 WinProxy Help Index

License Agreement

Contacting Ositis Software

What is WinProxy..

What is WinProxy, How does it work, and how can I use it?

What is HTTP?

What is FTP?

What is Telnet?

What is an Intranet?

What is an IP Address?

How To ...

Contact Ositis Software

Entering a new serial number

Configure WinProxy

Configure your web browser to support WinProxy

Configure your FTP client to work with WinProxy

Use your Telnet client with WinProxy

Configure WinProxy remotely

Commands

File menu

Help menu

Dialogs

Setup Dialog

Enter Serial Number Dialog

About Box

Dial-Up-Networking Setup

HTTP Setup

FTP Setup

Telnet Setup

News Setup

Mail Setup

WinProxy Features

HTTP Proxy

Secure Sockets (SSL)

FTP Proxy

Telnet Proxy

Name Caching

Blacklist

Logging

Proxy Cascading


Contacting Ositis Software

Ositis software can be contacted at:

E-Mail:	VOsitis@NetCom.COM

Telephone:	510-537-6626.

Look for our web page at WWW.OSITIS.COM, which should be operational in August, 1996.

Please feel free to contact us with suggestions, feature requests, technical questions or customized versions of WinProxy.

For Ordering Information:

Please send a check or money order for $299.00 in US funds to :

Ositis Software

19364 Stanton Pl.

Castro Valley, CA. 94546

Include your name, company, telephone number, e-mail address and postal address.  We will send a permanent serial number via e-mail within 7 days of receiving your order.  Sooner if the order is done by money order.  If you desire the serial number by other means, please specify with your payment.  Keep in mind that we must charge sales tax to California residents if the serial number is delivered on paper.  (Apparently fax and e-mail are not ‘tangible’.  We don’t write the laws.. We just follow them.)

The serial number you receive entitles you to a single license of WinProxy and to upload free upgrades for six months after the serial number is issued.  There will be at least three releases in each calendar year and each registered customer will be notified by e-mail when new releases become available.  After your year of free upgrades expires, your current version of WinProxy will continue to function, but later versions will request a new serial number.  Upgrades that solve critical security problems, especially those that allow unauthorized computers to get into the firewall, will be free of charge to all registered customers.  (Don’t hold your breath.  There is no way to break in.)

Non-profit or educational institutions should contact Ositis Software for special pricing information.

We hope to be able to process credit-card orders and on-line orders within the next few months, we apologize for the inconvenience.

For Technical Support:

•	Look for information on our web page at WWW.OSITIS.COM. (hopefully up by August, 1996)

•	Send E-Mail to VOsitis@NetCom.COM.  Please include the following information:

•	Your name, company, e-mail, telephone number and postal address.  We will not respond to help requests without this information.

•	Your serial number (even if it is an evaluation number)

•	The operating system and type of computer you are using

The most effective way to contact us is through e-mail.


File menu commands

The File menu offers the following commands:

Properties	Configures the proxy server properties.
Set New Serial Number	If you are running the demonstration version of WinProxy, this menu is present and allows you to enter a new serial number.  If your current serial number is not a demonstration serial number, this menu item is not present.
Exit	Exits WinProxy.


Help menu commands

The Help menu offers the following commands, which provide you assistance with this application:

Help Topics	Offers you an index to topics on which you can get help.
About	Displays the version number of this application.


Properties Command (File menu)

The Properties Command in the File menu initiates the Setup Dialog, which allows you to configure the operation of the proxy server.


WinProxy Properties Dialog

Invoke this dialog by selecting Properties from the File menu.

