Proxy Functionality

Proxy Overview
The Sambar Server proxy functionality allows many computers on a local network to connect to the Internet from a single (dynamic) IP address. The Sambar Server proxy also provides limited firewalling of the local network systems from the Internet. Note: Attacks based on IP spoofing can penetrate the Sambar Server proxy (in a limited fashion). Packet routing must be used in addition to the Sambar Server to prevent access through the IP network layer.

The Sambar Server proxy functionality includes the following:

Proxy server for HTTP, HTTPS, FTP (via HTTP)
Gateway for SMTP, POP3 and IMAP4
IP address security filtering of connections
Remote-proxy utilization (ISP caching proxy)

If your ISP provides a high-performance caching proxy which you wish to take advantage of, the Sambar Server proxy can be configured to utilize your ISP's proxy for HTTP and HTTPS requests. The Remote Proxy configuration entry can be used to directy Sambar Server proxy requests via your ISPs proxy. Remote Proxy must be left blank if you are not using your ISPs proxy. The Remote Proxy feature is not available for FTP at this time.

Lastly, the Sambar Server proxy provides no caching. All HTTP requests are passed through without interpretation or modification.

TCP/IP Configuration
To use the Sambar Server proxy functionality, all hosts must be configured with TCP/IP. In addition, DNS and network routing must be properly configured among machines. Contact your System Administrator or network consultant with questions on network setup.

Client/Browser Configuration

Netscape Version 2 & 3

Open the Netscape Navigator Web Browser.
Select the Options menu.
Select the Network Preferences menu item.
Click the Proxies tab.
Select Manual Proxy Configuration radio button and click the view button.
Type <your machine> in the HTTP Proxy: field and 80 in the port field.
Type <your machine> in the Security Proxy: field and 80 in the port field.
Type <your machine> in the FTP Proxy: field and 80 in the port field.
Type <your machine:80> in the No Proxies for: field.
Click the OK button to close the dialog box

For Netscape Version 2 only:

Open the Options menu.
Select the Save Options menu item.

Microsoft Internet Explorer Version 3

Open the Microsoft Internet Explorer Web Browser.
Open the View menu.
Select the Options menu item.
Click on the Connection tab.
Select Connect through a proxy server.
Click on the Settings button.
Type the following settings in the Servers section:
```
HTTP:   <your machine> 	Port:	80
```
Leave all other field blank.
Click the OK button to close the Proxy Settings dialog box.
Click the OK button to close the Options dialog box.

Lastly, if your clients are using the Sambar Proxy Server as well as the Sambar HTTP Server, they must configure the No Proxy for: field of their browser to the Sambar HTTP Server, port 80.

Mail

SMTP, POP3 and IMAP4 messages can be forwarded to their respective servers via the Sambar Server. The Sambar Server must first be configured with the appropriate Internet servers (via the browser-based administration interface). Once configured, your mail client must be configured to contact the Sambar Server for SMTP, POP3 and/or IMAP4 requests. In essence, your client mailer believes that the Sambar Server is its mail server (while mail is transparently forwarded via the Internet to the real server (typically on your ISPs machine.

The Sambar Server does not act as a native SMTP server. SMTP is not suitable for dial-up lines because computers working as SMTP servers must have a permanent/full-time connection to the Internet to receive e-mail (dynamic IP addresses are not appropriate), and SMTP servers are responsible for message delivery including store and forward should be destination be unreachable for some period.

Dial-on-Demand (available 12/97)
The Sambar Server can establish dial-up connections to your ISP via the Dial-on-Demand configuration parameter. If configured, the server attempts to connect to your ISP when a requested host is unknown on the local area network (your must have an understanding of DNS to properly route local traffic).

The dial-on-demand configuration allows the user to configure the phone number, username, password and domain to use when connecting via the RAS interface. In addition, a timeout period is defined allowing the dial-up connection to be dropped after a fixed period of inactivity. Note: This feature has only be tested to work with PPP connections.

security.ini

The HTTP proxy server includes IP security filtering. By default, this security filtering restricts HTTP proxy access to IP addresses in the range 140.175.165.0 to 140.175.165.255. You will receive a FORBIDDEN message if you attempt to connect via the HTTP proxy server from a machine other than one in this range. You should change the [proxyaccept] filter to one appropriate for the machines that will be accessing it.

FTP Proxy

When a browser is told to use a server/port for FTP proxy, it bundles its FTP request in an HTTP stream and forwards it on to the proxy. The browser expects all communication with the proxy to take place in HTTP/HTML. The proxy then translates the request into FTP commands. So the communcation looks like:

browser --> [http + ftp header] PROXY --> [ftp] FTP-Server

When no proxy is specified, the browser issues FTP commands directly to the server:

browser --> [ftp] FTP-Server

This differs from the HTTP proxy stream which is a "simple" passthrough mechanism:

browser --> [http + proxy header] PROXY --> [http] HTTP-Server

In the HTTP proxy case, only the initial proxy header directive is manipulated and then a virtual circuit is formed between the browser and the server for all subsequent communication. The stream ends when either side fails to communicate within the Network Read Timeout duration configured in the server.

In the FTP proxy case, the server must translate HTML requests into FTP requests (effectively writting an FTP client for the middle tier). This is considerably more complex code and more error prone.