I want to route all Internet access in my network through a Squid proxy server and authenticate and log all users. I want this to be a client-independent setting so that no one needs to do anything on their browsers or machines.

I have set my network gateway as the proxy server so that all traffic will be sent to it. I have done this using options in DHCP server.

  1. Now I tried using squid as a transparent proxy, but then it won't authenticate in that mode.
  2. I tried using iptables to route all traffic to port 3128 but it won't popup the authentication dialog box from SQUID.
  3. I tried telling DHCP to give WPAD to all clients by placing a WPAD file on a webserver containing the following for automatic proxy configuration on clients:

    Changes in dhcpd.conf

option wpad code 252 =test;

option wpad "\n\000";

option wpad "\n";

The WPAD file:

function FindProxyForURL(url,host)


return "PROXY squid-server-ip-address:3128 ; DIRECT ";


But the browsers (different versions of Firefox and IE) seem to ignore it. :(

What should I do ?


Think your DHCP options may be off... From: http://www.wlug.org.nz/WPAD

Add the following to your /etc/dhcpd.conf:

option option-252

With ISC DHCP v3+, option-# options don't work. You have to do this in the global section of your configuration:

option wpad-url code 252 = text;
(define a new option)

And add this in either the global or appropriate subnet section(s) of your configuration:

option wpad-url
"http://wpad.my.domain.tld/proxy.pac\n"; (use new option)

Also, you will find that auth in transparent mode in squid is not really possible. Some commercial web filters do work around this (indeed I work for SmoothWall, one such filter).

  • LOVE the SmoothWall, Tom. – cop1152 Apr 1 '10 at 16:59
  • Hey, thanks a ton Tom! :D This takes care of all the Internet Explorers out there in the network. But Firefox and Konqueror don't autodetect these settings. I will try the DNS method from the URL you mentioned. Thanks again! :) – Knight Samar Apr 6 '10 at 5:28
  • 1
    You might try adding a dns record for wpad.yourdomain - though if your client (windows) PCs all have different domain settings it might get hairy. Check your logs, see who is looking up what, wpad wise. Also worth downloading wireshark and and looking at what exactly each browser is doing when it fails. – Tom Newton Apr 6 '10 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.