How to bypass proxy for Microsoft Update via Pac file

// Bypass for Microsoft Update domains 

 if (  shExpMatch(host, "download.microsoft.com") ||  shExpMatch(host, "ntservicepack.microsoft.com") ||  shExpMatch(host, "cdm.microsoft.com") ||  shExpMatch(host, "wustat.windows.com") ||  shExpMatch(host, "windowsupdate.microsoft.com") ||  dnsDomainIs(host, ".windowsupdate.microsoft.com") ||  shExpMatch(host, "update.microsoft.com") ||  dnsDomainIs(host, ".update.microsoft.com") ||  dnsDomainIs(host, ".windowsupdate.com") ||  dnsDomainIs(host, ".windowsupdate.microsoft.com") ||  dnsDomainIs(host, ".download.windowsupdate.com") ||  dnsDomainIs(host, ".prod.do.dsp.mp.microsoft.com") ||  dnsDomainIs(host, ".dl.delivery.mp.microsoft.com") ||  dnsDomainIs(host, ".delivery.mp.microsoft.com") ||  dnsDomainIs(host, "tsfe.trafficshaping.dsp.mp.microsoft.com") ||  dnsDomainIs(host, "ctldl.windowsupdate.com")  )  return "DIRECT";

How to bypass proxy for Microsoft Update via Pac file

Opnsense setup on Vmware ESXi 8.0 to running for proxy mode with one network card only

Requirement:

Setup a proxy appliance which is running on VMware ESXi 8.0 with one network card only

 

1. One VMware, select boot from ISO and also using FreeBSD 13.0 template
2. Create a self sign cert for SSL proxy (Go to "System -> Trust -> Authorities")
3. Select "Community Plug-in" to search for "os-squid"
4. After install this plug-in, you will able to go to "Web Proxy" to continue the proxy setup

 

 

Reference:

https://forum.opnsense.org/index.php?topic=36454.0

https://docs.opnsense.org/manual/how-tos/proxytransparent.html

https://forum.opnsense.org/index.php?topic=38734.0

https://docs.opnsense.org/manual/how-tos/self-signed-chain.html

https://forum.opnsense.org/English_Forums/General_Discussion/Web_and_Content_Filter

https://forum.opnsense.org/index.php?topic=7198.0

https://forum.opnsense.org/index.php?topic=22117.0

https://docs.opnsense.org/manual/how-tos/proxywebfilter.html

https://forum.opnsense.org/index.php?topic=42497.0

Opnsense setup on Vmware ESXi 8.0 to running for proxy mode with one network card only

How to remove the Azure AD Connect sync proxy setting to use direct Internet connection?

 Go to "C:\Windows\Microsoft.NET\Framework64\v4.x.xxxxx\Config\machine.config

Remove the following:

<system.net>

<defaultProxy>

<proxy_usesystemdefault="true" />

</defaultProxy>

</system.net>

How to remove the Azure AD Connect sync proxy setting to use direct Internet connection?

Azure AD Connect 2.0 change proxy setting

 1. Go to the program files -> Microsoft Azure Active Directory Connect -> To modify the file proxy config in the file "Microsoft.ApplicationProxy.Connector.Common.dll.config

2. Netsh winhttp set proxy "<proxy IP>"

3. Restart the service "Microsoft Azure AD Sync"

Then, you can run the powershell command >Start-ADSyncSyncCycle -PolicyType Initial 

To use the new proxy for the sync.

Azure AD Connect 2.0 change proxy setting

Skyguard Proxy support running on Tencent Cloud

 

Skyguard Proxy support running on Tencent Cloud

Using different proxy for individual broswering via broswer shortcut

Workaround solution:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -proxy-server="x.x.x.x:8080"

The same setting -proxy-server="Proxy IP:Proxy Port" also work for IE

Reference:

https://stackoverflow.com/questions/22033401/workaround-to-have-a-standalone-proxy-settings-for-chrome

Using different proxy for individual broswering via broswer shortcut

Sangfor SASE service

User activity log:

 

 

Block page:

 

 

Sangfor SASE service

O365 User failed to access another company O365 resource due to restrict access to a tenant (Azure AD Tenant Restrictions)

Azure AD Tenant Restrictions is a feature available for Azure AD customers which can be used to control the Azure AD tenants a user of an organization can access applications/resources in. It is applied by having a proxy service or similar service append additional HTTP headers for requests  sent to Azure AD which tell Azure AD which tenants are allowed for a user and which tenant to log the requests in. 

