Censornet - internet filtering on your terms

Wpad issues

July 19, 2011 • Customer Services       

Synopsis

Article

We discovered a security feature in the Microsoft implementation of DNS that can lead to clients being unable to look up the IP address of the A record for wpad in their local domain, even after their administrator had created the record on the server. It is there for a reason. A malicious user can connect a computer called wpad to a domain and because a Microsoft client can register itself to a DNS domain on connection, such a malicious user could then send all the browsers on the domain to a false proxy.

The problem then comes when you are setting up a legitimate proxy server such as the CensorNet on your network and configure it as a wpad server so that your users need not enter the proxy details into their browser. The feature causes the DNS server to refuse to supply the answer to a look up for wpad. You have to disable the global query block list, or configure it so that it does not block a look up for wpad on the domain. After this things should work as defined. You can find instructions for configuring Active Directory Server 2008 here and Active Directory Server 2003 here.

Related articles