The Properties dialog allows you to configure the operation of the proxy server.  The following items can be configured:

External IPAddress	Set the IP address which WinProxy uses to connect to the external network.  WinProxy will not accept connections on this address.  If this address is assigned dynamically, then select “Dynamic.”
Internal IP Address	Set the IP address on which WinProxy listens for connections. This should be your internal IP Address which is not accessible from the external network.  If you have multiple internal IP addresses, you should set this value to “Multiple,” and you should specify your external IP address
CERN Proxy Port	The configures the port used by the CERN proxy protocol.
Logging Port	This configures the port number used for logging.
Logging IP Address	This configures the IP address used for logging.
Cascading Port	This configures the port number used if you are cascading another proxy server.
Cascaded Proxy IP	This configures the IP address used if you are cascading another proxy server.
Administration IP	This specified the IP address used for administration.
Verify IP Addresses	This checkbox enabled IP verification using Reverse Name Lookup.
Use Dial Up Networking	Select this checkbox to enable automatic dial-up using Microsoft’s Dial-Up-Networking. Press the setup button to configure a location to dial, a user name and password.  If this box is selected, WinProxy will automatically connect to the Internet as it is required.  WinProxy can also hang-up after a specified duration of inactivity.
Supported Protocols	This area allows configuration of the individual protocols.
HTTP Protocol	This checkbox enables the HTTP protocol.
HTTP Protocol Setup	This allows you to configure the HTTP protocol options, including command filtering.
FTP Protocol	This checkbox enables the FTP protocol.
FTP Protocol Setup	This allows you to configure the FTP protocol.
Telnet Protocol	This checkbox enables the Telnet protocol.
Telnet Protocol Setup	This allows you to configure the Telnet protocol.


Set New Serial Number (File menu)

Use this command from the file menu to enter a new serial number.

This will initiate a Serial Number Dialog box requesting a new serial number.  If you already have a permanent serial number, then you are not required to enter a new one and this item will not be available in the file menu.

There are two types of serial numbers. Permanent Serial Numbers enable full use of WinProxy for an unlimited amount of time and entitles you to receive free upgrades for at least six months.  Temporary Serial Numbers are issued for demonstration purposes and allow full usage on WinProxy for a limited amount of time (usually 30 days or until the end of the Beta test period.)

If you already have a Permanent Serial Number for WinProxy, then this menu item can be used to specify a newer serial number..

If you do not currently have a Permanent Serial Number or are using a Temporary Serial Number, then your product will expire after a limited amount of time.  This menu will not allow you to enter a new Temporary Serial Number, but will allow you to enter a new Permanent Serial Number.  Once your free evaluation period expires, you will need to purchase a Permanent Serial Number to continue using WinProxy.

If you have not yet entered a Temporary or Permanent Serial Number, then this menu will allow you to enter either type of serial number to enable your evaluation period or permanent usage of WinProxy.

Contact Ositis Software to purchase a permanent serial number.


Exit command (File menu)

Use this command to end your WinProxy session.  You can also use the Close command on the application Control menu.  WinProxy prompts you to save documents with unsaved changes.

Shortcuts

Mouse:	Double-click the application's Control menu button.

Keys:	ALT+F4


Using Help command (Help menu)

Use this command for instructions about using Help.


About command (Help menu)

Use this command to display the copyright notice and version number of your copy of WinProxy.


Help Using Help Command

Use the Context Help command to obtain help on some portion of WinProxy.  When you choose the Toolbar's Context Help button, the mouse pointer will change to an arrow and question mark.  Then click somewhere in the WinProxy window, such as another Toolbar button.  The Help topic will be shown for the item you clicked.

Shortcut

Keys:	SHIFT+F1


Title Bar

The title bar is located along the top of a window.  It contains the name of the application.

To move the window, drag the title bar.  Note: You can also move dialog boxes by dragging their title bars.

A title bar may contain the following elements:

Application Control-menu button

Document Control-menu button

Maximize button

Minimize button

Name of the application

Name of the document

Restore button


Move command (Control menu)

Use this command to display a four-headed arrow so you can move the active window or dialog box with the arrow keys.

Note:  This command is unavailable if you maximize the window.

Shortcut

Keys:	CTRL+F7


System Minimize Command
Minimize command (application Control menu)

Use this command to reduce the WinProxy window to an icon.

Shortcut

Mouse:	Click the minimize icon [image] on the title bar.

Keys:	ALT+F9


No Help Available

No help is available for this area of the window.


No Help Available

No help is available for this message box.


What is an Intranet?