This setting impacts users of an organization when they access an application which is integrated with an Azure AD tenant.

Error message: Your network administrator has blocked access. External access is blocked by policy. Contact your IT department for access.

 

 

There are example of how to make change on your proxy:

Controlling Office 365 access using tenant restrictions on Edge SWG (ProxySG) or Advanced Secure Gateway.

https://knowledge.broadcom.com/external/article/169870

Restrict users to a specific Office 365 tenant via Forcepoint Content Gateway proxy

https://support.forcepoint.com/s/article/000017790 

Restricted SaaS access | FortiGate / FortiOS 7.4.1 | Fortinet Document Library

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/8049/restricted-saas-access 

["Restrict-Access-To-Tenants"] = "Your company tenant", "Your business partner tenant"

For example: Your company is abc.onmicrosoft.com and your business partner is hkea.onmicrosoft.com

Your configuration will be like the following:

["Restrict-Access-To-Tenants"] = abc.onmicrosoft.com,hkea.onmicrosoft.com

Reference: 

https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions

O365 User failed to access another company O365 resource due to restrict access to a tenant (Azure AD Tenant Restrictions)

Fireeye (Trellix) Network Security (NX) failed to reconnect (via proxy to connect Internet) when Cisco Umbrella (OpenDNS) traffic routed to another DC during schedule maintenance

Error message: 'Critical: 1# subscriber:OpenDNS is with http response code:502 details…..502 Bad Gateway

 

Check Cisco Umbrella Service status: there are schedule maintenance the traffic being re-routed to another DC.

https://status.umbrella.com/#/

 

Resolution:

 

Run CLI – 'show health system warning' and show fenotify healthcheck' to check the Details for subscriber status. Fix the subscriber

 

Run CLI – 'fenotify healthcechk recheck' fter fix the subscribers config and server

 

Fireeye (Trellix) Network Security (NX) failed to reconnect (via proxy to connect Internet) when Cisco Umbrella (OpenDNS) traffic routed to another DC during schedule maintenance

Sophos XG Firewall rules - Proxy - Direct mode only

Create a new service “Proxy”

TCP

Source Port 1:65535

Destination Port 3128

UDP

Source Port 1:65535

Destination Port 3128

Reference:

https://community.sophos.com/kb/en-us/125585

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/94552/how-can-i-set-up-web-access-via-proxy-port-only

https://community.sophos.com/kb/en-us/122802

https://community.sophos.com/kb/en-us/123522

Sophos XG Firewall rules - Proxy - Direct mode only

Allow Microsoft Windows Update (Windows 10) pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Add the following exclusion URL under Microsoft Windows Updates exception list:

^([A-Za-z0-9.-]*\.)?tlu.dl.delivery.mp.microsoft\.com/

^([A-Za-z0-9.-]*\.)?au.windowsupdate\.com/

^([A-Za-z0-9.-]*\.)? download.windowsupdate\.com/

Reference:

https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting

Allow Microsoft Windows Update (Windows 10) pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Allow Kaspersky Update pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Add the exceptions policy, ^([A-Za-z0-9.-]*\.)?geo.kaspersky\.com/

Reference:

https://support.kaspersky.com/6105

Allow Kaspersky Update pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Create firewall service for proxy only on Sophos XG Firewall (SFOS 17.1)

You need to Add TCP and UDP from ALL Source Port to Destination Port which is your proxy server for connect

Create firewall service for proxy only on Sophos XG Firewall (SFOS 17.1)

Sophos XG - SFOS 17.1.4 MR4 Released

If you are running on 17.1.3 MR3, please upgrade asap.

It fix many connectivity issues via proxy such as Windows 10 update failed, Kaspersky update failed…..

Since it just released, you need to download it manually.

https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-1-4-mr4-released

Reference:

https://community.sophos.com/kb/en-us/132229 

https://community.sophos.com/kb/en-us/123285

Sophos XG - SFOS 17.1.4 MR4 Released

Proxy.pac：自動組態設定檔/自動設定網址 Proxy Autoconfig save at local

Proxy.pac：自動組態設定檔/自動設定網址 Proxy Autoconfig save at local

Check your proxy for anonymity or what can be known about you on the Internet

https://www.megaproxy.com/freesurf/

http://www.freeproxy.ru/en/free_proxy/info_about_you.htm

http://checker.samair.ru/

https://www.ultravpn.fr/

http://www.stilllistener.addr.com/checkpoint1/index.shtml

Check your proxy for anonymity or what can be known about you on the Internet