Skip to main content
Version: 2.10.0

Glasswall-Internal-Deployment-Issues-and-Fixes

1. DNS Issues on Windows​

  • Issue: Enabling the proxy caused loss of DNS resolution, blocking all internet access.
  • Fix: Resolved by using the IP address of the proxy server instead of the DNS name.

Here are the steps to set the proxy via IP address instead of the DNS name in Safari, Microsoft Edge, and Google Chrome on macOS and Windows:

Safari (macOS)​

  1. Open System Preferences by clicking the Apple logo in the top-left corner and selecting System Preferences.

  2. Go to Network.

  3. In the left-hand menu, select your network interface (e.g., Wi-Fi or Ethernet).

  4. Click the Advanced button in the lower-right corner.

  5. Select the Proxies tab.

  6. If you're using a manual proxy setup, enter the IP address of the proxy server in the Web Proxy (HTTP) and Secure Web Proxy (HTTPS) fields instead of the DNS name. For example:

    • Web Proxy (HTTP): 10.7.0.201:3128

    • Secure Web Proxy (HTTPS): 10.7.0.201:3128

  7. Click OK and then Apply to save the changes.

Microsoft Edge (Windows)​

  1. Open Settings by clicking the three-dot menu in the upper-right corner of Edge and selecting Settings.

  2. In the left-hand menu, click System and performance.

  3. Scroll down to Open your computer's proxy settings and click it. This will open the Proxy settings in Windows.

  4. In the Proxy settings window, enable Manual proxy setup by turning on the Use a proxy server toggle.

  5. In the Address field, enter the IP address of the proxy server (10.7.0.201), and in the Port field, enter 3128.

  6. Click Save to apply the changes.

Google Chrome (Windows)​

  1. Open Settings by clicking the three-dot menu in the upper-right corner of Chrome and selecting Settings.

  2. Scroll down and click Advanced to expand more settings.

  3. Under System, click Open your computer's proxy settings. This will open the Proxy settings in Windows.

  4. In the Proxy settings window, enable Manual proxy setup by turning on the Use a proxy server toggle.

  5. In the Address field, enter the IP address of the proxy server (10.7.0.201), and in the Port field, enter 3128.

  6. Click Save to apply the changes.

2. Slack Access​

  • Issue: Slack experienced issues sending/receiving messages when the proxy was enabled on macOS.
  • Fix: Slack functionality was restored by applying a local exclusion in safari:

Steps to Set a Proxy Exclusion for a Domain in Safari​

  1. Open System Preferences on your macOS device by clicking the Apple logo in the top-left corner and selecting System Preferences.

  2. Go to Network.

  3. In the left-hand menu, select the network interface you are using (e.g., Wi-Fi or Ethernet).

  4. Click the Advanced button in the lower-right corner.

  5. Select the Proxies tab at the top of the window.

  6. If a proxy is enabled, you'll see options for different proxy types (e.g., Web Proxy (HTTP), Secure Web Proxy (HTTPS)). Make sure the relevant proxy option is checked.

  7. Under the Bypass proxy settings for these Hosts & Domains section, you can enter the domain you want to exclude from the proxy. You can enter multiple domains, one per line. For example, to exclude Slack from being routed through the proxy, you would add the following:

3. Firefox Proxy Bypass​

  • Issue: Chrome, Safari, and Edge rely on system proxy, making it difficult to bypass for specific apps like Firefox.
  • Fix: Confirmed that we can use Firefox to bypass the system-wide proxy.

Steps to Set No Proxy in Firefox​

  1. Open Firefox.

  2. Click the hamburger menu (three horizontal lines) in the upper-right corner of the window to open the Firefox menu.

  3. Select Settings from the dropdown menu.

  4. In the left-hand menu, select General.

  5. Scroll down to the Network Settings section at the bottom of the page.

  6. Click on the Settings… button next to Network Settings.

  7. In the Connection Settings window that appears, you will see several options for configuring a proxy.

  8. Select No proxy.

  9. Click OK to save your settings.

4. Cloudflare CAPTCHA Problems​

  • Issue: CAPTCHA failures were observed on Safari (macOS), while Chrome worked correctly. This may be a browser compatibility issue rather than a proxy-related one.
  • Fix: Adding a domain exception to Squid (or other network appliance) resolves the issue for Cloudflare CAPTCHA.

5. Mac Update and App store problems​

  • Issue: Mac software updates and installing/updating apps from App store did not work because of trust issues with self-signed SSL certificates from Squid Proxy.
  • Fix: Adding a domain exception to Squid resolves the issue.

6. CLIs, Tools, Cloud Providers​

  • Issue: A variety of CLI tools (pip, az, gcloud, oci) did not work as expected because of self-signed SSL certificates. Similarly ChatGPT desktop application did not work because of self-signed SSL certificates.
  • Fix: Adding a domain exception to Squid resolves the issue.

How to exclude domains from SSL Bump in Squid proxy​

1. Edit the Squid Configuration File​

  1. Access your Squid proxy server via SSH or directly, depending on how you manage it.

  2. Open the Squid configuration file (squid.conf) for editing. This file is usually located in /etc/squid/ or /etc/squid3/.

    sudo nano /etc/squid/squid.conf

  3. Scroll to the bottom or find the appropriate section where you define ACLs and access control rules.

2. Define the Domain Exclusion (ACL)​

You need to define an ACL to match the domains you want to exclude from SSL Bump in the proxy.

  1. To create an exclusion list, add a line for the domains you want to bypass the proxy. For example:

    acl no_bump_sites ssl::server_name_regex -i  .slack.com

    This creates an ACL named no_bump_sites that matches any requests going to slack.com or any of its subdomains (i.e., *.slack.com). If you want to exclude multiple domains, you can create a text file listing all domains to be excluded and reference it in the configuration file. For example:

    • Create a text file, /etc/squid/no_ssl_bump_domains.txt with the following content:

      .slack.com .example.com

    • Then reference this file in squid.conf like this:

      acl no_bump_sites ssl::server_name_regex "/etc/squid/no_ssl_bump_domains.txt"

3. Bypass SSL Bump in Proxy for Excluded Domains​

Next, add a rule to bypass the proxy for the domains defined in the ACL:

  1. Add this rule to the squid.conf file to allow traffic to bypass the proxy for the specified domains:

    ssl_bump splice no_bump_sites

    This tells Squid to skip SSL Bump for no_ssl_bump_domains directly.

4. Restart Squid Service​

After making changes to the configuration, restart Squid for the changes to take effect:

sudo systemctl restart squid

or

sudo service squid restart

5. Verify the Configuration​

To verify that the exclusion is working, you can check the Squid access logs:

tail -f /var/log/squid/access.log

You should see that requests to the excluded domains are bypassing the proxy.

Issues Outstanding​

1. Web Filtering​

  • Issue: Enabling the proxy breaks existing web filtering solutions.
  • Fix: Investigating Squid Guard (or another potential solution) to see if it supports content filtering.

2. Conditional Access​

  • Issue: Access to internal services (e.g., Azure/ADO) via Twingate requires the ICAP IP to be included in Conditional Access policies.
  • Fix: We've identified a way to add the proxy IP to our Conditional Access policies. Some access issues are still being investigated, and further testing is underway to ensure this configuration is correctly applied.