An Intranet is a network of computers that connects all of the

computers in an organization and is generally not accessible to

computers outside of that organization.


Multi-homed host

A multi-homed host is a computer that resides on two subnets and,

therefore, has at least two IP addresses.


IP Address

An IP Address is a 32 bit number, usually expressed as four numbers

separated by periods, such as 192.0.0.12.  This is a unique number in which

some of the most significant bits define a subnet.


Subnet

A subnet is a network of computers that communicate with each other

directly.  In a TCP/IP network, a number of significant bits in the IP Address

define the subnet.  IP Addresses that are not on the same subnet must be

reached by going through a router, which forwards network packets between subnets.


Connection

A TCP/IP connection is a link between two IP Addresses.  An application can listen

for a connection on a specific IP address and port number.  Other computers can

then establish a connection to that application by connecting to the specific IP

address and port number..  If the receiving computer is willing to establish a

connection, it will accept the request, completing the link.


Port Number

Each time a computer accepts or listens for a connection on a specific IP Address, it is using a Port Number.  The port number distinguishes various connections or network processes on a computer.

Although all connections have a unique port number, the port number is usually used to allow one process to connect with another specific process on a computer.  HTTP, for instance, uses port 80 to listen for connections.  By having a port number as well as an IP address, many processes can be listening for connections on a single computer.


HTTP

HTTP (HyperText Transfer Protocol) is the name of the protocol used by the World Wide Web.  This is a client/server based protocol that allows computers to retrieve documents from another computer.  The World Wide Web uses, but is not limited to, HTML documents.

HTTP servers usually listen for connections on port 80.


HTML

HTML (HyperText Markup Language) is a document encoding format, that allows documents to be written with links to other documents, images and bookmarks.  This format is used in the World Wide Web to format documents in a device and application independent way.


World Wide Web

The World Wide Web is a network of computers on the Internet that uses HTTP and HTML to provide graphical documents to Internet users.


FTP

FTP (File Transfer Protocol) is the name of the protocol used in the internet to transfer files between computers.  Although HTTP can also be used to receive files, FTP allows users to browse directories and upload and download files to a remote computer.

FTP servers usually listen for connections on port 21.


Telnet

Telnet is the name of the protocol used in the internet to connect to other computers through a remote connection.  The Telnet Protocol provides a standard way to communicate with another computer as if you were typing at the console of that computer.  Telnet does not, however, provide a graphical interface such as X-Windows.


CERN

CERN (European Laboratory for Particle Physics) is the birthplace of the World Wide Web.  The CERN group, including Tim Berners-Lee, known as the father or the World Wide Web, devised the HTTP protocol and the protocols used to proxy with it.  The CERN proxy protocol includes a method to proxy HTTP, FTP and other protocols through a HTTP proxy server.  This is the proxy protocol used by Netscape’s Navigator® and Microsoft’s Internet Explorer®.


Mail

Electronic mail is transmitted over the internet using two protocols: SMTP, and POP3.

When you send electronic mail, your e-mail client application first connects to its designated SMTP server, gives it your e-mail name the destination name and the text of the document you are sending.  The SMTP server then reads the text behind the ‘@’ in the destination address and connects to the POP3 server at that location and gives it the message you are transmitting.

The user on the other end later opens another e-mail application, which connects to the same POP3 server to determine if any mail has arrived.  The server responds with a message stating that mail has arrived and the e-mail client retrieves the mail.

Essentially, the SMTP server acts as a delivery agent to assist in sending mail.  An SMTP server, may, in fact, transfer the mail to another SMTP server before it stops in a POP3 server.

The POP3 Server is merely a post office that hold mail until a user is ready to read it.  This allows mail to be delivered to a computer that is not currently on-line, because when that user DOES come on-line, the mail will be waiting.


SMTP

SMTP or Simple Mail Transport Protocol is the protocol used to transmit mail to the receiving mail server.  Usually mail sent using SMTP ends up in a POP3 server where it can be retrieved by a user.

Mail may travel through multiple SMTP server before reaching a post office.

