Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently installed a web proxy at my workplace. I don't understand why, should this be OK? What are the reasons to use a proxy at work? IMO using a proxy at work is a wrong decision.

share|improve this question

closed as primarily opinion-based by Falcon Momot, mdpc, Dave M, Ward, ceejayoz Oct 6 '13 at 16:35

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

14  
I'd love to know why you'd install something you didn't know the purpose of. –  womble Jul 17 '11 at 9:55

7 Answers 7

  • Caching frequently accessed content
  • Controlling and/or monitoring site access to ensure conformance with internal or external regulations and usage policies
  • Enabling intrusion detection systems and groupware filters to trap viruses or other malicious payloads
share|improve this answer
1  
+1 Pretty much hit the nail on the head. We tend to recommend appliances such as IPCop or pfSense which do more than just proxy. You'll find that with a few addons you can force everything through the proxy and then control (even with time controls) which websites are allowed, banned, etc. You can also easily identify who is working and who is just surfing around all day. –  KPWINC Jun 30 '09 at 15:56

Using a proxy at work is often very much the right decision. Maybe not so much for [very] small companies with not staff and loose policies, but still good for caching at the very least.

Some things already mentioned

  • caching downloaded content, consumes less bandwidth to your ISP
  • content filtering, lets you implement HR policies
  • virus scanning, catches things before hitting client workstations

Some additional things

  • load distribution, allows you to take the load of content filtering, virus scanning, etc off of your primary firewall
  • better security, if you use a web proxy for access control inside of your firewall you can integrate it with your internal authentication mechanisms (AD, LDAP, etc) without having to connect your firewall to do the authentication. Adds another layer between the outside and your internal authentication
  • traffic analysis and usage stats since many [most] firewalls don't log in formats that are recognized by web analytic packages
  • application level protocol filtering (although the gap is closing here), some proxies let you get inside the application level protocol to be able to filter things out more granularly (examples: blocking out WebDAV verbs from an HTTP request, blocking PUTs in FTP)

There are some drawbacks in running a separate web proxy from your primary firewall:

  • Different configurations for apps that use application level protocols other than HTTP, HTTPS, FTP if your proxy doesn't know about them. This is especially apparent in the streaming media arena.
  • You will have a problem with [Java] applets that want to talk directly to their remote hosts outside the realm of HTTP
  • You will need to have a configuration mechanism for client applications (browsers, media players, etc) to use the proxy. This is probably already the case if your Internet connection is coming in to a central location, but for smaller networks where the Internet gateway is the default route this will be an additional configuration to support.
  • It is an additional system to have to support and maintain
share|improve this answer

Because you don't want your developers spending all day on StackOverflow.com :)

share|improve this answer
    
True, luckily our proxies haven't caught on yet :-) –  MattGWagner Jun 30 '09 at 18:14

Repeat this mantra: "A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface."

Otherwise, what everyone else said.

share|improve this answer

One of the reasons to use a proxy at work is so that IT can analyze the traffic going into and out of the proxy for security reasons and to block off certain websites from being accessible via a filter.

share|improve this answer

The proxy "fetches" resources from other servers you have requested, so it serves as a good filter between your network and the Internet. It can speed up access time and keep your machine anonymous.

share|improve this answer

Traffic control, site locks and access control.

share|improve this answer