This is based on this question: https://askubuntu.com/questions/447877/how-to-resolve-the-dns-locally-when-there-is-a-proxy-configured

All I want to know is if there is an existing way to achieve this: adding IP ranges in the proxy exception list and have the clients (web browsers, IM clients, email client, etc.) resolve name locally only forwarding requests for non matching IP addresses.

PS: I'm well aware of how http proxies are working, but nothing prevents the client from asking the dns cache/files/server (if any) first. That won't help with the proxy itself but that could help in determining what to send to the proxy.

PPS: yes this could be less efficient than the default behavior, but I'm neither asking anyone to implement it nor making it the default. I'm asking if it exists in some form because at least Google does not know about it (plus with stuff like dnsmasq, doing the job twice is not that important).


The only way i can think of to do this is to install something like tinyproxy and configure it to, based on the domain name in the URL, fetch some requests directly and forward the rest to the main squid or whatever proxy.

According to man 5 tinyproxy, this is done with the upstream config option:

* 'upstream host:port "site_spec"' turns on the upstream proxy for the sites matching `site_spec`.

I run squid on my local network, so i have no idea how well tinyproxy works.


Local DNS lookups are required for, e.g. proxy.pac files when they use the dnsDomainIs() function in the main FindProxyForURL() function. e.g.

function FindProxyForURL(url, host) {
        if (dnsDomainIs(host, ".local.example.net"))
       { return "DIRECT" };

        if (dnsDomainIs(host, "work.example.net")
           || dnsDomainIs(host, "intranet.example.net)
       { return "PROXY work.proxy.example.net:3128" };

    return "PROXY proxy.local.example.net:3128; DIRECT";

That tells the browser to go direct for local URLs, to the proxy server at work for work-specific urls (which probably requires some form of authentication), and to the local proxy server on the local network for everything else (or direct if that is unreachable).

  • Yes, I understand that. Actually, this is what I'm currently using. The only problem is that the PAC file is read only once (at the begining of the session in the case of Gnome). – JohnW Oct 30 '15 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.