# Excel Web Query not working through Proxy ANYMORE

**URL:** <https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339>\
**Category:** Web Proxy, URL Filter & Update Accelerator\
**Created:** [31 July 2022 08:15 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339 "2022-07-31T08:15:21Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\
**Post date:** [31 July 2022 08:15 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/1 "2022-07-31T08:15:22Z")

</div>

Hello,  
Suddenly (from one day to another!) my Excel files containing web queries stopped with a message that Can’t reach Internet, Page not available and other sort of messages indicating a network problem.

After going in Control Panel, Internet Options, LAN Settings and removed the Automatically detect settings, everything works file, (transparent proxy is still on but because destinations are HTTPS, these don’t get caught)

 ![image](https://community.ipfire.org/uploads/default/original/2X/5/5390893db6bcfb07643eff8f1c44f0ff77cbb54f.png)

 ![image](https://community.ipfire.org/uploads/default/original/2X/9/9a01b4c8d5771933df566368fff178eb7dedc163.png)

Here are my DHCP settings and my wpad.dat file - very straight forward to send my Blue clients through proxy

 ![image](https://community.ipfire.org/uploads/default/original/2X/5/5930f14a6049c7539e510dcde4fb37e6e88537b9.png)

```auto
function FindProxyForURL(url, host)
{
if (
     (isPlainHostName(host)) ||
     (isInNet(host, "127.0.0.1", "255.0.0.0")) ||
     (isInNet(host, "192.168.GREEN.0", "255.255.255.0")) ||
     (isInNet(host, "192.168.BLUE.0", "255.255.255.0")) ||
     (isInNet(host, "192.168.GREEN.0", "255.255.255.0")) ||
     (isInNet(host, "169.254.0.0", "255.255.0.0"))
   )
     return "DIRECT";

 else

if (
     (isInNet(myIpAddress(), "192.168.GREEN.0", "255.255.255.0")) ||
     (isInNet(myIpAddress(), "192.168.VLAN1.0", "255.255.255.0")) ||
     (isInNet(myIpAddress(), "192.168.VLAN2.0", "255.255.255.0"))
   )
     return "PROXY 192.168.GREEN.x:800";

 else

if (
     (isInNet(myIpAddress(), "192.168.BLUE.0", "255.255.255.0"))
   )
     return "PROXY 192.168.BLUE.y:800";
}

```

While Internet Explorer LAN Settings use Automatic Detect settings I get such messages for **ANY** page I try to access. Example for [Xe Currency Converter - Live Exchange Rates Today](https://www.xe.com/currencyconverter/)

 ![image](https://community.ipfire.org/uploads/default/original/2X/f/ff7da73b3063ba5fad5ee21bf36cdd4d7bf9c519.png)

There is not a singe error message in `/var/log/messages`. And all blocks from `/var/log/squidGuard/urlfilter.log` are NOT for the forex pages I tried

And, to make thing more confusing, SQUID logs shows me ONLY 200 answers I got when opening the page in Browser - or at least this is what I think (that only Browser access got logged while Excel Web Query did not)!!!

```auto
cat /var/log/squid/access.log | grep onlinetrading-fx.com
1659254757.499 518 192.168.11.15 TCP_MISS/200 5953 GET http://www.onlinetrading-fx.com/en/saxobank.htm - HIER_DIRECT/50.87.253.35 text/html
1659254757.742 190 192.168.11.15 TCP_MISS/200 6734 GET http://www.onlinetrading-fx.com/Template1_files/logo2.jpg - HIER_DIRECT/50.87.253.35 image/jpeg
1659254758.050 447 192.168.11.15 TCP_MISS/200 7707 GET http://www.onlinetrading-fx.com/en/bg1.gif - HIER_DIRECT/50.87.253.35 text/html
1659254758.266 189 192.168.11.15 TCP_MISS/200 1240 GET http://www.onlinetrading-fx.com/favicon.ico - HIER_DIRECT/50.87.253.35 image/x-icon
1659254767.583 376 192.168.11.15 TCP_MISS/200 1230 GET http://www.onlinetrading-fx.com/currencyrates.html - HIER_DIRECT/50.87.253.35 text/html
1659254767.827 194 192.168.11.15 TCP_MISS/200 1485 GET http://www.onlinetrading-fx.com/1140161191_1526_easy_forex_site/ef_files/forex.css - HIER_DIRECT/50.87.253.35 text/css
1659254768.008 372 192.168.11.15 TCP_MISS/200 2210 GET http://www.onlinetrading-fx.com/1140161191_1526_easy_forex_site/ef_files/rates_02.gif - HIER_DIRECT/50.87.253.35 image/gif

```

**Where should I look to find what is wrong with proxy? Again, transparent proxy is ON but since this is and HTTPS destination this does not get caught.**

URL filter Settings:

 ![image](https://community.ipfire.org/uploads/default/original/2X/a/afb8a13b1c6f4aba0d6149ad5cba7f082ee8e4fb.png)  
 ![image](https://community.ipfire.org/uploads/default/original/2X/9/92135bcfd36a78fc64034501d1315e7c27f9bd05.png)

---

<div class="post-metadata">

**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\
**Post date:** [1 August 2022 12:08 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/2 "2022-08-01T12:08:23Z")

</div>

If there is nothing in the IPFire logs at all then maybe nothing is getting to IPFire.

