Copyright: Copyright ©1995-1999 Grok Developments Ltd.


Contents

Topic Not Found.

The Help Topic you selected could not be found in the help file. Please report this problem to Grok, either by e-mail to support@grok.co.uk or by fax on +44 20 8547 2305.

Grok Developments Ltd

103 Acre Road	Tel: +44 20 8547 2304

Kingston-Upon-Thames	Fax: +44 20 8547 2305

Surrey	Web: www.grok.co.uk

KT2 6ES

ENGLAND


Introduction and Overview

NetProxy is a proxy server and firewall system for Windows 95, 98 or Windows NT. It allows many users to access the Internet simultaneously using a single connection of almost any kind (modem, ISDN, ADSL, cable-modem, leased-line, etc.). NetProxy can be run on any PC with an Internet connection, it does not need a dedicated computer.

The proxy server is the part of NetProxy that allows many computers on your network to share a single IP connection to the Internet. The firewall is the part that regulates which Internet sites people on your network can connect out to and which, if any, sites on the Internet can initiate connections to the computers on your network.

Internet applications communicate using the TCP/IP protocol suite, so you must install the TCP/IP networking protocol on each of the computers on your network that you wish to provide Internet access to.

Each of your computers must be assigned an IP address that is unique on your network. You can manually enter an IP address for each computer, or you can use NetProxy’s built-in DHCP server to automatically assign suitable addresses. The IP addresses assigned to your computers do not need to be provided by your Internet Service Provider or registered with InterNIC because NetProxy effectively 'hides' these IP addresses from the Internet. The section "Configuring TCP/IP on your network computers" explains how to set up your network for use with NetProxy.

If you have a dial-up modem or ISDN connection to the Internet, you can configure NetProxy to automatically dial your Internet Service Provider when one of the computers on your network tries to connect to the Internet, and to drop the line when nobody is using the Internet. This ensures that any telephone or connect time charges are kept to an absolute minimum.


Introduction and Overview

Configuring the NetProxy PC

NetProxy runs on Windows 95, Windows 98, or Windows NT (version 4.0 or later, including Windows 2000). However, the computers on your network that connect to the Internet via NetProxy can be running any operating system that supports TCP/IP. This includes Windows for Workgroups (with the Microsoft Winsock TCP/IP protocol stack), Windows 95, 98, NT, or Windows 2000, IBM OS/2, any variety of UNIX (of course!), and Apple Macintosh computers.

The computer that is to run NetProxy must have a correctly configured TCP/IP connection to the Internet. If you currently use the computer on which you have installed NetProxy to access the Internet without problems, then you can safely assume that your connection is correctly configured.

After ensuring that the computer running NetProxy has a working connection to the Internet, you need to install the TCP/IP protocol for the network card and assign it a unique internal IP address so that NetProxy can relay information from the Internet to the other computers on your network. To do this, follow the steps in the section entitled Installing TCP/IP for the Network Interface on your NetProxy PC.

After you have installed TCP/IP on your NetProxy PC, you should configure the services you wish to provide to your network users. The simplest method of doing this is to use the NetProxy Configuration Wizard. Alternatively, detailed instructions for manually configuring individual services are provided in the section entitled Configuring NetProxy Services.

Dial-Up Connections

If your connection to the Internet uses Windows dial-up networking (DUN), as is the case with most modem or ISDN connections, then you should check the following option to ensure that NetProxy retains full control of your dial-up connection:-

NetProxy server PC with Internet Explorer 4 installed:-

•	Start the Windows Control Panel application, and display the properties for “Internet”.

•	Select the “Connection” tab and click the “Connect to the Internet using a local area network” option.

NetProxy server PC with Internet Explorer 5 installed:-

•	Start the Windows Control Panel application, and display the properties for “Internet Options”.

•	Select the “Connections” tab and click the “Never dial a connection” option.


Installing TCP/IP for the network interface on your NetProxy PC

To install and configure the TCP/IP protocol for the network card in your NetProxy computer, follow the steps below:-

1. Install the TCP/IP protocol for your Network Card

•	Start the Windows Control Panel application and select the ‘Network’ properties.

•	Highlight your Network card in the list of network components and click ‘Add..’.

•	Select ‘Protocol’ to add a new protocol for your Network card and click ‘Add…’.

•	Under the ‘Manufacturer’ list, select Microsoft, and select TCP/IP from the ‘Network Protocols’ list.

•	Click OK to install TCP/IP.

2. Configure the properties for TCP/IP

IP Address and Subnet Mask:

•	Highlight the newly installed protocol (shown as ’TCP/IP -> Your network adapter name’) and click the ‘Properties…’ button to configure the protocol.

•	Under the ‘IP Address’ tab, select the ‘Specify IP address’ option and enter 192.168.0.1 for the IP Address, and 255.255.255.0 for the subnet mask. (This assumes that you are using the private IP address space of 192.168.0.0/24, which we recommend).

Other options

You should leave all other options for TCP/IP at their default settings.

Click OK to save the settings, and click OK to close the Network settings dialog. You may be prompted to enter your original Windows CD-ROM or installation disks, so that Windows can install the necessary components for TCP/IP.

Restarting your computer will complete the installation.


Using the Configuration Wizard

NetProxy includes a configuration wizard that will securely configure a ‘typical’ NetProxy setup. If you are following the instructions in this help file to configure TCP/IP on your network, or if you are unfamiliar with TCP/IP networking concepts or are unsure about the security implications of using NetProxy on your network, the configuration wizard will do the work for you!

To start the configuration wizard, click the ‘toolbox’ icon.

This will display a dialog box similar to this:-

If your Internet Service Provider is listed in drop-down box, selecting it will preset the ISP server details. If your provider is not listed, manually enter as much information as you have about your service provider under the “ISP Server Details” section.

If you wish to use NetProxy over a dial dial-up connection, select the “Connect to the Internet using a modem or ISDN adaptor” option and click on settings to enter the details for your dial-up account.

If you are using a cable modem, or direct network connection, select the “Connect to the Internet using a local area network” option.

Select the ‘Configure…’ button to configure NetProxy. Any previous NetProxy settings will be overwritten with the new details.

What the Configuration Wizard Does

The configuration wizard makes several assumptions about how you plan to use NetProxy. Unless you have a particularly complex or unusual network setup, these assumptions will be correct. In any event, the changes made by the configuration wizard will in no way affect the availability or performance of other applications on your network.

The services configured by the configuration wizard are as follows:-

•	Firewall. The firewall will be configured to permit connections to NetProxy from your network only (IP addresses 192.168.0.0 to 192.168.0.255). No restrictions are imposed on which sites your network can connect out to.

•	DHCP Server. The DHCP server will be configured to allocate IP addresses in the range 192.168.0.2 to 192.168.0.254 to the machines on your network. Assuming you followed the instructions under the topic Installing TCP/IP for the network interface on your NetProxy PC, this will be the correct range for your network.

•	WWW Proxy. The WWW proxy service is enabled with caching set to expire HTML documents after 72 hours, and non-HTML files (such as images) after 120 hours. If you enter the name of your ISP’s Caching WWW Proxy Server, this will be configured as a downstream server.

•	FTP Gateway. The FTP gateway service will be enabled on port 21.

•	Telnet Gateway. The Telnet gateway service will be enabled on port 23, no password will be configured for the supervisor commands.

•	Socks Gateway. The socks server (which handles SOCKS v4, v4a and v5 requests) is enabled on port 1080.

•	DNS Server. If a “Primary DNS Server IP” was entered, DNS forwarding is enabled to the address specified.

•	RealPlayer.  The RealPlayer proxy service is enabled on port 1090.

•	POP3 (incoming mail).  The POP3 gateway is installed on port 110. If a “POP3 server name” was entered, this will be configured as the default remote POP3 server.

•	Port Mapping. If enough details were provided, port mapping entries are added for SMTP (outgoing mail), NNTP (usenet news), and ICQ.

•	Dial On Demand. The dial-up network settings are configured as per the details provided to the configuration wizard.


Introduction to Configuring NetProxy

NetProxy provides several proxy services, as well as a configurable firewall, access logging, and dial-on-demand settings. These can either be configured manually, or configured automatically using NetProxy’s configuration wizard. If you are unfamiliar with TCP/IP, or have any concerns about the security implications of connecting your network to the Internet, we recommend using the configuration wizard initially, as it configures all of the most frequently used Internet protocols in a secure manner.

NetProxy provides the following services:-

•	World Wide Web (HTTP Proxy). Proxy services for World Wide Web clients such as Microsoft Internet Explorer, Netscape Navigator, and Mosaic. The WWW Proxy provides full HTTP caching, and can be configured to use a downstream proxy server for improved performance.

•	File Transfer Protocol (FTP Gateway). An FTP gateway that is compatible with all command-line FTP clients, as well as FTP clients that support the user@host method of firewall traversal such as WS_FTP and CuteFTP.

•	Telnet (Telnet Gateway). The telnet gateway is compatible with all Telnet clients. The telnet gateway incorporates a 'finger' client and several configurable ‘supervisor’ commands for remotely checking the status and usage of NetProxy.

•	Socks Protocol (SOCKS Server). The SOCKS protocol provides proxy services for any SOCKS-capable client. Both Netscape Navigator and Microsoft Internet Explorer use the SOCKS protocol for anonymous FTP sessions and secure HTTP (https) connections. NetProxy supports SOCKS versions 4, 4a and 5. Many other applications such as ICQ and mIRC also use the SOCKS protocol.

