How do I allow a remote laptop user to use the WebMarshal proxy server?

This article applies to:

• WebMarshal

Question:

• How do I allow a remote laptop user to use the DMZ public WebMarshal proxy server address?
• Users who take laptops home have proxy connection issues

Procedure:

Trustwave does NOT recommend allowing client connections to the WebMarshal proxy from the public internet.

The following options are available:

Recommended Options:

• Have the remote users connect to the company network via VPN, and specify the IP addresses that the VPN server could allocate in the WebMarshal Local Address Table.
  
  • Note: This is the recommended workaround, and security conscious organizations are likely to have a VPN already configured.
• Educate laptop users on how to manually change the browser or system proxy settings so that they do not use the proxy when out of office.
  
  • In current Windows versions, see Settings > Network & Internet > Proxy

Valid Options that are not supported by Trustwave Technical Support:

• Develop a desktop batch file/script/registry file that laptop users can execute to change the settings.
  
  • One file to check the 'Use a Proxy Server for you LAN' option, and one to uncheck the same option

Notes:

In order to use WebMarshal as the Proxy server for the network, all workstation proxy settings must point to the WebMarshal server.  The problem manifests itself when laptop users connect to the LAN from an internal point on the network during the day at work, and then connect to the Internet outside the office, via an ISP without a VPN connection to the company's LAN.  At this point, the proxy settings are still referencing the internal name or IP address of the WebMarshal server.  The server IP address will resolve fine if the WebMarshal server is in the DMZ, but the end user will not be able to browse the Internet.  The web browser will get a 'Website not found" error message.

In this situation, we do NOT recommend opening firewall and the Local Address Table of WebMarshal to accept connections from all addresses.  This will allow the WebMarshal machine to accept connection attempts from any address, including unwanted connections. 

• Opening access freely can result in Denial of Service attacks and other security issues.

This article was previously published as:

NETIQKB35624