0

I have this weird behavior from a PAC File. I have an existing PAC File that is working fine. Due to recent migrations, I had to start modifying the PAC file, and exclude some IPs and URLs, mainly for MS Teams, from the proxy.

After testing the modification, I found that there is extreme latency in the browsing. Working on the PAC File, I tuned it to decrease the network requests and to resolve the domains one time, then check the IP Address. However, it caused every website that has to go to the proxy not working.

Below is my updated PAC File Removing some details from it:

function FindProxyForURL(url, host) {

    if(!isResolvable(host))
        return "DIRECT";
    var resolved_IP = dnsResolve(host);
    
    if ((shExpMatch(url, "ctldl.windowsupdate.com")) || 
    (shExpMatch(url, "download.windowsupdate.com")) || 
    (shExpMatch(url, "windowsupdate.microsoft.com")) || 
    (shExpMatch(url, "update.microsoft.com")) || 
    //check for local IP addresses
    (isInNet(resolved_IP, "127.0.0.1", "255.0.0.0")) || 
    (shExpMatch(url, "*.internaldomain1.com")) || 
    (shExpMatch(url, "*.internaldomain2.com")) || 
    (shExpMatch(url, "*.internaldomain3.com")) || 
    (shExpMatch(url, "internaldomain4.com")) ||
    /* Skype for Business and MS Teams */
    (isInNet(resolved_IP, "52.112.0.0", "255.252.0.0")) || 
    (isInNet(resolved_IP, "52.120.0.0", "255.252.0.0")))
        return "DIRECT"; 
    else
        if (url.substring(0, 5) == 'http:' ||
        url.substring(0, 6) == 'https:' ||
        url.substring(0, 4) == 'ftp:')
        return "PROXY <Primary Proxy IP>:8080; PROXY <Secondary Proxy IP>:8080";
    return 'DIRECT';
}

I'm not sure what I'm missing here causing the denial of requests.

I also enabled Developers Tools on Firefox, and saw blocked requests (not every time though)

=============================

UPDATE:

PAC File Before Modification

function FindProxyForURL(url, host) {

    if (shExpMatch(url, "ctldl.windowsupdate.com")) { return "DIRECT"; }
    if (shExpMatch(url, "download.windowsupdate.com")) { return "DIRECT"; }
    if (shExpMatch(url, "windowsupdate.microsoft.com")) { return "DIRECT"; }
    if (shExpMatch(url, "update.microsoft.com")) { return "DIRECT"; }


     //check for local IP addresses
    if ((shExpMatch(host, "127.0.0.1"))

                 || (shExpMatch(host, "*.domain1.com"))
                 || (shExpMatch(host, "*.domain2.com"))
                 || (shExpMatch(host, "*.domain3.com"))
                 || (shExpMatch(host, "domain3.com"))


         ) { return "DIRECT"; }


if (url.substring(0, 5) == 'http:' ||
url.substring(0, 6) == 'https:' ||
url.substring(0, 4) == 'ftp:')
{
return "PROXY <Proxy1>:8080; PROXY <Proxy2>:8080";
}
return 'DIRECT';
}
2
  • If it worked before and not after, providing the diff(erence) would be helpful.
    – A.B
    Oct 28 '20 at 13:02
  • @A.B Question Updated With PAC File Before
    – sikas
    Nov 1 '20 at 10:35
0

First of all this is illegal - shExpMatch(url, "*.internaldomain1.com" because its not always a regexp. This is legal:

shExpMatch(url, "*.internaldomain1.com/*")

or

shExpMatch(host, "*.internaldomain1.com")

You had hosts matching but new PAC has url matching. Not sure it has something with proxy sites problem. For this we have to know what refusing means - what error you get accessing what site.

1
  • thank you for your reply. I'm not getting any errors when using modified PAC, any request that should be sent to the proxy doesn't load. But direct does. When using old PAC everything works fine.
    – sikas
    Nov 2 '20 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.