# Configure a Proxy **URL:** \ **Category:** Network\ **Created:** [2 January 2024 12:28 UTC](https://community.ipfire.org/t/configure-a-proxy/10809 "2024-01-02T12:28:09Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![suschi](https://community.ipfire.org/user_avatar/community.ipfire.org/suschi/32/9247_2.png) [@suschi](https://community.ipfire.org/u/suschi)\ **Post date:** [2 January 2024 12:28 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/1 "2024-01-02T12:28:09Z")
Hello dear people, I have a question about the WebProxy. This is supposed to filter websites, control access, etc. To do this, I have to set the IP address of the IPfire with the port number, for example 192.168.3.1 and 800 port, in the client under proxy settings. So far so good and it works. If a user on the client deletes the proxy again, the filtering, access times etc etc are bypassed again, or not? On the client, the assignment of the IP address, gateway and DNS is assigned by the IpFire or should something be changed here? ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [2 January 2024 12:50 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/2 "2024-01-02T12:50:09Z")
> [@suschi](#): > > If a user on the client deletes the proxy again, the filtering, access times etc etc are bypassed again, or not? Yes, client settings are indeed beyond the direct control of the IPFire system administrator. However, you can enforce the use of the proxy at the firewall level. This can be done by blocking any direct access to the internet (the red interface) on standard web ports from your LAN. This way, only traffic passing through IPFire (the proxy) will be able to access the web. ![Screenshot 2024-01-02 at 13.40.15](https://community.ipfire.org/uploads/default/original/2X/e/e2559eab9271c14d73fb1754489be86deedf5026.png) Here, ‘web’ refers to a firewall group set up to manage these restrictions. ![Screenshot 2024-01-02 at 13.41.31](https://community.ipfire.org/uploads/default/original/2X/5/5b6ab7fe52fb6c44e2dbf86ae4005475968d50c4.png) > [@suschi](#): > > On the client, the assignment of the IP address, gateway and DNS is assigned by the IpFire Regarding your second point, yes, the assignment of IP addresses, gateways, and DNS settings to clients is managed by the IPFire DHCP server. For more information on configuring the DHCP server in IPFire, you can refer to the [IPFIre documentation.](https://wiki.ipfire.org/configuration/network/dhcp) ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [2 January 2024 12:57 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/3 "2024-01-02T12:57:59Z")
The mechanism for client configuring is called WPAD. ---
**Author:** ![sec-con](https://community.ipfire.org/user_avatar/community.ipfire.org/sec-con/32/15621_2.png) [@sec-con](https://community.ipfire.org/u/sec-con)\ **Post date:** [2 January 2024 13:37 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/4 "2024-01-02T13:37:46Z")
> [@cfusco](#): > > This way, only traffic passing through IPFire (the proxy) will be able to access the web. Sorry, wait what? How should I understand that statement, I have no Proxy, so is not all my traffic passing through IPFire? I know the cables most certainly are… the only traffic not passing through IPFire, that I can easily assume, is the traffic to Mobile Networks, like 4G and 5G. ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [2 January 2024 13:41 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/5 "2024-01-02T13:41:53Z")
> [@sec-con](#): > > I have no Proxy, so is not all my traffic passing through IPFire? yes, your traffic is passing through the RED interface of IPFire. If you set up a proxy and you want all your clients to use the proxy, the rule I suggested will block any access to the RED interface USING PORTS 443 and 80 (see message below). In this case, the only option that remains to access the RED interface from within the LAN would be through the proxy. ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [2 January 2024 13:46 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/6 "2024-01-02T13:46:49Z")
To clarify: We are talking about **web access** ( HTTP / HTTPS ). The FW rule inhibits direct conversation of a client with a web server in the WWW. All other traffic is neither affect by the rule nor this thread. ---
**Author:** ![suschi](https://community.ipfire.org/user_avatar/community.ipfire.org/suschi/32/9247_2.png) [@suschi](https://community.ipfire.org/u/suschi)\ **Post date:** [2 January 2024 19:22 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/7 "2024-01-02T19:22:56Z")
wow, you’re brilliantly fast again 🙂 Now I understand it and it works as it should. I wasn’t aware of the last little step, but it was actually logical. TOP, thank you for that ---
