Our pfsense serves the internet via Squid proxy + AD authentication while filtering HTTP/HTTPS access using Squidguard with WPAD enabled. So that users do not need to enter proxy manually as the WPAD functionality serves the proxy details to the user's browser.

Further, I've added two rules to block defaul HTTP (80) / HTTPS (443) access to make sure users won't go to the internet without the automatic proxy detection.

Now the problem is that, when I do block HTTP (80) & HTTPS (443) default services; it also blocks all the traffics along with mobile internet users too. PC's have the capability to select auto detect proxy so that WPAD will serve while PC browser requests. Now, are there any solution which I can allow mobile users to access through proxy while the default blocking to http/https stays?

  • 1- What about if you isolate mobile clients physically or use vlans to segregate them? ; 2- Https is 443/tcp. ;) – user34720 Jun 25 '14 at 19:29
  • @nwildner been having issues with email and ports last few days. My bad that I was in the same mind and posted 143 instead 443 :) ... Well, I'm not sure isolating or using vlans will work as it may effect the infrastructure we have. If I could achieve this in the pfsense box, will be nicer. – AzkerM Jun 26 '14 at 5:40
  • Are you delivering wpad configuration to your clients through dhcp-server(option wpad code 252 = text; option wpad "http://webserver.ip.address/wpad.dat\n";) or using an internal dns resolving the wpad host? – user34720 Jun 26 '14 at 16:36
  • Through DHCP on AD environment. pfsense is the gateway so to speak. – AzkerM Jun 26 '14 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.