I added a DMZ zone and started doing some testing. The transparent proxy does not function in the DMZ zone and (for good reason) the DMZ zone does not have access to the wpad.dat file. Really, why would anyone need a web proxy in their DMZ zone? The following screenshots should show what I experienced:
I can ping out, transparent http proxy is enabled, but I cannot browse:
I didn’t even test manually configuring proxy settings. But after unchecking the block http & https ports check-box, everything started working in the dmz zone. I think the best fix would be to have the “Block HTTP and HTTPS ports” checkbox not apply to the DMZ zone.
Is there a reason it applies to the DMZ zone that I’m not thinking of?
Probably an overzealous rule.
But I can’t see where’s the problem in the code. Please, could you show a section of your /etc/shorewall/rules where you find the comment “COMMENT Proxy block HTTP/HTTPS ports”?
# Block HTTP/HTTPS from blue to net
#
?COMMENT Proxy block HTTP/HTTPS ports
REJECT blue net tcp 80,443
#
# Block HTTP/HTTPS from loc to net
#
?COMMENT Proxy block HTTP/HTTPS ports
REJECT loc net tcp 80,443
#
# Block HTTP/HTTPS from orang to net
#
?COMMENT Proxy block HTTP/HTTPS ports
REJECT orang net tcp 80,443
@alefattorini never mind about that… images started working again.
Why change from a “bug” to “support” though? If the transparent proxy doesn’t work in the DMZ zone and WPAD doesn’t work in the DMZ zone, doesn’t that make applying the “Block HTTP and HTTPS ports” check-box to the DMZ zone a bug?
Edit: I tested again with a fresh install of NethServer, fully updated - still the same problem.
To add onto this issue, you would think that adding a host to “Hosts without proxy” under the “Web proxy” section would also bypass the “Block HTTP and HTTPS ports” option… but it doesn’t. Ports remain blocked for those hosts as well.
Hosts without proxy is evaluated only when the proxy is transparent.
Thinking about it, we could probably use the same list even when not transparent. @giacomo, what do you think?
It would make sense, while making exclusions to the port blocking, to add that to the list.
I don’t know that any other bypass is required other than port blocking bypass. I assume set proxy settings to ‘manual’ or ‘none’ in those clients’ browsers that are on the exclusion list so they don’t auto discover and we’re good to go.
