Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Firefox browser contains network settings under Tools-->Options-->Advanced-->Network-->Settings and there is an option to do auto detect proxy settings, how should I enable this? Currently this is manually configured and its possible for users to bypass and use the internet directly. We use a variety of browsers (firefox, IE, chrome, safari, opera) on win xp, win 2003, win vista machines. How should I enable this so that the end user cannot manipulate the settings on his browser to by pass security.

I have configured a squid cache proxy server for this purpose.

share|improve this question

For Internet Explorer, you can enforce your proxy settings using Group Policy Objects if you have an Active Directory domain; but I don't know of any way to centrally manage other browsers.

share|improve this answer
am interested in a solution which can be consistently enforced across all browsers. it's very common to use multiple browsers in a dev environment – user42891 May 24 '10 at 17:34
Of course, but you can't manage them centrally if they don't have any central management feature... – Massimo May 24 '10 at 17:37

To setup the proxy automatically use the WPAD, the link includes links to pages about how to setup the WPAD. Most browser will use this to decide which proxy to use.

Even if you setup WPAD, and group policies to control IE you still cannot completely force a proxy setting onto all browsers. A user could easily use a PortableApps browser or a livecd which you will have no control over. If you really need to lock things down you will probably need to block all http/https traffic from leaving your network from any system other then the proxy.

If your users are really sophisticated you may need to block all outgoing traffic except what you explicitly permit. Even this will not be a 100% effective block. There are far too many people working on ways to make sure the internet is not censored.

It may be easier to simply use WPAD and group policies to set a proxy wherever possible, do some basic firewalling to block the obvious proxy traffic, and just monitor for anything else and deal with it at layer 8.

I do suggest that if you try and filter internet access to do your best to filter the least amount possible. Trying to solve personnel with technology problems tends to cause as many layer 8 problems as it fixes.

share|improve this answer

This is where products like Microsoft's ISA server / forefront TMA can work well. Not only can it act as the proxy, but it can also handle being your IP gateway from the LAN to the web, so you can be sure that no traffic passes through it un-inspected...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.