•	DNS Server. The DNS Server built into NetProxy allows machines on the local network to resolve host names to their corresponding IP addresses. This service is essential when using the SOCKS version 4 protocol, which deals exclusively with IP addresses rather than host names. In addition, the DNS Server in NetProxy allows local DNS records to be set up which associate names with the IP addresses of local computers.

•	Port Mapping (SMTP, NNTP, ICQ, IRC, etc.). Port Mapping is used to configure services such as Electronic Mail, Network News (NNTP), Internet Relay Chat, ICQ and video-conferencing systems such as Microsoft NetMeeting.

•	POP3 Gateway. The POP3 gateway provides the ability to read e-mail using the POP3 protocol.

•	RealPlayer. The RealPlayer proxy service allows you to view RealAudio, and RealVideo clips encoded using RealPlayer PNA technology in real time through NetProxy.

•	Firewall. The firewall is a powerful and flexible rules-based tool for governing which Internet sites the machines on your network can connect to, and which Internet sites (if any) are able to access the resources on your network (such as WWW, FTP or mail servers).

•	Dial-on-Demand. The Dial-On-Demand feature enables NetProxy to connect to the Internet as needed, and to disconnect from the Internet during quiet periods. This ensures your telephone charges and online costs are kept to an absolute minimum.

•	DHCP Server. The DHCP server automatically assigns TCP/IP settings to network workstations, greatly reducing administrative overhead.

•	Access Logging. Full access log files can be generated by NetProxy. These files can be used to provide general access statistics, as well as detailed logs for auditing/accounting purposes.

•	Time-Based Usage Restrictions. NetProxy allows you to specify which machines can use the Internet at which time of day, and on which days of the week.


Configuring the WWW Proxy Service

The world wide web (WWW) proxy service allows your network users to use web browsers to access the world wide web. The WWW proxy includes a cache feature which stores copies of frequently-accessed pages and images on disk. If a network user attempts to access a page that NetProxy has cached, the page is served directly from the cache to the user. This caching process provides significant performance gains and reduces the amount of time the NetProxy needs to remain online. NetProxy uses a complex set of algorithms to ensure that its cached resources remain up-to-date.

The configuration dialog for the WWW proxy service is shown below. Click on an area of the picture for more information on each setting.


Local Port

Specifies the TCP port number that the WWW proxy service should run on. When configuring web browsers to use NetProxy, this port must be entered as the HTTP proxy port.


Downstream Proxy Server

Enabling this option causes NetProxy to forward any requests for pages not stored in its local cache to the specified remote proxy server. If your Internet Service Provider has a caching proxy server for customer use, entering the details here should offer significant performance gains.


Enable Caching

When enabled, the caching option causes NetProxy to store copies of frequently accessed pages on disk. Enabling caching is highly recommended, as it will improve performance and reduce the amount of time that NetProxy needs to remain connected to the Internet.


Local Cache Directory

Specifies the directory in which NetProxy will store cached WWW resources.


Maximum Cache Size

This value specifies the maximum size, in megabytes, that the WWW cache directory may grow to. NetProxy will stop caching web resources when the cache reaches this size. 50MB is a sensible minimum, but larger values will improve performance.


Expiry time for HTML Documents

Specifies the maximum time, in hours, that an HTML (textual web page) resource may be cached for before NetProxy must check for updates. Note: this is a maximum figure. NetProxy’s caching algorithms may cause cached HTML pages to be updated at shorter intervals to ensure stale pages are not served from the cache.


Expire time for ‘other’ Documents

Specifies the maximum time, in hours, that non-HTML web resources (such as images and Java applets) may be cached for before NetProxy must check for updates. Note: this is a maximum figure. NetProxy’s caching algorithms may cause cached resources to be updated at shorter intervals under some circumstances.


Tidy Cache

Causes NetProxy to run through its entire database of cached WWW resources, removing any stale resources. For busy servers, tidying the cache once per week will improve performance and reduce disk space used.


Empty Cache

Removes all cached resources from NetProxy’s cache directory.


Auto-Tidy Cache

This option instructs NetProxy to automatically tidy its database of cached WWW resources at the same time every day. This will ensure that the cache is kept in its optimum state, providing maximum responsiveness whilst using the minimum disk space required.

The process of tidying the WWW cache may take several minutes to complete on a busy system, during which time the WWW proxy service is temporarily disabled.

The time should be specified using the 24-hour clock in the format HH:MM.


Do not cache resources larger than…

Specifies the maximum size of WWW resource (web page, image, files downloaded from the web, etc) that will be cached by NetProxy. The option is used to prevent NetProxy's web cache from being exhausted by large file downloads.

Any files larger than the specified size will be delivered to the requesting web client, but will not be stored in NetProxy's cache.


OK Button

Closes the dialog box and applies any changes.


Cancel Button

Closes the dialog box and cancels any changes.


Apply Button

Applies any changes without closing the dialog box.


Configuring the FTP Gateway Service

The FTP gateway service allows your network users to use File Transfer Protocol (FTP) clients to transfer files to and from the Internet.

The configuration dialog for the FTP gateway service is shown below. Click on an area of the picture for more information on each setting.

The FTP gateway is used only by dedicated FTP clients. Web browsers such as Netscape Navigator or Microsoft Internet Explorer use either the SOCKS protocol or "FTP over HTTP" to access files using FTP, rather than the FTP gateway service.

Internally, the NetProxy FTP gateway uses the PASV command to allow passive transfers to and from remote FTP servers. Most modern FTP servers support the PASV command, but it is conceivable that you may come across an older or lower-spec FTP server that does not support passive mode transfers. In this event your FTP client will be told by NetProxy that the PASV command is not supported on the remote server and the connection will be terminated.


Local Port

Specifies the TCP port number that the FTP gateway service should run on. When configuring FTP clients to use NetProxy, this port must be entered as the firewall or gateway port.


Configuring the Telnet Gateway Service

The telnet gateway service allows your network users to use telnet clients to connect to computers on the Internet. The telnet gateway also provides several useful commands (which may be password protected) for remotely administering NetProxy.

The configuration dialog for the telnet gateway service is shown below. Click on an area of the picture for more information on each setting.

When you connect to the telnet gateway from a remote machine, you will see a greeting similar to this:-

At this point, a number of commands are available to you:-

Help – Provides help information for the available telnet commands.

Connect – Connects to a remote computer. You must specify the name of the remote computer and, optionally, the port number to connect to.

Finger – Uses the finger protocol to display information about a specified user. The information provided by the finger command varies from site-to-site.

Quit – Closes the current telnet session.

Dialstatus – When NetProxy is used with a dialup (modem or ISDN) connection to the Internet, this command displays the current connection status. The dialstatus may be disabled or password protected.

Hangup – When NetProxy is used with a dialup (modem or ISDN) connection to the Internet, this command causes any existing dialup connection to be dropped. The hangup command may be disabled or password protected.

Netstat – Displays complete information about which network computers are using which NetProxy services. The netstat command is useful for diagnostic and administrative purposes and may be disabled or password protected.

Listusers – Lists the IP address of each of the computers currently using the services of NetProxy, along with the number of connections in use. This command may be disabled or password protected.

Logfile – Lists the most recent 20 lines from the current NetProxy log file. Following this command with an optional numeric parameter (for example. "Logfile 30") causes that many lines to be displayed from the end of the current log file. This command may be disabled or password protected.

Version – Displays the version number of the NetProxy engine, and information about the version of Windows that NetProxy is running on.

Most of NetProxy's telnet commands can be entered using two-letter abbreviations ('he' in place of 'help', 'co' in place of 'connect', etc.).


Local Port

Specifies the TCP port number that the telnet gateway service should run on. Port 23 is the standard telnet port for TCP/IP.


Supervisor commands

Identifies which of the supervisor telnet commands are available, and whether they are password protected.


Supervisor Password

Allows you to alter the password used to protect the supervisor telnet commands. The contents of the ‘password’ and ‘confirm’ boxes must match exactly for the password to be changed. Passwords are case-sensitive.


Configuring the SOCKS Service

The SOCKS service allows your network users to use any client software that supports the SOCKS protocol. The SOCKS protocol provides transparent proxy services to clients, and is all encompassing in the services it can provide.

NetProxy supports versions 4, 4a and 5 of the SOCKS protocol.

The configuration dialog for the SOCKS server is shown below, click on an area of the picture for more information on each setting.

The version 4 SOCKS protocol requires you to have an Internet domain name service (DNS) available to your network. NetProxy includes a DNS Server, which must be enabled in order for applications that use the version 4 SOCKS protocol to work properly. Applications that fully support SOCKS versions 4a or 5 do not require DNS.

NetProxy does not support the SOCKS BIND command. This is intentional, as the use of the socks BIND command introduces potential security risks that could be exploited to gain access to machines on your network.

Both Netscape Navigator and Microsoft Internet Explorer can be configured to use the SOCKS protocol for a variety of services, including FTP and Gopher.

SOCKS5 is a registered trademark of NEC Systems Laboratory Inc.


Local Port

Specifies the TCP port number that the SOCKS service should run on. Port 1080 is the standard port for SOCKS.


