▶ BLOG

KB No. 2539: AUTOMATIC DEPLOYMENT OF PROXY CONFIGURATION (DHCP/DNS)

KB OLFEO On-Premise
June 5, 2023

How to deploy a proxy configuration across the IT infrastructure, on different browsers, via a DHCP or DNS server.

Objective

Deploy a proxy configuration across the IT infrastructure, on different browsers, via a DHCP or DNS server.

We will use an Apache or IIS web server to make the WPAD file available.

 

Steps

Prerequisites

Step 1: Store the wpad file on a web server

This involves making the wpad file containing the details of the proxy to be used available to client browsers.

  • Apache :

    On the Apache server, the only action required is to place the wpad.dat file in the root directory of the web server.

  • IIS :

    For the IIS part, the only difference compared to Apache is adding a new MIME type for .dat extensions. To do this, simply click on the "MIME type" icon in the IIS server configuration, then add the MIME type as follows:

Step 2: Configuring the client workstation

In order for the configuration to be retrieved by browsers, they must be configured to automatically detect proxy settings.

Deployment via DNS

For Windows Server 2003/2008

  1. Add an alias wpad.mydomain.lan which points to the web server delivering the wpad:

  2. You must now check that the wpad is not in the DNS block list, or even disable it. To do this, you need to access the registry editor (Start > Run > regedit).
  3. Once you have entered the registry editor, look for the following keys:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\EnableGlobalQueryBlockList

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

    EnableGlobalQueryBlockList should not be present (default behavior in 2003). If it is, then verify that a wpad entry is not present in the GlobalQueryBlockList key.

 

DHCP deployment

  • For Windows Server 2003/2008 :

    Following initial testing, it appears that the DHCP service on Windows 2003 and 2008 servers does not deliver option 252 to DHCP clients, meaning that this part is not functional.

  • For Debian server (udhcpd) :
    1. We start by installing the package udhcpd :

      apt-get install udhcpd

    2. Add the following to the file /etc/udhcpd.conf the following directive:

      opt wpad http://@web_server_IP/wpad.dat

Validation

  • When deploying via DNS, you must verify that WPAD resolution is working properly from a client workstation and that it correctly returns the name of a web server on the network.
  • You can also check that, in the advanced network settings, the DNS suffix matches the domain suffix.
  • Next, for both DNS and DHCP deployment, verify by capturing a frame with Wireshark on the client workstation that DHCP option 252 appears correctly:
  • ...and the request to the web server to retrieve the wpad.dat file, which we will see when we open the browser: