mirror of
https://github.com/opnsense/docs
synced 2024-11-05 06:00:36 +00:00
270 lines
7.5 KiB
ReStructuredText
270 lines
7.5 KiB
ReStructuredText
================
|
|
Setup WPAD / PAC
|
|
================
|
|
|
|
---
|
|
PAC
|
|
---
|
|
|
|
Introduction
|
|
============
|
|
|
|
OPNsense supports generating PAC files to provide automatic proxy configuration
|
|
files to clients. For example if your web GUI is running at http://192.168.0.1/,
|
|
your PAC URL will be http://192.168.0.1/wpad.dat.
|
|
|
|
In Firefox you can configure your proxy using PAC by the following steps
|
|
manually:
|
|
|
|
* Click the menu Icon and open "Settings"
|
|
* Scroll down to "Network Proxy" and click "Settings"
|
|
* Check "Automatic Proxy Configuration Address"
|
|
* Enter the URL of the PAC file like mentioned in the paragraph above into
|
|
the text field and click "OK"
|
|
|
|
.. Warning::
|
|
Your browser may be unable to connect to the internet if the PAC file is
|
|
not available. This type of configuration is not recommended on mobile
|
|
devices like laptops if employees can use the devices for home office.
|
|
For such devices WPAD should be used.
|
|
|
|
|
|
Configuring PAC
|
|
===============
|
|
|
|
First Step: Creating Matches
|
|
----------------------------
|
|
|
|
Go to :menuselection:`Services --> Proxy --> Configuration` and open Match
|
|
|
|
.. image:: images/pac_menu_match.png
|
|
|
|
Enter a name for the match and an optional description.
|
|
Then choose what to match on. In our example we want to achieve
|
|
that hostnames without a FQDN (like server01) and also our
|
|
internal domain (example.com) will be excluded from the proxy.
|
|
|
|
=========== ==================================================
|
|
Name A unique name for the match to call it from rules.
|
|
Description A short description for your own reference.
|
|
Negate Inverts the match (any that does not match)
|
|
Match Type Choose what you want to match on
|
|
=========== ==================================================
|
|
|
|
The rest of the fields depend on the used `Match Type`.
|
|
For example if we match on "Plain Hostname", we do not need any
|
|
additional parameters.
|
|
|
|
The match "Plain Hostname means no dots inside the domain so if we
|
|
want to create a fqdn match, we can simply invert this:
|
|
|
|
.. image:: images/pac_match_fqdn.png
|
|
|
|
|
|
=========== ==============
|
|
Name is_fqdn
|
|
Description can stay empty
|
|
Negate checked
|
|
Match Type Plain Hostname
|
|
=========== ==============
|
|
|
|
.. image:: images/pac_internal_domain.png
|
|
|
|
============ =================================
|
|
Name not_internal
|
|
Description can stay empty
|
|
Negate checked
|
|
Match Type Hostname matches
|
|
Host Pattern Wildcard for your internal domain
|
|
============ =================================
|
|
|
|
Second Step: Create Proxy Servers
|
|
---------------------------------
|
|
|
|
Now switch to :menuselection:`PAC --> Proxies` and add new proxy servers.
|
|
|
|
=========== ================================================================
|
|
Name Enter a name which will be shown at the rules view for selection
|
|
Description You can add an optional description for this proxy
|
|
Proxy Type Enter a Proxy type or DIRECT if no proxy should be used
|
|
URL Enter the Proxy URL unless DIRECT has been choosen
|
|
=========== ================================================================
|
|
|
|
In this case it is assumed that only a single LAN and a DMZ exists and that
|
|
internal connections should not run over the proxy.
|
|
To make meaningful rules, we need two possible return values:
|
|
|
|
* The LAN Proxy
|
|
* No Proxy
|
|
|
|
No proxy is quite simple to configure:
|
|
|
|
.. image:: images/pac_proxy_direct.png
|
|
|
|
=========== =================
|
|
Name direct
|
|
Description can stay empty
|
|
Proxy Type Direct Connection
|
|
URL empty
|
|
=========== =================
|
|
|
|
For outgoing connectins we need the proxy:
|
|
|
|
.. image:: images/pac_proxy_lan.png
|
|
|
|
=========== ===========================
|
|
Name lan_proxy
|
|
Description can stay empty
|
|
Proxy Type Proxy
|
|
URL Proxy IP + ':' + Proxy Port
|
|
=========== ===========================
|
|
|
|
|
|
Third Step: Create Rules
|
|
------------------------
|
|
|
|
Now as the matches and the proxies exist, rules can be built.
|
|
For that, switching to :menuselection:`PAC --> Rules` is required.
