Secure Internet Access – Proxy PAC configuration [Draft]

A proxy for internet access in an enterprise business refers to an intermediary server or service that acts as a gateway between a company’s internal network and the internet. When employees access websites or online services, the proxy server sits between their devices and the destination servers, handling the communication on behalf of the users. Proxies are used for various purposes, including improving security, performance, and compliance.

PAC file (Proxy Auto-Config file) is a script used to automatically determine which proxy server (if any) should be used for a specific web request. It allows a device or browser to make dynamic decisions about how internet traffic is routed, based on a set of rules defined in the PAC file.

How a PAC File Works:

When a browser or application is configured to use a PAC file, it loads the file at the start of a web request. The PAC file contains JavaScript code that defines a function called FindProxyForURL(url, host). This function evaluates the requested URL and determines the appropriate proxy server to use for that request.

function FindProxyForURL(url, host) {
    if (shExpMatch(host, "*.company.com")) {
        return "DIRECT";  // No proxy for company sites
    }
    if (shExpMatch(host, "*.example.com")) {
        return "PROXY proxy.example.com:8080";  // Proxy for example.com
    }
    return "PROXY proxy.default.com:8080";  // Default proxy for everything else
}

Proxy Server (Reverse Proxy)

Proxy Server Functionality:

  • The Proxy Server fully analyzes the traffic, which can happen up to Layer 7.
  • The Proxy Server acts on behalf of the OCS (Origin Content Server).
  • Like a Full Proxy, the traffic is handled the same way, separating incoming and outgoing traffic as different connections.

Uses of the Proxy Server:

  • Load Balancing
  • Blocking traffic from specific sources
  • Traffic Optimization
  • SSL Offloading
  • Deep Traffic Inspection
  • Web Application Firewall (WAF)
  • Server Side Caching

In this setup, the user machine connects to the internet through the Proxy Server, which then communicates with the Origin Content Server on the user’s behalf. This allows the Proxy Server to perform various optimization and security functions, such as load balancing, traffic filtering, SSL offloading, and caching.

The key benefit is that the Proxy Server acts as an intermediary, handling the traffic in a way that can improve performance, security, and control over the content delivery process.