Before I attempt this Im looking for advice on web proxy&I have a server with which I want to create a web proxy using Squid. Want my users who are at another branch to do all their browsing, chat, accessing their gmail, FTP downloading, etc. thru the web proxy. They are at (fictional IPs) 69.120.130.0/28 and my web proxy is at 131.31.27.8/29 network. I am putting the IP 131.31.27.9 (web proxy servers IP) in Proxy Setting of their laptops. At first I will let all traffic thru, and will look to filter it later on.
Will all user traffic, in both directions, go thru my 131.31.27.8/29 network? I want them to be able to do chat, gmail, hotmail, youtube, whatever. Dont want any return traffic to go directly to their 69.120.130.0 network, everything to come back thru the 131.31.27.8 network. Is this all possible? Are there any limitations with what I can pass thru my proxy?
Lastly, can you point me to info on how to do this?
Thank you in advance.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If everything is going thru my web proxy server, then is there any affect or limitation to the users accessing their gmail, or going to chat rooms, or connecting to youtube while going thru the web proxy server? Any kind of noticeable performance hit? Any applications not supported? Want this totally seamless to the users, while being "unknow" to the destination resource.
Anytime you add additional processing you can have a performance loss. However you can gain some back with the caching, so I think it all balances out.
Web Proxys typically follow the CERN Compliant Web Proxy Standard. This means it handles:
HTTP
HTTPS
FTP-over-
Gopher (if anyone cares about Gopher)
I cannot say if your Web Proxy follows that standard exactly.
It can only be used by applications designed to use a Web Proxy,...which is pretty much just web browsers and any applications that run inside the browser environment (like activex controls, java applets).
Winsock based applications will not use the web proxy and will need a different means to get out (POP3/SMTP mail clients, telnet clients, full FTP Clients, etc)
I see. So as I understand this (please excuse my newbieness), the user can't do FTP (eg. FileZilla) directly, but via the web proxy he can download through an FTP-embedded program on the web site he browsed to. He can't ssh (eg. putty) thru the web proxy to a specific location, but he can browse to it (if it provides a web page) and log in, if it allows that. Do I have that right?
What about accessing his gmail account? Isn't that a browsing function since he just goes to google, clicks gmail, and enters his username/pw?
Same thing goes when he subcribes to a chat room. And downloading streaming video from youtube. That's all browser initiated, so it would all use the proxy right?
Thanks again.
I see. So as I understand this (please excuse my newbieness), the user can't do FTP (eg. FileZilla) directly, but via the web proxy he can download through an FTP-embedded program on the web site he browsed to. He can't ssh (eg. putty) thru the web proxy to a specific location, but he can browse to it (if it provides a web page) and log in, if it allows that. Do I have that right?
FTP-over-HTTP means that it is really HTTP,...the FTP "stuff" is embedded within the HTTP packets payload. So you have to use the browser as the "FTP Client".
No SSH.
What about accessing his gmail account? Isn't that a browsing function since he just goes to google, clicks gmail, and enters his username/pw?
Same thing goes when he subcribes to a chat room. And downloading streaming video from youtube. That's all browser initiated, so it would all use the proxy right?
that all takes place within a browser from a browser,...so it should be fine.
You deal with this by having your Firewall Device allow whatever traffic the user needs except http/https. It will only allow http/https when it is comming from the Web Proxy. This should let everything work while still forcing the user to only be able to get out with http/https by using the web proxy. If some smart-aleck user tries to remove the proxy setting from their browser to get out and bypass the web proxy will be denied by the firewall.
Business Accounts
Answer for Membership
by: pwindellPosted on 2009-08-12 at 12:29:04ID: 25081971
The user generated traffic will appear to come from the web proxy machine,...therefore the "response" traffic will respond to the web proxy machine,...the user's machines are "invisible" and "unknown" to the destiantion resoure.