3

I run Linux on a laptop that is sometimes on a corporate network which uses an NTLM proxy server, and thus I have cntlmd running on the laptop as a child proxy to connect to the parent (corporate) proxy server. Everything running on the laptop is configured to use localhost:3128 (the CNTLM proxy address) and then cntlmd handles the non-standard authentication with the NTLM proxy server.

When I take the laptop off the corporate network, there are maybe a dozen different places things are configured to use localhost:3128, and it is a pain to disable and then later re-enable them.

It is apparently not possible to configure cntlmd to not use a proxy when the one it is configured to use is unavailable.

One option is to write a script that will automate all these changes for me, but it seems that it might be simpler to have a second child proxy that I can (automatically) start up when cntlm startup fails (it fails if it can't find the parent proxy). The second child proxy would just connect directly to the network, and so if it also listened on 3128 everything configured to hit 3128 could keep its configuration the same.

What I can use to do this with? (Or is there a better way?)

  • I use ProxyManager for Exactly This Purpose. It is a script that will enable/disable proxy settings in a wide variety of applications. github.com/Tahaan/proxymanager - works well enough on Ubuntu-like distros, including Kubuntu. May need some tweaking on other distros though. – Johan Apr 8 '14 at 7:52
  • Have you considered running a different proxy server on port 3128 whenever the non-standard thing is not needed? One that doesn't use any upstream proxy server? – Celada Feb 17 '15 at 7:08
  • @Celada: that's an interesting idea, but wouldn't I still need some script to switch between proxy A and proxy B? And if I have a script that somehow detects the availability of the parent proxy and changes child proxies accordingly, is this any easier? – iconoclast Feb 17 '15 at 18:35
  • Sure, you still need a way to switch between the two scenarios, but instead of having to go around changing proxy settings in every single application (tough to automate them all!) you only have to do one thing: stop one proxy server and start another in its place. – Celada Feb 18 '15 at 2:35
  • It was a long time ago that I wrote this question, but isn't your suggestion pretty similar to the 2nd-to-last paragraph of my question? – iconoclast Feb 18 '15 at 16:24
0

What about proxy.pac

it's just an JavaScript, you can host this file on local machine or any web server in your intranet and set in client side file:///opt/proxy.pac using this script you can do load-balancing with your proxy. also you can divide traffic using ip ranges in this java script, there are multiple feature like bypass proxy for particular web site.

It will do :

  • if Proxy unavailable it will then instruct the browser to go direct.
  • bypass proxy for some sites (basically some site not working through proxy)
  • bypass proxy for local, intranet servers
  • so forth.

Example of PAC file

function FindProxyForURL(url, host) {
    // our local URLs from the domains below example.com don't need a proxy:
    if (shExpMatch(host, "*.example.com"))
    {
            return "DIRECT";
    }

  // If on a internal/LAN IP address, send traffic direct.
  if (isInNet(myIpAddress(), "10.10.1.0", "255.255.255.0"))
  {        
    return "PROXY 10.0.0.100:8080; PROXY 10.0.0.101:8080; DIRECT";
  }
  else
  {
    return "DIRECT";
  }
}
  • Won't this only work for browsers? I need something that works for yum, curl, git, wget, etc., etc. – iconoclast Aug 16 '13 at 19:05
  • export http_proxy="http://DOMAIN\User:password@myproxy.domain.com:8080/proxy.pac" – Rahul Patil Aug 16 '13 at 19:37
  • refer this link unix.stackexchange.com/questions/84061/… – Rahul Patil Aug 16 '13 at 19:37
  • The solution to that problem is to use CNTLM, which I'm already using. It does mention using a PAC, but doesn't explicitly answer the question whether a PAC file will work globally. Can you answer that? – iconoclast Aug 16 '13 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.