current network automatically. This can be done via
 * DHCP
 * WPAD
 * manual URL configuration

Once the proxy autoconfiguration file is obtained, clients evaluate it to see how to connect to a proxy server.

The Proxy Auto Configuration (PAC) file
A PAC file is a simple javascript file clients can evaluate to get their configuration. For each request, the client executes the javascript, passing along the URL and host name it would like to make the request to. The script will return a proxy name to use for this server/URL, or DIRECT if there is no proxy for this host or protocol.

Getting the PAC file to the client
In order to get to the PAC file, a client can use several options.

The last two options are explained in this article, because once a client is set up it can work the same way regardless which network it is in.

Web Proxy Auto-Discovery (WPAD)
WPAD works like this:

A client tries to figure out is domain name by stripping its own host name from the FQDN it got from DHCP (or wherever). It will then try to contact a HTTP server by the name of wpad. . If it can't find one, and the domain name has one ore more subdomains, it will strip the first subdomain and try again to find a server named wpad. up until the top-level domain is reached.

From those HTTP servers it will request a file called /wpad.dat which should be a PAC file like the one created above.

For example:

= Creating the PAC file =

For details on which commands are supported in this file, see:
 * http://www.proxypacfiles.com/proxypac/
 * http://findproxyforurl.com/

A simple PAC file looks like this:

The pacparser tool can be used to test that the PAC file is functioning correctly. Example: /usr/bin/pactester -p proxy.pac -u http://www.gentoo.org -h gentoo.org PROXY proxy.example.org:8118; DIRECT

/usr/bin/pactester -p proxy.pac -u rsync://rsync.gentoo.org -h gentoo.org DIRECT If the return value of the script is DIRECT, the client won't use a proxy. The line "PROXY proxy.example.org:8080; DIRECT" will tell clients to first try to use the host proxy.example.org at port 8080 as a proxy, and if that fails, go direct. Multiple PROXY strings can be provided for redundancy or load balancing. (Note that clients will try to use the servers in order so for load balancing the javascript will have to shuffle the servers.)

= DHCP Server configuration =

Some Operating systems can use information provided via DHCP to obtain the proxy autoconfiguration file. Here is how to make the ISC dhcpd server serve this information:

In dhcpd.conf in the general section define a new option with code 252 and in the section for the network provide the value of the config server valid for that network.

= DNS Server configuration =

The responsible DNS Server must have records for the wpad. servers. How to set up an or configure a DNS server is out of scope here, but a simple modification to the records of ISC bind would look like this:

= Serving the WPAD file =

Now that there is a PAC file and DNS points to the correct server, all that is left is actually serving the file to clients.

Apache setup
To use ), configure a (virtual) host which will respond to the wpad server name, and serve out the PAC file.

Now all that is left is to copy our PAC file to /var/www/example.org/htdocs/. The Author likes to call the file 'proxy.pac' because that name is used in lots of documentation, and add a symlink called wpad.dat to satisfy the WPAD naming convention.

= Configuring clients =

= Next Steps =

Well you need a proxy if you don't already have one ;)

Some popular choices are, , ,