Configuring the DNS Service

The Domain Name System (DNS) is the facility that allows computers connected to the Internet to map hostnames such as "www.grok.co.uk" to the corresponding IP address. The DNS also provides a number of other ancillary services such as the ability to specify which machines handle e-mail for a given domain, and the ability to store operating system and CPU details for a given host.

NetProxy's DNS server has two main uses. Firstly, it enables NetProxy to act as an intermediate DNS forwarding agent which your client computers can use to resolve Internet host names to IP addresses and vice-versa. To use the DNS Server in this mode you simply need to ensure that the DNS Service is enabled and that you have listed the IP address of one or your ISP's DNS servers in the Remote DNS Server IP textbox.

Secondly, the DNS Server allows you to set up a number of records covering the machines on your local network. Once set up, your networked computers can then access local machines by name rather than by IP address (e.g. "mailserver" or "proxy-server.my-domain.com" rather than, say, "192.168.0.1"). The DNS records are maintained within NetProxy and can be changed instantly should the need arise.

The configuration dialog for the DNS Server is shown below, click on an area of the picture for more information on each setting.

The following DNS resource record types can be created within NetProxy's DNS service:-

Host(A/PTR) – Associates a hostname with an IP address

CNAME – Identifies an alias or alternative name for an existing host

MX – Identifies a host that will handle e-mail for the specified domain

NS – Identifies an authoritive nameserver for the specified domain

SOA – Identifies Start of Authority data for the specified domain

TXT – Specifies a free-form, human-readable text string associated with the specified hostname.

HINFO – Identifies the CPU type and Operating System of the specified hostname.

A working DNS service must be present in order for client applications that use version 4 of the SOCKS protocol to work fully. Applications that fully support SOCKS versions 4a or 5 do not require DNS.

The DNS Server built into NetProxy allows a full range of local DNS resource records to be set up. However it does not permit zone transfers (zone transfers allow a remote computer to grab a copy of all of the DNS records for a given domain in one go). For this reason we recommend that that NetProxy's DNS Server is only used to provide DNS Services to your local network, and not to provide authoritive zone information to the Internet at large.


Remote DNS Server IP

Specifies the IP address of the DNS server to which NetProxy forwards DNS requests. In a typical configuration, this will contain the IP address of your Internet Service Provider’s primary DNS server.


Local DNS Port

Specifies the UDP port number that NetProxy will listen on for DNS queries. Port 53 is the standard port for DNS. This value should not usually be altered, unless you are using a dedicated DNS server on your network that is capable of forwarding DNS queries to non-standard ports.


Default Time-to-live

Specifies the amount of time, in seconds, that DNS records will remain valid for. Clients and remote DNS servers may use this information to cache DNS responses for the specified amount of time in order to reduce DNS traffic.


DNS Record List

Contains the list of currently configured DNS records for the local domain. If a DNS query from a client machine cannot be resolved using the data in this list, it is passed off to the Remote DNS Server for resolution.


Add Record

Adds a new DNS record to list of local records.


Edit Record

Allows the currently highlighted record in the DNS record list to be edited.


Remove Record

Removes the currently-highlighted record from the list of local DNS records.


Resource

The resource field specifies the host name to which this record applies. For example, when assigning an IP address to the hostname "gateway.sample.com", the resource record would hold the hostname "gateway.sample.com".


Record Type

This field identifies the type of record being added or edited. NetProxy supports 7 distinct DNS record types, each of which server a particular purpose. See the help topic entitled "Configuring the DNS Service" for more information on the various record types.


Host (A/PTR) Record Type

This record type associates a host name with an IP address. For example, the name "netproxy.mydomain.com " could be associated with the IP address "192.168.0.1" so that your network users can refer to the host as "netproxy.mydomain.com" instead of having to remember the IP address.


Response Parameters

Each record type has one or more parameters associated with it. For a resource record to be valid, all of its parameters must contain valid data.


CNAME (Canonical Name) Record Type

CNAME records allow aliases to be set up for existing hosts, allowing a single host to be referred to by multiple names. For example, you could have a server with a Host (A/PTR) record that names it "server1.mydomain.com", and then set up multiple CNAME records that alias "mail.mydomain.com", "news.mydomain.com" and "proxy.mydomain.com" to server1.


MX (Mail eXchange) Record Type

MX records are used by mail servers to route e-mail to the correct destination SMTP server for a given domain. When setting up MX records, the "resource" field should contain the domain name you are configuring (for example "mydomain.com") and the "MX Hostname" parameter should contain the name of a host running an SMTP server that will accept e-mail for the specified domain. The "priority" parameter is a numeric value that specifies the order in which remote mail servers should attempt to deliver mail. Remote mail servers will attempt to deliver mail to records with lower MX priorities first, only falling back to the hosts with higher MX priorities if the initial delivery attempts fail.

The Domain Name System is a complex service. We recommend that only administrators with a good understanding of the workings of the DNS use this record type in the setup of local domains.

The book "DNS and BIND" by Paul Albitz & Cricket Liu, published by O'Reilly & Associates is generally regarded as the authoritive source of information on the Domain Name System, as we highly recommend reading at least the early chapters of this book before using the more advanced features of NetProxy's DNS Server.


NS (Name Server) Record Type

NS records are "glue" records that identify the hosts responsible for providing DNS information about a given domain to other DNS servers on the Internet.

The Domain Name System is a complex service. We recommend that only administrators with a good understanding of the workings of the DNS use this record type in the setup of local domains.

The book "DNS and BIND" by Paul Albitz & Cricket Liu, published by O'Reilly & Associates is generally regarded as the authoritive source of information on the Domain Name System, as we highly recommend reading at least the early chapters of this book before using the more advanced features of NetProxy's DNS Server.


SOA (Start of Authority) Record Type

SOA records are "glue" records that hold information about a given domain (such as the timeout values for caching DNS records within the domain, and contact details in case of problems with the DNS data). You cannot have more that one SOA record for each domain you administer.

The Domain Name System is a complex service. We recommend that only administrators with a good understanding of the workings of the DNS use this record type in the setup of local domains.

The book "DNS and BIND" by Paul Albitz & Cricket Liu, published by O'Reilly & Associates is generally regarded as the authoritive source of information on the Domain Name System, as we highly recommend reading at least the early chapters of this book before using the more advanced features of NetProxy's DNS Server.


TXT (Text) Record Type

TXT records are free-form text records intended to hold human-readable text about a host or domain. TXT records can contain any text you wish as they are effectively ignored by DNS servers and clients.


HINFO (Host Information) Record Type

HINFO records can be used to provide information about the operating system and CPU used by a particular host. This record type was originally used by early versions of some operating-system-specific protocols such as FTP (where the format of directory listings depending on the host operating system), however HINFO are rarely used now.


Configuring the RealPlayer Proxy Service

Configuring the RealPlayer™ Proxy Service

The RealPlayer proxy service allows your network users to experience streaming RealMedia material such as realtime audio and video through NetProxy.

The configuration dialog for the RealPlayer proxy service is shown below. Click on an area of the picture for more information on each setting.

NetProxy currently supports the RealPlayer PNA proxy service, but not the RTSP (RealTime Streaming Protocol). For the best results, RealPlayer clients should be set to use NetProxy as a PNA and HTTP proxy server only.

RealPlayer, RealMedia, RealAudio and RealVideo are trademarks of RealNetworks, Inc.


Local Port

Specifies the TCP port number on which the RealPlayer PNA proxy service will run. Port 1090 is the standard port for this service.


Configuring the DHCP Server

NetProxy includes a Dynamic Host Configuration Protocol (DHCP) server, which can automatically configure the TCP/IP settings for the machines on your network.

The DHCP server assigns IP addresses within the range you specify to the other computers on your network. Along with each address assignment, NetProxy also specifies the following TCP/IP settings: -

Subnet mask. This should usually be 255.255.255.0, but it may different if you have a previously assigned set of IP addresses for your network, or if you have a network consisting of more that 254 computers.

Default gateway. This should usually be left blank, as you do not need a default gateway to use NetProxy from a single IP network. For more complex setups such as Intranets split across several subnets, you may need to specify the IP address of a router to assign as the default gateway for the computers on your network.

Primary and Secondary DNS servers. In a typical setup, the primary DNS server should be the IP address of the NetProxy PC (assuming you have enabled the “DNS forwarding” option in the SOCKS server settings). More complex networks may have one or more DNS servers available, the IP addresses of up to two DNS servers may be specified in the primary and secondary DNS server fields.

The DHCP Server configuration dialog is shown below, click on an area of the picture for more information on each setting.

 To make use of the DHCP server, set your network client computers to “obtain an address from a DHCP server”.

 NetProxy allocates IP addresses with an infinite lease time.

 NetProxy’s DHCP server correctly handles DHCP_RELEASE messages, which are sent when a client machine wishes to relinquish its assigned IP address. NetProxy adds released IP addresses back into the pool of available addresses.


First IP Address

Specifies the starting IP address that NetProxy uses when assigning address to network client machines. If you alter this setting, you are advised to reset the DHCP allocation table.


Last IP Address

Specifies the final IP address in the pool of addresses that NetProxy assigns to network client machines. If you alter this setting, you are advised to reset the DHCP allocation table.


Subnet Mask

Specifies the IP subnet mask that is assigned to network clients using the DHCP protocol. For a typical NetProxy installation, this will be “255.255.255.0” but it may be altered for use with more complex setups.


