Networks

Ask something
Discussion Locked

Network and proxy server questions

0 helpful
4 replies

by matt_falenski

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Does a proxy server go between clients & Internet/network, or anywhere on the network? Can you require use of a proxy server without installing some sort of client on each PC?
I see the checkbox on IE, Use Proxy Server: & the address and different ports for Web, FTP, SSL, etc. Is it possible to force clients use that, and if they don't - no Internet access for them? Seems too easy to just remove the check box or would you deny ports 80,21,443 access to all but the proxy server? Thanks!

4 replies

by joseph moore

A lot of questions! Ok, let's go.

>Does a proxy server go between clients & Internet/network, or anywhere on the network?
Well, it depends on how your routing and firewall and/or router access lists are set up. You can make it so that going fromone IP network (192.168.10.0/24) to a web server on another network (192.168.11.0/24) on your LAN/WAN would require that your clients use a proxy server, the same way clients use the proxy to hit www.yahoo.com
It all just depends on what kind of internal traffic you allow running through your network.

>require use of a proxy server without installing some sort of client on each PC?
Yes, some proxy servers have client software, but I believe that most do not. MS Proxy and Winproxy are 2 I know of that do not use client software on the clients.

>Is it possible to force clients use that?
With Windows clients, yes, you can. You can force proxy settings if you have Win2K Active Directory running, using Group Policy. You can also push a.REG file in logon scripts to NT/2k/XP and the Win9x clients to run if you don't have Active Directory. The REG file will contain the IE registry settings to use a proxy server. I have done this myself, and it works quite well. When people log in, the login script changes the IE settings so that they have to use the proxy. Also, as the users move from machine to machine, the proxy settings follow them (since the same logon script runs no matter what machine they use).

by joseph moore

>Seems too easy to just remove the check box or would you deny ports 80,21,443 access to all but the proxy server?
Yes, that is all that needs to be done on the user side, to remove the proxy check box. But, if your network is designed right (againwith firewall rulesets or router access lists) then IF a user tries to go outbound without using the proxy server, the outbound communication would fail. That is how you guarantee that users won't go messing with the proxy settings. You lock down the outbound routes so that ONLY the proxy can go outbound on port 80 & 443 (and 21 and 25 and 110, etc.) You just need to be tough.

hope this helps

This discussion is closed to new replies.