I would check what is in the logs on the client machine trying to send the requests.

Were there any OS updates that were implemented overlapping with the stopping working from one day to the next.

---

<div class="post-metadata">

**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\
**Post date:** [1 August 2022 13:14 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/3 "2022-08-01T13:14:40Z")

</div>

Let’s think a bit through, shall we?

OS updates - with or w/o them, Excell can reach any site as long as Automatic proxy detection (or WPAD) is off.

So we can rule out the OS updates

But we can’t rule out the elephant in the room which is WPAD - while that is on (for whoever is Not familiar with it - it uses both DHCP option 252 and DNS queries to WPAD.domain suffic where domain suffix is what machine has set) the Win OS gets blocked to reach the site if client = Excel, and works for same site if client = Chrome or Edge browser.

Turning of WPAD on Windows , all clients in Win OS can reach that site - Excel included.

I also turned off Suricata just to be sure - is not Suricata that blocks the traffic.

So: back to my question : what inside the proxy blocks a certain web client (Excel uses old IE libraries) to reach ANY Internet page??

Windows WPAD: [Internet Explorer WPAD Diagnostic - Browsers | Microsoft Docs](https://docs.microsoft.com/en-us/troubleshoot/developer/browsers/general/ie-wpad-diagnostic)

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [1 August 2022 13:33 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/4 "2022-08-01T13:33:13Z")

</div>

Haven’t read the cited MS doc fully, there came another fact to my mind.  
Some time ago there was a problem with the WPAD script on Mozilla Firefox. It was caused by a miscalculation of `myIpAddress` . If direct web access is prohibited by the firewall, a `DIRECT` result ( or none ) of the function results in a blocked request.

Just a further search suggestion.

---

<div class="post-metadata">

**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\
**Post date:** [1 August 2022 15:26 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/5 "2022-08-01T15:26:11Z")

</div>

Not holding.  
With WPAD on I can access internet from so many clients: Edge, Chrome, curl, on more than one Windows OS.

And since WPAD.dat is the same, we can conclude that is an proxy problem JUST FOR EXCEL CLIENT (aka Web Query client using old IE libraries for Internet access).

Does anybody know where proxy keeps filter for UA? (I.e. USER AGENT)

Thanks!

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [1 August 2022 15:34 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/6 "2022-08-01T15:34:44Z")

</div>

Does Excel use the system settings or does try to detect at its own?  
The script file is interpreted on the client, either by the OS or the application.

Can you see any messages in the log files given on the MS page?

---

<div class="post-metadata">

**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\
**Post date:** [1 August 2022 16:56 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/7 "2022-08-01T16:56:43Z")

</div>

Native Win apps (Excel web query) ALWAYS use OS helpers - this is Windows world!  
So WPAD is an OS agent (or whatever is its right name), and all native apps ask it to provide proxy settings

More: since Web Query is using IE, then IE is the one that asks WPAD to provide the current proxy.

Please read MS Documentation or trust me that Excel Web Query uses proxy if in Control Panel, Internet Options, Lan settings is activated Automatic Detect Settings - that turns WPAD ON

Here is Windows implementation for WPAD

> **[WinHTTP AutoProxy Support - Win32 apps](https://docs.microsoft.com/en-us/windows/win32/winhttp/winhttp-autoproxy-support)**
>
> To ease the configuration of proxy settings, WinHTTP 5.1 implements the Web Proxy Auto-Discovery (WPAD) protocol, also known as autoproxy.

And this one : winhttp.h

> **[WinHttpGetProxyForUrl function (winhttp.h) - Win32 apps](https://docs.microsoft.com/en-us/windows/win32/api/winhttp/nf-winhttp-winhttpgetproxyforurl)**
>
> Retrieves the proxy data for the specified URL. (WinHttpGetProxyForUrl)

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [1 August 2022 17:25 UTC](https://community.ipfire.org/t/excel-web-query-not-working-through-proxy-anymore/8339/8 "2022-08-01T17:25:40Z")

</div>

Did you look in the logs of the **client** machine?  
Can you trace the request per wireshark, on the client?