Default Gateway

Specifies the IP address of a router which will act as the default gateway for the client machine. In a typical setup, this setting should be empty, however it may be useful for more complex setups such as Intranets that are split across several subnets.


Primary DNS server

Specifies the IP address of the primary DNS server that the machines on your network will use when attempting to resolve Internet host names to IP addresses. In a typical setup, this should point to the IP address of the NetProxy PC.


Secondary DNS server

Specifies the IP address of a secondary DNS server for the machines on your network. In a typical setup, this setting should be empty.


Reset Allocation Table

Resets the DHCP allocation table. This table records which IP addresses have been leased to which machines. If you make any major changes to the DHCP settings, it is recommended that you reset the DHCP allocation table in order to ensure that the changes are propagated around your network.


Configuring the POP3 Gateway Service

The POP3 gateway allows mail-reader software to retrieve e-mail through NetProxy from any POP3 mail server. A POP3 ‘divider’ character is defined in NetProxy to separate the username portion of an address from the POP3 server name. By default, the divider character is a hash symbol (“#”).

If you had a POP3 mailbox called “johndoe” on a server named “mail.somewhere.net”, you would set up your mail software as follows:-

POP3 Server: 192.168.0.1	  (or whatever the IP address of your NetProxy PC is)

POP3 Username:	johndoe#mail.somewhere.net

You may also specify a Default POP3 Server in NetProxy. This is the name of a POP3 server that is used if no divider character and server name is specified in the client mail software. For example, if you set the Default POP3 Server setting to “mail.somewhere.net”, the mail software settings for the above example could be simplified to:-

POP3 Server: 192.168.0.1	  (or whatever the IP address of your NetProxy PC is)

POP3 Username:	johndoe   (no need to specify the POP3 serve, as we are using NetProxy’s default).

Obviously, the above settings would break if you where to alter the Default POP3 server setting in NetProxy.

The POP3 Gateway configuration dialog appears below. Click on an area of the picture for more information on each setting.


Local Port

Specifies the TCP port number that the POP3 gateway service should run on. Port 110 is the standard port for POP3.


Divider Character

Specifies the character that is used to separate the account/user name from the POP3 server name in mail client software.


Default POP3 Server

Specifies the default POP3 server. This server name is used if no divider character and server name are specified in the mail client.


Configuring Mapped Ports

NetProxy allows mapping of both TCP and UDP ports to specific destinations. Mapped ports facilitate the use of many Internet protocols through NetProxy, including (but not limited to): -

•	Simple Mail Transfer Protocol (SMTP) for sending e-mail

•	Network News Transfer Protocol (NNTP) for reading and posting USENET news

•	Mirabilis ICQ for communicating with remote users

•	Network Time Protocol (NTP) for synchronising PC clocks with a central resource on the Internet

Mapped ports are also useful for configuring video conferencing and collaboration programs, as well as providing a method for making nominated servers on your network available to the Internet at large (WWW, FTP or SMTP servers for example).

The configuration dialog for adding and editing mapped ports appears below. Click on an area of the picture for more information on each setting.


Description

This is a textual description of the service provided by the mapped port. It is intended to provide a useful reference to system administrators.


Local Port

Specifies which TCP or UDP port on the NetProxy PC is to be mapped. Ports that are in use by another application or service cannot be mapped. Port number can be in the range 1 – 65535.


IP Protocol

Specifies which protocol (UDP or TCP) this port mapping is for. TCP a reliable streaming protocol, used for the majority of applications including mail and news. UDP is a datagram-based protocol that is often used for ‘real-time’ media such as video and audio.


Default host and port

Specifies the default host and port number that NetProxy maps connections to for this mapping. If there are no exceptions listed that match the IP address of the connecting machine, NetProxy maps the connection to the default host.


Exceptions list

Shows a list of exceptions to the ‘default’ destination host and port. If the IP address of the connecting machine matches one of exceptions, the specified host is connected to instead of the default. If the incoming connection matches more than one exception rule, the ‘best match’ is used (i.e. the exception with the most bits specified after the slash).


Add Exception

Displays a dialog box that allows you to add a new exception rule for the mapped port.


Edit Exception

Displays a dialog box that allows you to edit the currently selected exception rule.


Remove Exception

Removes the currently selected exception rule.


Allow Global Access

When this option is enabled the incoming firewall rules are ignored for the specified mapped port, thus providing a simple means of running a world-accessible server such as a public WWW, FTP or SMTP server on a machine situated behind NetProxy’s firewall.


Configuring Firewall Settings

NetProxy contains a powerful rules-based firewall that allows you to specify which computers and services (if any) on your network can be accessed from the outside world, and which Internet hosts can be connected to from the machines on your network.

A typical firewall configuration will reject all incoming connections (incoming connections refers to connections into NetProxy, both from the Internet and from the computers on your own network) apart from connections from any of the machines on your NetProxy, and will allow outgoing connections to any destination. This is the default configuration generated by the configuration wizard, and it offers the maximum level of security.

Certain situations, such as setups where a world-visible SMTP or WWW server is running on a machine behind the firewall, may require changes to the default firewall settings in order to perform optimally.

Firewall rules in NetProxy are specified using standard slash notation. This allows you to easily add rules covering entire groups of hosts (subnets).

The firewall configuration dialog appears below. Click on an area of the picture for more information on each setting.


Reject All Incoming Connections

Sets the default behaviour for connections into NetProxy to “reject”. When this option is set, you then explicitly add one or more firewall rules to permit connections to NetProxy from the hosts on your own network.


Accept All Incoming Connections

Sets the default behaviour for connections into NetProxy to “accept”. When this option is set, NetProxy will permit incoming connections from any hosts (both on the Internet and on your internal network) apart from those hosts excepted by any other firewall rules.


Incoming Connection Rules

Contains a list of firewall rules for connections into NetProxy. Hosts and subnets are specified using slash notation, and individual rules can be specified for each NetProxy service.


Add Incoming Firewall Rule

Adds a new firewall rule for governing which hosts can use the services of your NetProxy installation.


Edit Incoming Firewall Rule

Displays a dialog box permitting the currently selected incoming firewall rule to be altered.


Remove Incoming Firewall Rule

Removes the currently selected incoming firewall rule.


Block Outgoing Connections

Sets the default behaviour for connections out of NetProxy to “reject”. One or more outgoing firewall rules must be added to cover the hosts that NetProxy is permitted to make connections to.


Accept Outgoing Connections

Sets the default behaviour for connections out of NetProxy to “accept”. Any hosts that are covered by an outgoing firewall rule will not be reachable via NetProxy.


Outgoing Connection Rules

Contains a list of firewall rules for connections from NetProxy. Hosts and subnets are specified using slash notation, and individual rules can be specified for each NetProxy service.


Add Outgoing Firewall Rule

Adds a new firewall rule for governing which sites can be reachable via NetProxy.


Edit Outgoing Firewall Rule

Displays a dialog box permitting the currently selected outgoing firewall rule to be altered.


Remove Outgoing Firewall Rule

Removes the currently selected outgoing firewall rule.


HTTP Filter List

Shows a list of web pages, or directory paths within web pages, that NetProxy will not permit connections to.


Add HTTP Filter

Adds a new HTTP filter rule.


Edit HTTP Filter

Displays a dialog box permitting the currently selected HTTP filter rule to be altered.


Remove HTTP Filter

Removes the currently selected HTTP filter rule.


IP Address Range

Identifies a 32-bit IP address in dotted quad notation. For example, “192.168.1.32”.


IP Address Mask

Specifies the number of bits (binary digits) that are relevant for a given IP address. For example, 192.168.0.1/32 specifies a single computer with the IP address 192.168.0.1, whereas 192.168.0.0/24 specifies a group of computers with IP addresses between 192.168.0.0 and 192.168.0.255. See the section on slash notation for further information.


Service

Specifies the NetProxy service that the firewall rule applies to.


Host Name

Identifies the name of the web server that is blocked by the HTTP filter rule.


Directory Path

Identifies the (optional) directory path that is blocked by the HTTP filter rule. The named directory and all directories below it are blocked.


Configuring Dialling Settings

If you are using NetProxy with a dial-up modem or ISDN connection to your Internet Service Provider, you can configure NetProxy to dial your service provider whenever anyone on your network attempts to connect to a site on the Internet. NetProxy will also drop the line when nobody is connected to the Internet.

To use NetProxy with a cable modem, satellite uplink, or leased-line connection to the Internet, the "Enable dial on demand" option should normally be unticked.

The dial on demand configuration dialog is shown below, click an area of the picture for more information on each setting.


Enable ‘Dial on Demand’

Enables or disables NetProxy’s dial on demand capability.


Entry Name

Specifies the name of the Windows dial up networking (DUN) connection name that NetProxy will dial out to.


User Name

Specifies the log on user name for connecting to your Internet Service Provider.


Password

Specifies the log on password for connecting to your Internet Service Provider.


Allow Multilink Connections

Switching this option on allows NetProxy to use Windows dial-up networking profiles that have the "Dial Using Multiple Lines" option set. This feature, which is not present in older versions of Windows, allows simultaneous connections to your ISP using two or more phone lines or ISDN channels resulting in faster overall throughput. For example, two 33.6kbps modems can be used with two phone lines to obtain a 67.2kbps connection to your ISP, or two 64kbps ISDN channels can be used simultaneously to obtain a 128kbps connection.

