Generic Forward Proxy with Websense Filtering iApp

Problem this snippet solves:

This iApp implements a simple anonymous HTTP (CONNECT) or SOCKS 4/4a/5 foward proxy virtual server, and supports the following features:

  • Support for Websense content filtering
  • Menu-driven proxy autoconfiguration file generation
  • Simple network-based restriction of proxy use
  • Control of allowed ports-per-protocol
  • Support for dynamic FTP PASV mapping
  • Simple name resolution caching from a pool of configured DNS resolvers
  • Informative error pages
  • Extended enforcement of SSL blocking through confirmation of Server Name Indication

The Websense support is delivered through use of a sideband connection over which we speak natively to a Websense server that's configured to run (at minimum) the Filtering Service. This iApp supports sending queries from the forward proxy VS to a pool of Websense servers.

The iApp is supplied with a complete help menu; make sure to read it thoroughly.

Code :

45216
Published Mar 11, 2015
Version 1.0
application delivery
devops
iApps
LTM
  • YuvarajaK_17090's avatar
    YuvarajaK_17090
    Icon for Nimbostratus rankNimbostratus
    Jun 24, 2015
    HI Support team, I am getting attached error while creating an IAPP using this tempate, is any one can help on this. Error: not able to type complete error here. script did not succsfully complete cant read"proxy__Proxy $tr_large" no such a variable Regards, Yuvaraja K
  • brad_11480's avatar
    brad_11480
    Icon for Nimbostratus rankNimbostratus
    Jul 09, 2015
    Thank you so much for sharing this iApp. It is showing promise to provide a proxy for a special situation here where we need to provide a method for Skype clients to 'get around' our IronPort (Cisco WSA) web proxy. It has tested well as a socks5 proxy for my web browsers but it doesn't seem to click in when the skype client is configured for socks5. I brought up the HTTP proxy and that is showing much more promise and we will be testing further today. A few questions as perhaps someone else has gone down this path before... 1. Anyone had experience using the socks5 proxy for Skype or similar video clients? 2. Is there any plans to provide authentication for the proxy? It would help. I may tag source IP or may setup a 'side' authentication page to authenticate/validate the client IP to use the proxy but it would be nice if the authentication method within the proxy could be used. 3. Plans for adding UDP for socks5? Thanks again.
  • Jason_Drake_204's avatar
    Jason_Drake_204
    Icon for Nimbostratus rankNimbostratus
    Nov 05, 2015
    I can get this Forward Proxy to work fine with the Common partition, but when I use another partition and create a 2nd forward proxy, I seem to get DNS issues. First, I copied the f5.forward.proxy iapp to the new partition, and have configured the iapp for our new Virtual server/ IP/ Allowed networks/Snat, etc. When I run the proxy I get "DNS Resolution failed for hostname" google.com" Anyone else have success creating 2 forward proxies on 2 partitions?
  • cjmalon_145830's avatar
    cjmalon_145830
    Icon for Nimbostratus rankNimbostratus
    Nov 30, 2015
    Hi, Is anyone able to confirm that this works in a non default route domain, my Packet Captures show 503 Service Unavailable messages being sent from the Proxy to the client after the DNS has resolved the IP address, just wondering if the proxy sees the IP addresses returned by DNS not being in the default route domain.
  • Jason_Drake_204's avatar
    Jason_Drake_204
    Icon for Nimbostratus rankNimbostratus
    Mar 11, 2016
    Not sure if this is a bug, but we have this forward proxy iapp in an HA pair and when we failed over to the standby unit, the IAPP mysteriously stopped working. We had to rebuild the IAPP on the failover unit for it to work again. Also tested failing back and that worked.
  • brad_11480's avatar
    brad_11480
    Icon for Nimbostratus rankNimbostratus
    Apr 19, 2016
    There is a known issue, ID471288. It is a problem caused from having both CLIENT_CLOSED and SERVER_CLOSED on any single virtual server's iRules. It results in tmm crash. We are using this iApp and it has worked well for a Skype Proxy that was required-- we don't permit general use of Skype. I have to move this to a non-production F5 as we have had a service interruption that seems to stem from the iApp..
  • Eric_Marquez_25's avatar
    Eric_Marquez_25
    Icon for Nimbostratus rankNimbostratus
    Apr 27, 2016
    is there a way to configure this so it can be a proxy auth? I just need a simple username/password auth, this can be static.