Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my Linux box I need to use an ISA proxy that requires authentication to reach the internet. I therefore installed CNTLM and configured it to point to the proxy address and listen on port 4321.

I then configured my GNOME distribution to use localhost:4321 as global proxy for HTTP and HTTPS.

The result: I can connect to the internet. I can ping intranet IPs, I do receive name resolution for intranet sites, yet I cannot ping them or open any intranet site in a browser (configured to use the distributions proxy) unless I use the site's IP address.

I tried blocking the intranet IP range in the CNTLM config file without luck.

share|improve this question
Sounds like the ISA proxy isn't resolving internal hostnames. – mgorven Jun 12 '12 at 21:38
Right, but that should be dealt with by adding those sites to the NoProxy list of CNTLM? Enabling the authentication proxy is like flipping a switch between "working intranet/broken internet" and "broken intranet/working internet". – htorque Jun 13 '12 at 3:37
Yup, it should. Can you provide your cntlm.conf (minus the secret data), and examples of the intranet URLs. – mgorven Jun 13 '12 at 3:45
It now works... I don't know what changed, but definitely nothing on my end. NoProxy still points to the intranet IP address range (apart from localhost et. al), and I can successfully connect to both networks. Maybe this was a caching issue somewhere? I don't like when problems disappear without explanation. :-( Anyways, I very much like your approach and consider awarding the bounty to you, should there be no other awesome answer coming in the next few days. :-) – htorque Jun 13 '12 at 16:16
up vote 1 down vote accepted

It sounds like the ISA proxy is not resolving intranet hostnames correctly. One solution is to write a proxy auto-config file which tells the client when and which proxy to use. This doesn't work with CLI programs which use http_proxy, but will at least work in browsers.

Save this to a file like ~/proxy.pac and change to suit your environment. In the GNOME proxy configuration select the "Automatic proxy configuration" option and enter the location of this file as a file:// URL, e.g. file:///home/htorque/proxy.pac.

function FindProxyForURL(url, host)
    // Strip port number
    host = host.replace(/:\d*/, "");

    // Local destinations
    if (    isPlainHostName(host) ||
            dnsDomainIs(host, ".local") ||
            dnsDomainIs(host, ".mycompany") ||
            shExpMatch(host, "127.*.*.*") ||
            shExpMatch(host, "10.*.*.*") ||
            shExpMatch(host, "192.168.*.*") )
        return "DIRECT";

    // External destinations
    return "PROXY localhost:3128";
share|improve this answer
This worked great for the intranet that I'm on that has its own proxy.pac file which has a large list of proxy bypass destinations. I downloaded the file and simply modified it to point to my local CNTLM proxy. This is on Win2k8 running Chrome. – Shaun May 28 '15 at 7:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.