3 ms·

Why do so many companies require proxy configurations to be set on the endpoint, rather than using transparent proxying? Wouldn't that completely avoid a whole

Why do so many companies require proxy configurations to be set on the endpoint, rather than using transparent proxying? Wouldn't that completely avoid a whole class of issues?

9dev 4y ago
SSL certificates would be my first guess.
- josephcsible 4y ago
  Don't browsers use CONNECT to access HTTPS sites over a proxy? Isn't the certificate situation exactly the same inside of that vs. with transparent proxying?
tryauuum 4y ago
hm... Could it be related to malware? If there's a malicious device in network, it would need a proxy configuration. With a transparent proxy back-connecting to attacker would be easier On the other hand, attacker could probably always send messages out via DNS tunnel Please someone more knowledgeable do enlighten us
- c0nsumer 4y ago
  Malware can easily just pick up and use the system proxy settings. Hell, on Windows it just has to use WinHTTP and it'll use the system's paths to the internet.
  - tryauuum 4y ago
    Yeah, but if you don't set system proxies and instead you set it through environmental variables only for apps that need it?
c0nsumer 4y ago
OP here. This isn't quite my space, but from what I recall there's a couple wrinkles with transparent proxying. It's overall a good idea, but has some edge cases: - Authentication can go sideways in weird ways. A 407 from what looks like the correct site can cause odd things. IIRC there isn't great support from vendors for authenticating transparent proxies, too. Sure, you could auth off the machine instead (X device is on the network, therefore it's allowed), but what about shared machines... Proxy auth as user is better, because it allows requests to be tracked to a user ID and login session, not just a device. - Client getting load balanced between proxies during a session can trigger reauth (because auth sessions not shared between proxies), this can confuse a client. - HTTPS sites can get weird. - Routing in very large private environments can complicate default routing to the public internet. Although this can be handled by doing transparent auth + optional manual config.

Why do so many companies require proxy configurations to be set on the endpoint, rather than using transparent proxying? Wouldn't that completely avoid a whole class of issues?

9dev 4y ago

SSL certificates would be my first guess.

josephcsible 4y ago
Don't browsers use CONNECT to access HTTPS sites over a proxy? Isn't the certificate situation exactly the same inside of that vs. with transparent proxying?

tryauuum 4y ago

hm... Could it be related to malware? If there's a malicious device in network, it would need a proxy configuration. With a transparent proxy back-connecting to attacker would be easier On the other hand, attacker could probably always send messages out via DNS tunnel Please someone more knowledgeable do enlighten us

c0nsumer 4y ago
Malware can easily just pick up and use the system proxy settings. Hell, on Windows it just has to use WinHTTP and it'll use the system's paths to the internet.
- tryauuum 4y ago
  Yeah, but if you don't set system proxies and instead you set it through environmental variables only for apps that need it?

c0nsumer 4y ago

OP here. This isn't quite my space, but from what I recall there's a couple wrinkles with transparent proxying. It's overall a good idea, but has some edge cases: - Authentication can go sideways in weird ways. A 407 from what looks like the correct site can cause odd things. IIRC there isn't great support from vendors for authenticating transparent proxies, too. Sure, you could auth off the machine instead (X device is on the network, therefore it's allowed), but what about shared machines... Proxy auth as user is better, because it allows requests to be tracked to a user ID and login session, not just a device. - Client getting load balanced between proxies during a session can trigger reauth (because auth sessions not shared between proxies), this can confuse a client. - HTTPS sites can get weird. - Routing in very large private environments can complicate default routing to the public internet. Although this can be handled by doing transparent auth + optional manual config.