0

Following this post, outgoing traffic will go through the proxy only if the requesting app knows the proxy url, if it doesn't then sending the request out of the LAN is denied by the proxy.

In this case it's like the app saying to the LAN "I'd like to get this from the web", and the LAN's proxy answering "No, you didn't say Simon Says".

Why is the proxy acting like this instead of just intercepting the request, doing necessary security check, and sending the request to the outside ?

And, obviously the LAN knows the proxy url, then why the need for the app to specify it when it wants to send HTTP requests outside the LAN ?

| improve this question | |
1

There are different kinds of proxies and explicit configuration is only needed in some cases:

  • Transparent proxies don't need any kind of configuration, they just need to be in the path of the traffic. The client is not really aware of the proxy in this case. DNS resolution will be done at the client. To get the proxy in the path typically some ports on the perimeter firewall are redirected to the local proxy, which means that the proxy will only cover these ports. The functionality might also be integrated in some DPI solution (like NGFW) where the kind of analysis depends on the detected application protocol and is independent of the port.
  • Explicit HTTP proxies are configured at each client. They don't need to be in the normal path of the traffic. They are not specific to some ports, instead the browser will send any HTTP traffic via the configured proxy. Contrary to a transparent proxy an explicit proxy can require explicit authentication by the client against the proxy. DNS lookup will be done at the proxy.
| improve this answer | |
  • I assume my case is about explicit proxies then. If the browser (or any other app) chooses to not send HTTP requests via the proxy, then this very proxy refuses to pass the request to the outside, acting de facto like a transparent proxy... I don't understand this config. – Coli Feb 27 '19 at 13:40
  • @Coli: ".... acting de facto like a transparent proxy..." - it is not clear how exactly the proxy is refusing the traffic. Can you please describe what the exact error is you get and not just your interpretation of the error? – Steffen Ullrich Feb 27 '19 at 14:22
  • @Coli+ for example one classic arrangement is to put the proxy in the DMZ and set the firewall so that your machine can reach the proxy and the proxy can then reach outside, but the firewall (NOT the proxy) blocks your machine from reaching outside directly. – dave_thompson_085 Feb 28 '19 at 5:29
  • Examples: if I don't specify the proxy url in Firefox config (or auto-detect it), trying to reach a web site returns an error like 'you can't reach this web site'. If I don't specify the proxy url in Git or Maven config, reaching the web hangs for some time before displaying a timeout error. – Coli Feb 28 '19 at 15:14
  • @Coli: The behavior your describe fits very much what dave_thompson_085 already suggested: the firewall (not the proxy) is simply blocking all traffic which tries to directly connect (i.e. without proxy) to the internet. – Steffen Ullrich Feb 28 '19 at 17:17
0

Many corporate proxies are implemented as a decryption and monitoring choke point. They require everything to pass through the proxy so security can evaluate and monitor from a central tap point.

I don't know if this the case for you, but that would be my guess without more information.

| improve this answer | |
  • Yes it's probably the config we have at the office. I imagine that there is a 'software' that intercepts all the HTTP requests from the LAN. If those requests didn't pass through the proxy this 'software' denies access to the web. Then why doesn't this software simply automatically redirect all request to the proxy before sending them to the web? – Coli Feb 28 '19 at 15:22
  • You're looking at this backward. The proxy is the only gateway to the Internet. If you don't direct your traffic to the proxy, you don't have a gateway. – user10216038 Feb 28 '19 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.