PPP-Multilink is sometimes referred to as "channel bonding" or "channel bundling".


Advanced Button

Displays the Advanced Dialling Options dialog. This allows a range of dial-up profiles (a dialup profile consists of a Windows Dial-Up Networking entry name, an account name and a logon password) to be specified for use at different times of day or days of the week.

In some countries, ISP's offer discounted or free call rates at certain times of the day by providing special phone numbers. Using the advanced dialling options, NetProxy can automatically use the most appropriate Windows Dial-Up Networking entry at any given time.


Retry Count

Specifies the number of times NetProxy will attempt to dial your Internet Service Provider before reporting a “connection failed” message.


Retry Pause

Specifies the length of time, in seconds, that NetProxy will wait between successive dial attempts.


Inactivity Timeout

Specifies the length of time, in seconds, for which NetProxy must remain idle before closing the dial up connection to your ISP.


Minimum Connect Time

Specifies the minimum length of time, in seconds, that must elapse before NetProxy will drop a dial up connection. Useful in situations where a minimum call charge, or a call setup charge, makes it economic to stay connected for a minimum period.


Advanced Profile Rule List

Contains a list of the currently configured advanced dialling profile rules. NetProxy examines this list when initiating a dial-up connection and, if an entry is found that covers the current time-of-day and day-of-week, those dial-up settings are used in place of the default listed in the standard Dialling dialog.

Only the first matching entry is used – there is no advantage to be gained from having more than one profile rule being configured for use at any one time/day.


Add Profile Rule

Adds a new Advanced Dialling Profile rule.


Edit Profile Rule

Allows the currently highlighted entry in the Advanced Dialling Profile rule list to be edited.


Remove Profile Rule

Removes the currently highlighted entry from the Advanced Dialling Profile rule list.


Configuring Time-Based Usage Restrictions

NetProxy's Time Restrictions dialog allows a set of rules to be defined that specify which clients (by their IP address) can use the services of NetProxy at which specific times of the day or days of the week.

For example, in an office environment, Internet usage might be restricted to office hours only.

Time restriction rules in NetProxy are specified using standard slash notation. This allows you to easily add rules covering entire groups of hosts (subnets).

The Time Restrictions dialog appears below. Click on an area of the picture for more information on each setting.

 When a computer attempts to connect to NetProxy, all of the time restriction rules are searched. If there is any rule that allows the host to connect the connection is permitted, otherwise the connection is dropped.


Time restriction rules list

Contains a list of the currently configured time restrictions. Any hosts not covered by a rule in this list will not be permitted to use the services of NetProxy at any time.


Add Rule

Adds a new time-restriction rule.


Edit Rule

Allows the currently highlighted entry in the Time Restriction list to be edited.


Remove Rule

Removes the currently highlighted entry from the Time Restriction list.


Start Time

Specifies the starting time for the rule. Hosts within the specified IP address mask will be allowed access to NetProxy from the specified time on the specified days.


End Time

Specifies the end time for the rule. After the end time has elapsed, hosts within the specified IP address will no longer be permitted to use NetProxy unless there is another rule in the list which covers the host.


Day of Week

The checkboxes specify the days of the week on which this rule is active.


Configuring Access Logging Options

Configuring the Access Logging Options

NetProxy is able to log all activity in standard plain text files. The Access Logging configuration dialog allows you to specify which network activity is logged, and where log files are stored.

For further information about the format of NetProxy’s log files see the topic entitled Log File Format.

The Access Logging configuration dialog is shown below, click an area of the picture for more information on each setting.

 Log file names are based on the system date in the format “YYYYMMDD.log”. For example, “20000918.log” would contain logging information for 18th September 2000. Log files are rotated at midnight (00:00:00).


Log WWW Proxy Requests

Enables logging of all traffic that passes through NetProxy’s WWW Proxy service. The requested resource is logged, along with information about whether a fresh copy of the page was retrieved, or whether a cached copy was sent.


Log RealPlayer Proxy Connections

Enables logging of all RealMedia traffic that passes through NetProxy. Including RealAudio, RealVideo and RealFlash resources.


Log SOCKS Connections

Enables logging of all SOCKS traffic that passes through NetProxy.


Log FTP Gateway Connections

Enables logging of file transfers that pass through NetProxy’s FTP Gateway. Note that some programs (most notably web browsers) actually use the SOCKS protocol for FTP transfers, rather than NetProxy’s FTP gateway.


Log Telnet Gateway Connections

Enables logging of telnet connections that pass through NetProxy. Both telnet connections, and finger queries made via the telnet gateway are logged.


Log DNS Queries

Enables logging of DNS queries made via NetProxy’s DNS forwarding service.


Log Connections to Mapped Ports

Enables logging of all connections that pass through any of NetProxy’s mapped ports. Both TCP and UDP traffic is logged.


Log DHCP Server Activity

Enables logging of DHCP server activity. The MAC address of the requesting machine is used to uniquely identify each machine. All DHCP requests are logged, including DISCOVER, REQUEST and RELEASE messages.


Log POP3 Gateway Connections

Enables logging of POP3 mail connections.


Log Unauthorised Connection Attempts

Enables logging of all illegal attempts to use NetProxy services. This includes connections from computers whose IP addresses are blocked by incoming firewall rules, and connections to destinations whose IP addresses are blocked by outgoing firewall rules.


Log Dialup/Hangup Activity

Enables logging of all dialup and hangup events. Useful for monitoring online connection charges when using NetProxy with a modem or ISDN connection.


Directory for log files

Specifies the disk directory in which NetProxy stores access log files.


Installing TCP/IP on your Network Workstations

The computers on your network must use the TCP/IP protocol to communicate with NetProxy. TCP/IP is the network protocol used by computers on the Internet. If you are using Windows 95, Windows 98 or Windows NT, you can safely install the TCP/IP protocol alongside any existing network protocols such as NetBEUI or IPX/SPX.

The TCP/IP protocol is available for all popular operating systems including Windows, OS/2, all variants of UNIX, Mac OS, BeOS, AmigaDOS and RiscOS. All of these operating systems can be configured to use NetProxy as a gateway to the Internet.

IP addresses beginning 192.168 are reserved for use on private networks and will not clash with IP addresses of valid hosts on the Internet. We therefore recommend that you use IP addresses in the range 192.168.0.1 to 192.168.0.254 for the machines on your network.

There are two methods of assigning IP addresses to network clients. You can either instruct your network computers to obtain an IP address from a DHCP server (NetProxy will then take care of assigning appropriate IP settings to your computers), or you can configure the settings for each machine manually.

To install TCP/IP on a machine running Windows 95, Windows 98 or Windows NT:-

•	Run control panel and select the ‘Network’ icon.

•	In the network Window, highly the entry for your network adapter and select the ‘Add…’ button.

•	Select ‘protocol’ to add a new protocol for your network card and click ‘Add…’.

•	In the ‘Manufacturers’ list box, select ‘Microsoft’ and in the network protocols list box, select ‘TCP/IP’ and click OK.

To manually configure the TCP/IP settings on a machine running Windows 95, 98 or NT:-

•	Run control panel and select the ‘Network’ icon.

•	In the network Window, highly the entry for the TCP/IP protocol bound to your network adapter and select the ‘Properties’ button.

•	Under the IP Address tab, select ‘Specify an IP address’ and type the next available IP address (for the first PC, this would usually be 192.168.0.2), and type 255.255.255.0 in the subnet mask box.

•	Under the DNS configuration tab, select ‘Enable DNS’ and add a DNS server entry containing the IP address of the NetProxy PC (this would usually be 192.168.0.1 if you have followed the instructions given in this document). You may also have to provide a unique host name for the computer (this can be anything, as long as it is unique to your network).

You may be required to restart the computer in order for the new TCP/IP settings to take effect.

To configure a machine running Windows 95, 98 or NT to use DHCP to automatically obtain TCP/IP settings from NetProxy:-

•	Run control panel and select the ‘Network’ icon.

•	In the network Window, highly the entry for the TCP/IP protocol bound to your network adapter and select the ‘Properties’ button.

•	Select the ‘IP Address’ tab and ensure that the option to "Obtain an IP Address Automatically" is selected.

•	Click OK to close all of the network settings dialogs. You may be asked to reboot the computer.

When the computer reboots, assuming NetProxy is running on another machine on your network, a unique IP address and related TCP/IP setup details will be automatically assigned.

Once you have configured your client software to use NetProxy, the setup is complete.


Configuring your Client Software to use NetProxy

Each piece of client software (such as a mail reader, web browser or FTP client) that is used on your network computers needs to be configured to use NetProxy instead of trying to connect directly to hosts on the Internet.

Typically, this is a fairly trivial process, but here we provide instructions for configuring most popular packages.

Web Browsers

Netscape Navigator v4

To configure Netscape Navigator to use NetProxy, select ‘Preferences…’ from the Edit menu in Navigator. Open the 'Advanced' branch and select the ‘Proxies’ option. Highlight the ‘manual proxy configuration’ option and click ‘view…’ to view the current proxy settings and alter them to: -

HTTP	192.168.0.1	Port:	8080
Security:	192.168.0.1	Port:	8080
FTP:		Port:	0
Socks:	192.168.0.1	Port:	1080
Gopher:		Port:	0
WAIS:		Port:	0

Navigator will then use the SOCKS protocol for FTP, Gopher, and WAIS sessions. Do not enter anything for the FTP, Gopher or WAIS settings in Navigator.

