ntlm authentication

[Pascal]

You can leave the proxy running on port 3128. Simply add an intercept on port 80. Will have to think about the other one.

Do you need actual authentication or will people be connecting from a trusted range of IPs ?

[inthesands]

I need actual authentication, as some people will be with changing Ip's.

So it would create a 2 fold security. Get through the firewall first, before authentication with the internal NT server.
I'm not sure if this is possible.


However, what about if from known fixed external IP?

[inthesands]

Regarding having now setup basic authentication, with user can be assumed,
how do I get wingate to NEED to authenticate some users, while others (like myself) WOULD NOT need to be authenticated.

[Pascal]

Do you move from IP to IP as well? You can use the user assumptions ? (Combined with basic auth, having an assumption by IP)

[inthesands]

Ah ha, forgot about the assumed IP.
That works perfectly

[inthesands]

Now, I have got the authentication working well, for my internal users.

BUT,

I have setup the www proxy to redirect non proxy request to my internal www server. Now, when external clients connect from the internet, they also have to authenticate. How do I get around this?

OR
should I setup port 80 to ONLY service external requests to my www server, and setup another port eg 8080 to service my internal IE clients?

Surely, if I just open up the port, I am again vulerable.

[Pascal]

If your WWW Server is in the DMZ, you should not need to bind your WWW Proxy to the external address. The redirection should be handled by normal routing, I believe.

[inthesands]

That doesn't work. If I don't have a port 80 bound to an external NIC, how can I service www requests to the DMZ?

[Pascal]

You will have to open a hole externally, to let the traffic in - then use routing as Adrien describes in the post he just made under the DMZ topic. (The static routes, from yesterday?)

[inthesands]

I cannot get www proxy with pipe non proxy requests to work, and have authentication on.

I can only have it setup on port 80, redirect non proxy to my internal www server, with no authentication. Then outside users can get my web page.

I had to set up a new www proxy service, I chose port 3128, for internal users, then I can get the internal users authenticated.