Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow certain users access to our network via Citrix. We're using XenApp 5.0 and we will allow Internet Explorer, but want to restrict what sites they can visit. For instance, I'd like to allow browsing Intranet site A, but not sites B or C, or any external sites.

Can this sort of thing be controlled via Citrix?

share|improve this question
up vote 3 down vote accepted

You could force these users to use a proxy script using a GPO.

The proxy script is a simple JavaScript, allowing you to direct connection through different proxies or direct.

Create the script so that allowed sites are sent DIRECT or through the proxy used on your network (if any), but any undefined sites are sent to a bogus proxy address.

It could be something like this:

var local_ip = myIpAddress();

function FindProxyForURL(url, host) 

    // Resolve host to IP address
    var resolved_ip = dnsResolve(host);


    // Hosts and domains
    if (localHostOrDomainIs(host,   "intranet")                     ||
        localHostOrDomainIs(host,   "servicedesk")                  ||
        localHostOrDomainIs(host,   ""))
    return "DIRECT";

    // IP addresses
    if ((resolved_ip == "")  ||
        (resolved_ip == "")  ||  
        (resolved_ip == "")) 
    return "DIRECT";

    // IP ranges
    if (isInNet(resolved_ip,    "", "")    ||
        isInNet(resolved_ip,    "",   "")  ||
        isInNet(resolved_ip,    "",  "")  ||
        isInNet(resolved_ip,    "",    ""))
    return "DIRECT";


    // Default to bogus proxy server on same subnet as client!
    return "PROXY";

    // --------------------------------------------------


Replace "DIRECT" with "PROXY ProxyIP:ProxyPort" if a proxy is used. Replace the bogus proxy "PROXY" with an IP address on the same site as your Citrix servers, to keep the dead-end traffic on the LAN.

If you wish, you can add more sophisticated conditions, e.g. regex matching on either the "url" or "host" variable.

Test your own script with

Put the script on an internal web server with a .pac extension and put the URL in the GPO. Make sure to add the .pac file extension to the web server's MIME type list as "text/javascript".

I have never used PAC files for this purpose, so you probably want to ensure that Internet Explorer doesn't somehow fallback on DIRECT, when it fails to use the bogus proxy server.

Just an idea.

share|improve this answer
And... I just realized this question is ancient... – abstrask Apr 11 '12 at 13:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.