Internet Explorer v4

To configure Internet Explorer 4 to use NetProxy, select ‘Internet Options…’ from the 'View' menu. Select the ‘Connection’ tab and enable the ‘Access the Internet using a proxy server’ checkbox. Select the 'Advanced…' button to view the current proxy settings and alter them to: -

HTTP	192.168.0.1	Port:	8080
Secure:	192.168.0.1	Port:	8080
FTP:		Port:
Gopher:		Port:
Socks:	192.168.0.1	Port:	1080

Internet Explorer will use the SOCKS protocol for FTP and Gopher sessions. Do not enter anything for the FTP or Gopher settings in Internet Explorer.

Internet Explorer v5

To configure Internet Explorer 5 to use NetProxy, select ‘Internet Options…’ from the 'Tools' menu. Select the ‘Connections’ tab and click the "LAN Settings…" button. Enable the ‘Access the Internet using a proxy server’ checkbox. Select the 'Advanced…' button to view the current proxy settings and alter them to: -

HTTP	192.168.0.1	Port:	8080
Secure:	192.168.0.1	Port:	8080
FTP:		Port:
Gopher:		Port:
Socks:	192.168.0.1	Port:	1080

Internet Explorer will use the SOCKS protocol for FTP and Gopher sessions. Do not enter anything for the FTP or Gopher settings in Internet Explorer.

FTP Clients

WS_FTP and WS_FTP95

To use the WS_FTP or WS_FTP95 clients with NetProxy, select the profile of the host that you wish to connect to in the ‘Session Properties’ dialog in WS_FTP. Select the ‘Advanced’ tab and put a checkmark next to the ‘use firewall’ option. Enter the IP address of your NetProxy PC (usually 192.168.0.1) in the host name field and enter the port number of the FTP gateway (usually port 21) in the port field. The ‘User ID’ and ‘Password’ settings should be left empty. The firewall type must be set to ‘USER with no logon’.

Command line FTP clients.

To use a command-line based FTP client, such as the DOS-based FTP.EXE supplied by Microsoft with both Windows 95 and Windows NT, simply ftp to your NetProxy PC and enter your username as ‘username@remote.ftp.host’. A sample ftp session is shown below:-

C:\>ftp 192.168.0.1

Connected to 192.168.0.1.

220 Welcome to the NetProxy FTP gateway at proxy.grok.co.uk

User (spike:(none)): anonymous@sunsite.doc.ic.ac.uk

331 Guest login ok, send your complete e-mail address as password.

Password: ****************

230-                 The Archive  --  SunSITE Northern Europe

230-                 ========================================

230-

230-   SunSITE Northern Europe is located at the Department of Computing,

230-   Imperial College, London and is running on a SPARCserver 1000 (with

230-   8 CPUs and 61 GB of RAID5 disk space) kindly donated by Sun Microsystems.

ftp>

Telnet Clients

You can use any Telnet client with NetProxy. Rather than telnetting directly to the destination host, telnet to the NetProxy PC (this is 192.168.0.1 if you followed our installation guidelines). Then, when you see the ‘NetProxy>’ prompt, type ‘open hostname’ where hostname is the name or IP address of the host on the Internet that you wish to telnet to. You can also type 'finger user@hostname' to perform a 'finger' query for a given user or host. Ensure that you have the Telnet Gateway enabled in Netproxy.

News Readers

You can use any news reader with NetProxy. Your news reader will have a configurable option that lets you specify the name or IP address of the news server that you wish to connect to. Simply use the IP address assigned to your NetProxy PC (this is 192.168.0.1 if you followed our installation guidelines). Ensure that you have a mapped port configured in NetProxy for port 119 (NNTP).

Mail Programs

You can use any Internet mail program with NetProxy. Your mail program will have a configurable option that lets you specify the name or IP address of the SMTP host that you wish to use for sending mail. Specify the IP address assigned to your NetProxy PC (this is 192.168.0.1 if you followed our installation guidelines). There will also be a configurable option that lets you specify the name or IP address of the POP3 host that you wish to use for receiving mail. Specify the IP address assigned to your Netproxy PC (this is 192.168.0.1 if you followed our installation guidelines). Specify your POP3 account/username in the form "username#pop3.hostname.net", where username is your POP3 account name and pop3.hostname.net is the real name or IP address of the POP3 server that holds your mail. A separator other than ‘#’ can be configured in NetProxy’s POP3 configuration dialog.

Ensure that you have a mapped port configured in NetProxy for port 25 (SMTP) and that the POP3 gateway service is enabled.

RealPlayer

To configure the RealPlayer client application from RealNetworks, select the “Preferences” option (this is in either the “View” or “Options” menu, depending on the version of RealPlayer being used). Select the “Proxy” tab, and enter the IP address of your NetProxy PC as the “RealPlayer PNA Proxy” and “HTTP Proxy”. Next, select the “Transport” tab, select “Use specifies Transports”, and click the “Specify Transports” button. Set the following transport options: -

•	Use TCP to Connect to Server

•	Attempt to use UDP for static content

Switch to TCP if no data is received after 10000 milliseconds

RealPlayer and RealNetworks are trademarks of RealNetworks, Inc.

ICQ

To configure the Mirabilis ICQ client for use through NetProxy, select the “Preferences” option from the ICQ menu. Select the “Connection” tab and set the “I’m using a permanent internet connection (LAN)” option, and the “I am behind a firewall or proxy” optiion.

Next, click the “Firewall Settings” button to display the ICQ firewall wizard and set the following options:-

•	“ I am using a SOCKS4 proxy server”

•	Set “Firewall sessions time out after” to 180 seconds.

•	Click “Next”.

•	Set the SOCKS4 host to the IP address of your NetProxy computer.

•	Set the SOCKS4 port to “1080”.

•	Select the “Use a mapped port on a Proxy” option and specify the IP address of your NetProxy computer and port 4000.

Ensure that NetProxy’s SOCKS server is enabled, and that a port 4000 (UDP) is mapped to an ICQ server (such as icq.mirabilis.com, port 4000).


Using Slash Notation to Configure Mapped Ports and Firewall Rules

NetProxy uses "slash notation" to define which individual computers, or groups of computers, are covered by firewall rules and port mapping exceptions. IP addresses written in slash notation look like this:-

192.168.1.0/24

192.168.1.23/32

195.153.161.128/25

To the left of the “slash” character (/) is the IP address or network address being referred to. To the right of the “slash” character is a number that specifies the number of significant “bits” in the address.

IP addresses are 32 bit numbers consisting of four eight bit numbers separated by periods (.). Therefore, the number following the slash character must be between 1 and 32.

Here are some examples of common slash-notated addresses, with their meanings:-

Address	Meaning
192.168.14.12/32	Refers to the single computer with the IP address “192.168.14.12”. The /32 tells us that all 32 bits of the address are relevant.
192.168.14.0/24	Refers to a group of computers with addresses ranging from 192.168.14.0 to 192.168.14.255. The /24 tells us that the first 24 bits (i.e. the first three numbers in the dotted quad) are relevant.
192.168.17.128/25	Refers to a group of computers with addresses ranging from 192.168.17.128 to 192.168.17.255. The /25 tells us that the first 25 bits of the address are relevant.

Why does NetProxy use slash notation? Wasn’t the “192.168.14.*” style of notation used by NetProxy 2.0 easier to understand?

The pattern matching used in NetProxy 2.0 may have been more intuitive for people used to using MS-DOS wildcards, but it is a fundamentally inflexible method of matching IP addresses. As an example, slash notation allows us to use “192.168.1.192/27” to refer to computers with the IP addresses 192.168.1.192 to 192.168.1.223. There is no simple way to do this using the pattern matching in NetProxy 2.0, separate rules would have to be generated for each of the 32 IP addresses.

Slash notation is a widely used standard for referring to IP subnets. It is used by most modern TCP/IP software and hardware routers.


Port Mapping Primer

To facilitate the use of ‘single-host’ TCP/IP services such as SMTP (for email), NNTP (for network news) and NTP (Network Time Protocol), NetProxy has a facility called port mapping. This section describes what ports are, why you might want to map them, and how to map them in NetProxy.

What are ports?

The Internet has application protocols for commonly used applications such as FTP, Telnet and the world-wide-web. On the Internet, these common applications use something called a well-known port assignment to identify the nature of the data being sent or received.

Just as PC programs use port LPT1 to send data to a printer and COM1 to talk to a modem, Internet programs use a variety of protocol ports for specific Internet applications. For example, the well-known port assignment for sending email is port number 25. The well-known port assignment for the WWW is port number 80.

With TCP/IP there are two main types of port TCP (Transmission Control Protocol) which is the most commonly used, and UDP (User Datagram Protocol) which is sometimes used for streaming media such as real-time Video and Audio and for less-critical protocols such as NTP (Network Time Protocol). Ports are numbered from 1 to 65535.

What is port mapping?

Using port mapping, you can configure your NetProxy PC to forward any data it receives on a particular port number to another computer on the Internet.