**Author:** ![suschi](https://community.ipfire.org/user_avatar/community.ipfire.org/suschi/32/9247_2.png) [@suschi](https://community.ipfire.org/u/suschi)\ **Post date:** [3 January 2024 10:25 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/8 "2024-01-03T10:25:32Z")
Hello dear people, the proxy runs as far as uspoer with URL filter etc etc. Only Outlook doesn’t want to come out ☹ I have adjusted the permitted and TLS ports but somehow it doesn’t work. Should I create an extra firewall rule? Here are the ports that I set in the proxy settings: 80# http 21 # ftp 443 # https 563 # snews 70# gopher 210 #wais 1025-65535 # unregistered ports 280 # http mgmt 488 # gss-http 591 # file maker 777 # multiling http 800 # Squids port (for icons) 993 # IMAPs 587 # SMTP 465 # ssmtp and TLS: 443 # https 563 # snews 993 # IMAPs 587 # SMTP 465 # ssmtp Thank you again in advance 🙂 ---
**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\ **Post date:** [3 January 2024 22:55 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/9 "2024-01-03T22:55:24Z")
Unfortunately, this has always been a big issue. The firewall rules mentioned by @cfusco block all traffic that doesn’t go through the proxy. However, the IPFire proxy only works for the web browser (or for all programs that “mimic” the web browser, http or https, regardless of whether the remote server uses the standard ports or not.). To better understand, if you ‘free up’ port 563 in the proxy, all that you authorize is this: [http://www.example.com:563/](http://www.example.com:563/) [https://www.example.com:563/](https://www.example.com:563/) It’s obvious that Outlook doesn’t work. And it never will until you create firewall rules that “open a passage” for Outlook and all the services you want to work. (Outside of http and https). The ports you mentioned need to be opened in the firewall rules, not in the proxy. And the rules for opening these ports should come before the rules mentioned by @cfusco. If a firewall rule is valid, all the rules that follow are not executed. That’s the logic. I am willing to help 😉 😊. ---
**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\ **Post date:** [3 January 2024 23:00 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/10 "2024-01-03T23:00:28Z")
Of course, it is important to consider that an ‘excessive use of firewall rules that open’ can compromise the functioning of the proxy. For instance, if you open port 80 in the firewall rules, the web filter might become ineffective. (In this case, if you remove the proxy from the client, you would be able to browse, only on port 80). Therefore, it’s advisable to only open what is necessary. It’s important to strike the right balance between openness and closure. The possibilities are endless. I’ll mention some examples: 1. You can set a firewall rule to ‘exempt from the obligation of using the proxy’ one or more groups of IPs from the green, blue networks. 2. It is possible to “free” only the pop3 service port. 3. The combination of 1 and 2. 4. And much more. Think carefully about what you want to do. I believe I can help you ‘translate into firewall rules’ your decision. 😉 I think this can be helpful for you: > [@Problems with url filter](https://community.ipfire.org/t/problems-with-url-filter/9458): > > I select the categories for filter, for example, violence, drugs, and porn, and the other options, so when I search a site with porn and entering the page, this content is not blocked, and I don’t understand this, because I follow the steps for create a filter for urls. How can we block content permanently? I’m following the URL filter config and the Web proxy config but nothing seems to work. Good job 😊. ---
**Author:** ![casabenedetti](https://community.ipfire.org/user_avatar/community.ipfire.org/casabenedetti/32/16594_2.png) [@casabenedetti](https://community.ipfire.org/u/casabenedetti)\ **Post date:** [4 January 2024 00:44 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/11 "2024-01-04T00:44:01Z")
![regola](https://community.ipfire.org/uploads/default/original/2X/3/3ee1c50a46290480feede02fc8396f71558d1f55.png) This rule (which must precede the rules mentioned by @cfusco) ‘frees up’ a group of ports, previously configured under ‘service / service groups.’ Remember to apply the changes every time you create/modify a firewall rule by clicking on the green button that will appear at the top after saving the new rule. ---
**Author:** ![suschi](https://community.ipfire.org/user_avatar/community.ipfire.org/suschi/32/9247_2.png) [@suschi](https://community.ipfire.org/u/suschi)\ **Post date:** [4 January 2024 10:15 UTC](https://community.ipfire.org/t/configure-a-proxy/10809/12 "2024-01-04T10:15:19Z")
Thanks again for the quick tips, I have added a firewall rule to the clients it concerns where only these ports are open. Of course that’s how it works.