Security

Ask something
Discussion Locked

Users bypassing Proxy & Firewall

0 helpful
17 replies

by bhrdwh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hi, we use MS Proxy 2.0 with SP1 for our win95/98 MSP Clients. Now the users here simply remove settings of Proxy (port 8080, auto config) from IE 5.0 / 5.5 connection & browse the whole internet. We use XStop but even that does not show up. I have reinstalled MSPClients on PCs but got nowhere !! HELP !!

17 replies

by paklover4

First of all Use the latest service pack e.g.
SP5 . Then in proxy server settings choose No automatic config , But manual config of settings, And also install the latest winsock version, . I hope this will solve ur problem.

by david

If the users are taking out the settings in Internet Explorer you should lock out the lan settings button in IE either through a policy or a reg hack. The reg hack could be pushed out through a login script.

by bkduke

We had the exact same setup. We were using MS Proxy 2.0 with the MSP Client winsock replacement which eliminated the requirement to configure the users browsers or other Internet enabled applications.

However, we setup our firewall rules to onlyallow traffic "originating" from the Proxy Server to access the Internet. This same thing could be done by a router with access lists.

by isys

Your proxy server is essentially a peer to the rest of your network. To prevent this, it should have two network cards installed. The first is your internal network IP and takes the requests from your users. The other is connected directly to your Internet router via a cross-over cable. Then there is no way they can bypass the proxy. Make sure you have IP forwarding set on both card IP configurations.

by tlivers

The Easiest way to fix it is not to load the wspclient on the workstations and force them to use Browser Authentication, IE the Name and Password login box. The WSPCLIENT is only really needed to allow proxy unaware applications access to the internet through the proxy server. PS They are not going around the firewall they are using the WSPCLIENT to get through the firewall with out having to login.

by brian_e

As in question #4..

Use filtering rules on your router to the internet that allow traffic originating only from your proxy server on port 80.

You proxy server will not require two NIC's.

Even if following #4 you can assign an alias to your proxy's NIC so that it can have multiple IP addresses.

Regards,
Brian

by bhrdwh

My Client PCs show that they are using port 808 (I dont know how & why). Win 95/98 users, have MSP client installed on their PCs and simply remove / uncheck settings for Automatic Configuration, Proxy Script & Proxy server name / port. Then these guys can open all sites/url. We use X Stop for filtering URLs. However, guys using IE properly (not trampering the entries on IE) get XStop when they try to open blocked sites. My first concern is how to get port 80 ?
Akash

by tlivers

IF YOU READ WHAT I POSTED THE FIRST TIME YOUR PROBLEM WOULD HAVE BEEN FIXED. THEY ARE USING THE WSPCLIENT TO BYPASS THE SIGN ON. IF YOU WISH THEM TO SIGN IN TO THE FIREWALL IE NAME AND PASSWORD YOU NEED TO DO THE FOLLOWING.

1) UNINSTALL THE WSPCLIENT FROM THE WORKSTATIONS.
2) SET THE PROXY SERVER INFORMATION IN THE BROWSER TO REFLECT A MANUAL PROXY CONFIGURATION AND USE THE NAME OR IP ADDRESS OF THE INSIDE NIC ON THE FIREWALL. IE 192.168.2.1 USE PORT 80 AS YOUR PORT AND CHECK USE THIS CONFIG FOR ALL.

NOW THEY WILL HAVE TO LOGIN TO ACCESS THE INTERNET.

PS IT DOES NOT GET MUCH SIMPLER THEN THIS.

by leon_guerrero

Usually those Internet Monitoring Software packages (websense, surfcontrol, etc.) only work using the WebProxy Service and not with the WinSock Service. MSPClients is used for WinSock Service access.
I would stop the WinSock service on the Proxy Server and uninstall all MSPClients on the PC's. This will stop users from browsing the Internet through WinSock. I bet your users can browse anywhere on the Internet through WinSock.
Then I would set up the WebProxy Service and enable Access Controls. With Access Controls I can add only the users that I want to be able to browse the Internet. Anyone not on the Access Control list will not be able to browse the web. Also, your X-Stop software will be monitoring and allowing/blocking sites through the WebProxy Service.
Using this set up they should not be able to go around your setup even if they change their settings in IE for manual/auto configuration or whatever because the only way out to the Internet is through the WebProxy Service which you are in control of through Access Controls.

This discussion is closed to new replies.