|
|
|
|
Now the following rule needs to be created:
|
|
|
|
.. image:: images/pac_rule.png
|
|
|
|
=========== ===========================
|
|
Enabled checked
|
|
Description a description for your reference
|
|
Matches the two previously created matches
|
|
Join Type And
|
|
Match Type If
|
|
Proxies Select the LAN proxy
|
|
=========== ===========================
|
|
|
|
Click the orange reload button and you are done.
|
|
|
|
----
|
|
WPAD
|
|
----
|
|
|
|
Web Proxy Auto Discovery is used to find the PAC file for the domain.
|
|
|
|
|
|
Using DNS (Unbound)
|
|
===================
|
|
|
|
|
|
Variant 1: Automatic Configuration
|
|
----------------------------------
|
|
|
|
.. Warning::
|
|
When you use this option, the wpad hosts and the TXT records for
|
|
the domain will be overridden. This may break some other records
|
|
like TXT records for SPF for this particular domain.
|
|
|
|
In Unbound, you can simply check the following checkbox:
|
|
|
|
.. Image:: images/wpad_dns_unbound2.png
|
|
|
|
This will define the host records of any domain configured in DHCP
|
|
as CNAME for your firewall host. It will also override TXT records
|
|
resolve to the URL to the PAC file.
|
|
|
|
|
|
Variant 2: Manual Configuration
|
|
-------------------------------
|
|
|
|
.. Warning::
|
|
When DNS is used, OPNsense must respond via HTTP on port 80.
|
|
|
|
Open the page :menuselection:`Services --> Unbound DNS --> Overrides` and add a new host override
|
|
for the `wpad` host:
|
|
|
|
.. image:: images/wpad_dns_unbound.png
|
|
|
|
|
|
=========== =========================================================
|
|
Host wpad
|
|
Domain your domain
|
|
Type A or AAAA
|
|
IP IP of your OPNsense (where the Web interface is reachable
|
|
Description can stay empty
|
|
=========== =========================================================
|
|
|
|
Save the settings and apply the changes.
|
|
|
|
Using DHCP
|
|
==========
|
|
|
|
|
|
Variant 1: Automatic Configuration
|
|
----------------------------------
|
|
|
|
In the DHCP server settings, you can check the following checkbox:
|
|
|
|
.. image:: images/wpad_dhcp.png
|
|
|
|
In this case, an entry for the protocol and the port of the web interface
|
|
will be created with the domain you choose in your system settings
|
|
(domain of the firewall). The hostname is `wpad`. If you are running
|
|
the OPNsense web interface on port 80 with HTTP. The following URL will be
|
|
created:
|
|
|
|
http://wpad.example.com:80/wpad.dat
|
|
|
|
.. Warning::
|
|
If you have **HTTP Redirect** enabled via :menuselection:`System --> Settings --> Administration`,
|
|
make sure your browser accepts the certificate presented by OPNsense, as it won't
|
|
download wpad.dat if the certificate is untrusted.
|
|
|
|
Variant 2: Manual Configuration
|
|
-------------------------------
|
|
|
|
Open the page :menuselection:`Services --> DHCP --> Server`, select the correct interface and
|
|
scroll down to the "Additional Options".
|
|
|
|
Add this line and save:
|
|
|
|
.. image:: images/wpad_dhcp_option.png
|
|
|
|
====== ======================================
|
|
Number 252
|
|
Type String
|
|
Value PAC file URL enclosed in double quotes
|
|
====== ======================================
|
|
|
|
---------------------
|
|
Firefox Configuration
|
|
---------------------
|
|
|
|
Open Settings Menu
|
|
==================
|
|
|
|
First, the settings menu must be opened. There are two ways. You can either
|
|
|
|
.. image:: images/pac_firefox_menu.png
|
|
|
|
first click `Edit`
|
|
|
|
.. image:: images/pac_firefox_edit.png
|
|
|
|
then click `Preferences` or you can also
|
|
|
|
.. image:: images/pac_firefox_menu2.png
|
|
|
|
click the menu icon and then click `Preferences`.
|
|
|
|
Configure Proxy
|
|
===============
|
|
|
|
.. image:: images/pac_firefox_network_proxy_setting.png
|
|
|
|
Then scroll down to the bottom of the page and click `Settings` in the
|
|
`Network Proxy` settings.
|
|
|
|
.. image:: images/pac_firefox_proxy_settings.png
|
|
|
|
In the newly opened window, you can setup your proxy settings.
|
|
If you want to force Firefox to use WPAD/PAC, choose
|
|
`Auto-detect proxy settings for this Network`.
|
|
Click save and you are done.
|
|
|