How-to: Proxy Autoconfiguration
7/14/2010 - I've been testing our proxy auto-config setup on my laptop for the last 5 days and it's working flawlessly. It did take some trial and error to figure out that my Mac cached the proxy auto-config file until I rebooted, but I eventually wrote a short auto-config file that works for 10.10.140.x, *.bolinas-stinson.org and simple hostnames (e.g. do not use proxy when navigating to, e.g. 10.10.140.5, techlab.bolinas-stinson.org or techlab).
It's nice because client configuration only requires checking a box or two, and it automatically provides direct access when not on an MCOE-connected subnet, or when navigating to a local host on the school campus. With automatic proxy configuration there's no need for a client to change network settings/locations when moving their laptop on and off campus, or to manually configure proxy settings.
In Windows (IE 4+), just check Automatically detect settings under Internet Properties > Connections tab > LAN settings button:
![]()
In Mac OS X 10.6.x, just check Auto Proxy Discovery under each interface (AirPort, Ethernet > Advanced > Proxies):
![]()
On all other operating systems and devices (e.g. 10.3.2–10.5.x, smartphones), just set the automatic proxy configuration script URL or PAC file URL to http://wpad.domainname/wpad.dat, substituting domainname with the domain-name setting assigned by the site's router/DHCP server (e.g. http://wpad.bolinas-stinson.org/wpad.dat in our case, or http://wpad.marin.k12.ca.us/wpad.dat in most other cases).
So that's the client side of things. On the server end, you just need three things:
- A world-resolvable subdomain at wpad.domainname (e.g. I went to the DNS registrar and added the subdomain wpad.bolinas-stinson.org as an alias/CNAME to bolinas-stinson.org).
- A config file named wpad.dat with Western (Windows Latin 1) encoding (e.g. Windows text file with .dat extension) saved to the root directory of the server located at http://wpad.domainname. You can view/download our proxy auto-config file at http://wpad.bolinas-stinson.org/wpad.dat.
- Set the MIME Types on the web server for dat and pac to application/x-ns-proxy-autoconfig (procedure varies for different servers).
This is very well-documented. The first site to look at is at wikipedia:
http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol
http://en.wikipedia.org/wiki/Proxy_auto-config
| function FindProxyForURL(url, host) { // If not on a BSUSD LAN IP address, send traffic direct. if (!isInNet(myIpAddress(), "10.10.140.0", "255.255.255.0")) return "DIRECT"; // If URL has no dots in host name, send traffic direct. if (isPlainHostName(host)) return "DIRECT"; // If URL matches the following, send traffic direct. if (shExpMatch(url,"*bolinas-stinson.org*")) return "DIRECT"; // If IP address is internal or hostname resolves to internal IP, send direct. var resolved_ip = dnsResolve(host); if (isInNet(resolved_ip, "10.0.0.0", "255.0.0.0") || isInNet(resolved_ip, "172.16.0.0", "255.240.0.0") || isInNet(resolved_ip, "192.168.0.0", "255.255.0.0") || isInNet(resolved_ip, "169.254.0.0", "255.255.0.0") || isInNet(resolved_ip, "127.0.0.0", "255.255.255.0")) return "DIRECT"; // All other http traffic uses proxy.marin.k12.ca.us:80, in fail-over order. if (url.substring(0, 5) == "http:") return "PROXY 137.164.143.116:80; PROXY 137.164.143.114:80; DIRECT"; } |
|---|
- BSUSD uses the 10.10.140.x subnet. Modify the text if (!isInNet(myIpAddress(), "10.10.140.0", "255.255.255.0")) to match the subnet used by your site.
- The router/DHCP server at BSUSD assigns the domain-name bolinas-stinson.org. Modify this to match the domain name assigned at your site (e.g. marin.k12.ca.us).
- Querying nslookup resolves proxy.marin.k12.ca.us to the IP addresses 137.164.143.116 and 137.164.143.114.