For example if your Internet service provider has a network news server on a computer called ‘news.serviceprovider.net’, it will be listening for incoming news connections on port 119. If you set up NetProxy to forward any data it receives on it’s port 119 to port 119 on ‘news.serviceprovider.com’, then your NetProxy PC will appear as if it is a news server that can be used by anyone of your network!

You just have to set up the newsreader software on your network workstations to send and retrieve news articles from your NetProxy PC and NetProxy will forward the data to and from your service providers’ news server as necessary.

The most frequently-used well-known port numbers are shown below:-

Protocol	Port #	Transport type
Daytime	13	UDP
File Transfer Protocol (FTP)	21	TCP
Telnet	23	TCP
Simple Mail Transfer Protocol (SMTP)	25	TCP
Finger	79	TCP
Hypertext transfer protocol (HTTP)	80	TCP
Post Office Protocol v3 (POP3)	110	TCP
Network News Transfer Protocol (NNTP)	119	TCP
Network Time Protocol (NTP)	123	UDP
ICQ Control Protocol	4000	UDP
Internet Relay Chat (IRC)	6667	TCP

In addition to mapping the ports on your NetProxy PC to a default remote computer, you can map a port to a different remote computer depending upon the IP address of the computer that is initiating the connection. What use is this? Well, for instance, if you run an SMTP server on one of the computers on your network, you’d want NetProxy to map all incoming SMTP connections from the Internet through to it so that it could process the incoming mail. But, when someone on your network sends outgoing Internet email, you’d want NetProxy to map the connection to your service provider’s mail server for delivery to the appropriate destination on the Internet. NetProxy needs to map the SMTP port to a different place depending on which computer is sending the data.

How do I set up a mapped port in NetProxy?

To configure NetProxy for the scenario described in the previous paragraph, you would specify the IP address of the PC running your SMTP server as the default host for incoming connections on port 25 (remember, the port number for SMTP is number 25). If you run your SMTP server on a PC with an IP address of 192.168.0.2 you’d do this:-

Now, before you click the ‘close’ button, click on the ‘Add…’ button. This allows you to add an exception to the default mapping depending on the IP address of the connecting machine. If the name of your service provider’s SMTP mail server was ‘mail.serviceprovider.net’, you could route the SMTP connections from your own network to it by adding the following mask:-

(This is based on the assumption that the computers on your network are all in the subnet 192.168.0.0/24 (i.e. their IP addresses are in the range 192.168.0.1 to 192.168.0.254).

This result is a ruleset that means ‘map any incoming connections on port 25 to 192.168.0.2 apart from connections from 192.168.0.*, which should be mapped port 25 on mail.serviceprovider.net’.

"Allow Global Access" Option

When this option is enabled, NetProxy will ignore the incoming firewall rules for that particular mapped port. This allows you to specify "open" port numbers that can be accessed from any computer on the Internet whilst maintaining full security for NetProxy’s other services and mapped ports. The primary use for the "allow global access" option is to enable you to run a server (perhaps an SMTP server to receive incoming mail, or a WWW server) on a computer on your network without compromising the security of other services.


Running NetProxy as a System Service

NetProxy consists of two separate programs. NPConfig.EXE is the ‘front-end’ program that allows you to configure the various settings, and NPServ30.EXE is the “proxy engine” – a program that runs invisibly and does all of the actual sever work such as cacheing web pages, accepting FTP requests and forwarding mapped port connects to the correct destination.

Although NPConfig and the proxy engine communicate with each other to exchange setup information and statistics, each program can be run independently.

For most setups, the most convenient way to run the NetProxy Engine is as a system service. NetProxy runs as a service under Windows NT, Windows 95 or Windows 98. Windows system services have the following properties:-

•	They start up automatically, when Windows boots up.

•	They don’t require a user to be logged on in to Windows in order to run.

•	They run invisibly without requiring any user intervention.

To install NetProxy as a system service, select the “System service” option from the “Configure” menu in NPConfig. The next time the computer reboots, NetProxy will automatically start up as a system service before you’ve even logged in to Windows.


Registering NetProxy

NetProxy is not free software! You are permitted to use the unregistered version for a period of 30 days for evaluation purposes. After this evaluation period, NetProxy will continue to run but will only support one user at a time. You may continue to use NetProxy in this single user mode indefinitely for no charge.

To use NetProxy with more than one concurrent user after the evaluation period has expired, you must purchase a licence.

Licences are available for 3, 5, 10 or ‘unlimited’ users. An unlimited user licence covers any number of users of a single NetProxy installation.

Current pricing details are available from our web site at http://www.grok.co.uk/netproxy/pricing.html.

There are a number of easy ways to pay for your NetProxy licence. We have a secure web server which may be used to placed credit card orders. You may also place your order by telephone or by fax (using the postal/fax order form).

We accept payment by cheque or money order in either UK sterling, or US dollars (only if drawn on a US bank).

Full information for purchasing NetProxy is available from our web site at http://www.grok.co.uk/ordering.html. Alternatively, contact our sales team:-

Tel:	+44 20 8547 2304

Fax:	+44 20 8547 2305


NetProxy Postal/Fax Order Form
NetProxy 3.0 Postal/Fax Order Form

Credit card orders may be submitted electronically using our secure web server (details of which are available from http://www.grok.co.uk/ordering.html), or by fax to +44 20 8547 2305.

Current pricing information for NetProxy is available from http://www.grok.co.uk/pricing.html

- LICENCE DETAILS -

Your name: …………………………………………………………………………………………………..

The name of your organisation: ………………………………………………………………………

Your E-Mail address (we will send the licence key to this address):

……………………………………………………………………………………………………………………..

Your full postal address:	……………………………………………………………………………..

……………………………………………………………………………..

……………………………………………………………………………..

……………………………………………………………………………..

Telephone Number: ……………..………………………………………………………………………….

I wish to purchase a licence for: 3 Users  /  5 Users  /  10 Users  /  Unlimited Users

- PAYMENT DETAILS -

I wish to pay by 	Credit card  /  Cheque  /  Money order

Credit card type:	VISA  /  MasterCard  /  EuroCard  /  Switch

Card number: ………………………………………………………………………………………………..

Card Expiry date: …………………………………..

Cardholder's Name: ……………………………………………………………………………………….

Cardholder's Address:	……………………………………………………………………………

……………………………………………………………………………

……………………………………………………………………………

……………………………………………………………………………

I fully authorise the sum of: £……………………………………………………… (UK Pounds)

to be debited from my credit card by Grok Developments, Ltd.

Signed: …………………………………………………………………….………………. (Cardholder)

- OTHER DETAILS -

VAT Reg. Number (EC-member countries only): …………..……………………………………

Country Code: ……………………………………………………………………………………………….

Please tell us if you would like a VAT receipt to be sent to your postal address.

If you are not paying by credit card, remember to include a cheque, postal order or international money order for the full amount, including VAT if applicable, payable to ‘Grok Developments Ltd’ with your order.

V.A.T. only applies to European purchasers in the European Community member countries.

EC purchasers outside of the UK who supply a valid V.A.T. Reg. Number are exempt from paying V.A.T. on goods purchased from the UK.

Grok Developments Ltd	Telephone:	+44 20 8547 2304 (sales and general enquiries)
103 Acre Road	Fax:	+44 20 8547 2305
Kingston-upon-Thames	Web:	http://www.grok.co.uk/
Surrey	E-Mail:	sales@grok.co.uk
KT2 6ES
England


Restrictions in the Unregistered Version of NetProxy

An unregistered version of NetProxy will work unrestricted for 30 days. After this evaluation period has expired NetProxy will behave as follows:-

•	The proxy engine will continue to run, but will only allow connections from one computer at a time.

•	The NPConfig program will display a “Thank you for evaluating NetProxy” message each time it is started.

When you purchase a licence, you will receive a unique licence key to enter into NetProxy – this will licence the product to work with more than one user at a time, and will remove the “Thank you for evaluating NetProxy” message.

See the section on registering NetProxy for details of how to obtain a licence key.


Technical Support

We operate a "NetProxy Users" mailing list frequented by our support and development staff, as well as many knowledgeable users of NetProxy. This discussion list is available to registered and unregistered users alike, and is our primary means of supporting NetProxy.

For users of the unregistered product, we also offer one-to-one technical support on a “best efforts” basis by e-mail or fax. Support queries from registered users of the product will take priority.

Registered users are entitled to free priority technical support by e-mail or fax. We do not offer free telephone support for NetProxy.

Mailing list:

To subscribe to the netproxy-users mailing list, send an e-mail message to majordomo@grok.co.uk containing the text "subscribe netproxy-users" in the message body. Within a few minutes, you should receive a "Welcome" message describing list etiquette and how to submit messages.

HTML-ised mail messages and multi-part MIME mail messages will cause your subscription request to be rejected. Please configure your mail client to send plain text messages rather than HTML or multi-part MIME messages when submitting your subscription request.

E-Mail:

Support queries may be e-mailed to support@grok.co.uk. Please include a clear description of the problem, including all the symptoms and the steps required to reproduce the problem if necessary. If you are a registered user, please include your registered name and licence key at the top of the message in order to receive priority attention.

Fax:

Support queries may be faxed to us on +44 20 8547 2305. Please include a clear description of the problem, including all the symptoms and the steps required to  reproduce the problem if necessary. If you are a registered user, please include your registered name and licence key in order to receive priority attention.


Contacting Grok

NetProxy is developed and distributed by Grok Developments Limited. Please contact us if you would like any more information about our products and services.

Grok Developments Ltd	Telephone:	+44 20 8547 2304 (sales and general enquiries)
103 Acre Road	Fax:	+44 20 8547 2305
Kingston-upon-Thames	Web:	http://www.grok.co.uk/
Surrey	E-Mail:	sales@grok.co.uk
KT2 6ES
England


Format of NetProxy Log Files

NetProxy 3.0 Log File Format

The addition of new functionality in NetProxy 3.0 has necessitated a number of changes to the log file format from that used in NetProxy 2.0. The most far-reaching of these is the decision to record dates in standard CERN httpd log format - this particular change affects all log entries, but adds the ability to correctly indicate timezone changes (such as the twice-yearly change to and from daylight savings time that happens in most countries).

The full specification of the log file format, with notes for those porting scripts from version 2.0 is as follows:-

File names

Log files are placed in the directory of your choice (as defined in NPConfig) and are named "yyyymmdd.log" (e.g. "19980610.log"). They are auto-rotated at midnight each night.

DIALUP

Log entries now have their date recorded in CERN-httpd log format (dd/mmm/yyyy:hh:mm:ss [+|-]hhmm). In addition, the IP address of the machine that initiated the dialup session is recorded if available.

NetProxy 2.0 Format	NetProxy 3.0 Format
DIALUP [31 Aug 1997 12:09:48]	DIALUP 192.168.0.12 [06/Jun/1998:13:28:52 +0100]

HANGUP

Log entries now have their date recorded in CERN httpd log format. In addition, the disconnection cause is recorded if known.

NetProxy 2.0 Format	NetProxy 3.0 Format
HANGUP [31 Aug 1997 14:23:04]	HANGUP [02/Jun/1998:19:44:13 +0100] 000-Normal disconnect. Idle Timeout

Some of the more commonly-occurring disconnect causes include:-

000-Normal disconnect. Idle Timeout
601-Invalid port handle
602-Port already open
629-The port was disconnected by the remote machine
631-The port was disconnected by the user
676-Line busy
677-Voice answer
678-No answer
679-No carrier
680-No dialtone
691-Access denied because username and/or password is incorrect
718-Timed out waiting for a valid PPP response from server

DNS

Unchanged from v2.0, other than timestamp format.

DNS 192.168.0.1:1815 [01 Sep 1997 14:19:16]

The IP address and port number of the requesting host (separated by a colon) appear in the second column.

TELNET

Unchanged from v2.0, other than timestamp format.

TELNET 127.0.0.1:3326 [31 Aug 1997 12:10:25] "finger status@gate.demon.co.uk"

TELNET 127.0.0.1:3326 [31 Aug 1997 12:10:49] "open pop3.demon.co.uk 110"

The IP address and port number of the requesting host (separated by a colon) appear in the second column.

The time of the request appears in square brackets and represents the system time on the NetProxy PC at the time the request was initiated.

The final column, contained within quote characters describes the operation requested. Finger requests are logged in the form "finger user@remotehost", Telnet sessions are logged in the form "open remotehost portnum". If no port number appears, the default telnet port (port 23) can be assumed.

FTP

Unchanged from v2.0, other than timestamp format.

FTP 192.168.0.1:2853 [02 Sep 1997 11:48:58] anonymous@src.doc.ic.ac.uk

The IP address and port number of the requesting host (separated by a colon) appear in the second column.

The time of the request appears in square brackets and represents the system time on the NetProxy PC at the time the request was initiated.

The final column identifies the FTP username and the name of the remote FTP server.

HTTP

This has changed significantly in order to allow for the performance of the cache to be recorded, and to more closely mimic the standard CERN httpd log format.

HTTP 195.153.161.131:1066 [09/Jun/1998:07:08:59 +0100] "GET http://www.knowledge.com/index.html HTTP/1.0" 200 1539

Which can be broken down as follows:-

HTTP requestingIPaddress:TCPport [standard date] "Full HTTP request" ResultCode BytesTransferred

Apart from the new date format, everything up to and including the "Full HTTP request" is the same as a NetProxy 2.0 log file. There are two new fields at the end of the line; ResultCode is a three digit code that can be one of the following:-

ResultCode	Meaning
200	OK
203	Resource was served from local cache (i.e. a successful cache hit)
304	Not Modified. The browser made a “Get page if modified since…” request and the requested resource had not been modified.
404	Resource not found or an error occurred during transfer.

The BytesTransferred field is recorded as follows:-

For a "200" result, this usually shows the number of bytes of the document body excluding any HTTP header information. This may be less than the total document size if the transfer is interrupted partway through.

For a "203" result, this shows the number of bytes of the entire document, including the HTTP header that were transferred. This may be less than the total document size if the transfer is interrupted partway through.

For "304" and "404" results, this field is not relevant and contains just a single hyphen.

SOCKS4

Barring the date format, this is the same as for NetProxy 2.0 except that the SOCKS username is added to the end of the request:-

NetProxy 2.0 Format	NetProxy 3.0 Format
SOCKS4 192.168.0.2:3124 [31 Aug 1997 12:09:48] 158.152.1.65:79	SOCKS4 192.168.0.2:3124 [31/Aug/1997:12:09:48 +0100] 158.152.1.65:79 fred

If no username was specified, the field contains a single hyphen character ( - ).

SOCKS5

This is a new entry that indicates SOCKS v5.0 traffic. The format is exacly the same as the SOCKS4 entry, apart from the fact the text "UDP" may appear at the end of the line to indicate an UDP port association rather than a mapped TCP port.

SOCKS5 192.168.0.2:3124 [31/Aug/1997:12:09:48 +0100] 158.152.1.65:79 fred UDP

DHCP

This is another new entry that describes DHCP (Dynamic Host Configuration Protocol) activity. There are three sub-types, DISCOVER, REQUEST, and RELEASE, defined as follows:-

DHCP DISCOVER - The client with the specified ethernet MAC address has broadcast a DHCP DISCOVER message to all DHCP servers on it's local network. The IP address offered by NetProxy in response to this is recorded at the end of the log entry.

DHCP REQUEST - The client with the specified ethernet MAC address has requested to use the IP address offered by NetProxy. If NetProxy authorises this use the log entry end with "Offered IP: a.b.c.d", otherwise it ends "Declined IP: a.b.c.d".

DHCP RELEASE - The client with the specified ethernet MAC address has released it's allocated IP address. The released IP address appears at the end of the log entry.

DHCP DISCOVER 00:40:95:04:C3:0A [10/Jun/1998:17:36:19 +0100] Offered IP: 192.168.0.2
DHCP REQUEST 00:40:95:04:C3:0A [10/Jun/1998:17:36:19 +0100] Offered IP: 192.168.0.2
DHCP REQUEST 00:40:95:04:C3:0A [10/Jun/1998:16:43:52 +0100] Declined IP: 10.1.1.2
DHCP RELEASE 00:40:95:04:C3:0A [10/Jun/1998:17:43:22 +0100] Released IP: 192.168.0.2

BLOCKED

The blocked entry has been enhanced to provide more information about unauthorised attempts to use NetProxy. The new format looks like this:-

BLOCKED 10.1.1.2 [10/Jun/1998:17:36:19 +0100] INCOMING TO HTTP
BLOCKED 192.168.37.12 [10/Jun/1998:17:36:19 +0100] INCOMING TO TELNET
BLOCKED 192.168.0.14:3201 [10/Jun/1998:17:36:19 +0100] OUTGOING TO 158.152.1.65 (TELNET)
BLOCKED 192.168.0.23:1198 [10/Jun/1998:17:36:19 +0100] OUTGOING TO 194.159.255.135 (FTP)

Connections blocked at the incoming stage have the connecting host's IP address logged, along with the name of the NetProxy service that the connecting host attempted to use in brackets.

Connections blocked at the outgoing stage have the connecting host's IP address and port number logged, along with the IP address of the destination host and the name of the NetProxy service being used in brackets.


Quick Start Guide

Here are some quick instructions and references for setting up NetProxy. If you run into difficulties, please consult the relevant sections of this help file for further information.

•	Install NetProxy and configure TCP/IP for the Network Interface on your PC with and IP address of 192.168.0.1 and a netmask of 255.255.255.0.

•	If NetProxy is to connect to the Internet using Windows dial-up networking (DUN), as is the case with most modem or ISDN connections, then start the Windows Control Panel application, and display the properties for “Internet”. Select the “Connection” tab and click the “Connect to the Internet using a local area network” option. This ensures that dial-on-demand access is fully controlled by NetProxy, rather than by Windows.

•	Start NPConfig (which will have been installed on the Start|Programs menu in Windows) and select the “System Service” option from the configure menu. This will ensure NetProxy starts up automatically each time the PC is rebooted.

•	Click the toolbox icon in NPConfig ( [image]) to display the NetProxy configuration wizard and fill in as much information as possible. Then click ‘OK’ to auto-configure NetProxy. This will create a secure setup, using DHCP to assign IP addresses in the range 192.168.0.2 to 192.168.0.254 for the machines on your network.

•	Configure the TCP/IP protocol for the network card on each of the machines on your network to “Obtain an IP address automatically” (this option may be called “Obtain an IP address from a DHCP Server” or “Use a DHCP Server” on some systems).

•	Configure the software you want to use with NetProxy by following these instructions.