See also Internet Mail


POP3

POP3 or the Post Office Protocol is the protocol used to receive mail that is stored in a post office.  Since most mail recipients are not constantly on-line,

to the receiving mail server.  Usually mail sent using SMTP ends up in a POP3 server where it can be retrieved by a user.

Mail may travel through multiple SMTP server before reaching a post office.

See also Internet Mail


Serial Number

WinProxy requires a unique serial number in order to function.

There are two basic types of serial numbers available for WinProxy.

A Permanent Serial Number allows full use of WinProxy for an unlimited period of time, and works on future versions of WinProxy that have been released within one year of the date the serial number is issued.

A Temporary Serial Number allows full use of WinProxy for an evaluation period of 30 days.  Changing the date on the computer will not change the duration of the evaluation period.  When the evaluation period is over, WinProxy will not work until a Permanent Serial Number is entered.  WinProxy will not accept another Temporary Serial Number to extend the evaluation period.  Some Temporary Serial Numbers may be valid for 60 days.

The WinProxy serial number is fifteen characters long, separated into three groups or four, eight and three characters.

Contact Ositis Software to purchase a permanent serial number.


External IP Address

The External IP address is the IP address which WinProxy uses to connect to the Internet.  No incoming connections will be accepted on this IP address.

If your Internet address is assigned dynamically, this value should be set to “Dynamic” and the internal IP address must be specified.


Internal IP Address

The Internal IP address is the IP address which WinProxy will use to listen for connections.  This value should be set to the IP address that is directly connected to the internal network.

If Multiple is selected in this field, WinProxy searches your computer for available IP Addresses and permits connections from all IP addresses except for the address specified as the external IP address.

WinProxy will only accept connections on the internal IP address.  All other connections will be refused.  If this field is set to multiple, then WinProxy will accespt connections on all IP addresses except the external IP address.

NOTE: DO NOT CONFIGURE WINPROXY TO HAVE MULTIPLE INTERNAL IP ADDRESSES AND A DYNAMICALLY ASSIGNED EXTERNAL IP ADDRESS!  This could result is a security breach.


CERN Proxy Port

The port on which WinProxy listens for connections, using the CERN Proxy specification.

WinProxy supports the CERN Proxy protocol for HTTP and FTP.  A CERN proxy server will usually listen for connections on the HTTP port and proxy other protocols using the HTTP protocol.  Hence, it only listens for connections on a single port.

This is the proxy protocol used by Netscape’s Navigator® and Microsoft’s Internet Explorer®.

The range of valid values is from 1 through 32000.


Logging Port

WinProxy can log all activity that takes place through the proxy server.  Logging is done by establishing a connection between WinProxy and the WinProxy sample logging application, ProxyLog.  The connection is established when WinProxy is started or when it is specifically requested through remote configuration.  If WinProxy is unable to connect to a logging application, then it will continue to function with logging disabled.  For security reasons, WinProxy does NOT listen for a connection from the logging application.

The ProxyLog application listens for a connection on the port number specified here and writes all logging information to the screen as well as to a log file, if requested.  Although it is possible to send logging information outside of the intranet, this is not recommended, since it would be a significant security risk.

This parameter, along with the Logging IP Address, tells WinProxy the location of a logging application, which can even be located on the same machine as WinProxy.  Placing the logging application on the same machine as ProxyLog can reduce the bandwidth used for logging, but may open a security hole when the connection has not been established.  ProxyLog can be modified to prevent this problem, by requiring logging connection only from the local computer.

If this value is left blank (or invalid) then logging will be disabled.  This is an option when monitoring network traffic is not necessary.

The range of valid values for this setting is from 1 through 32000.


Logging IP Address

WinProxy can log all activity that takes place through the proxy server.  Logging is done by establishing a connection between WinProxy and the WinProxy sample logging application, ProxyLog.  The connection is established when WinProxy is started or when it is specifically requested through remote configuration.  If WinProxy is unable to connect to a logging application, then it will continue to function with logging disabled.  For security reasons, WinProxy does NOT listen for a connection from the logging application.

The ProxyLog application listens for a connection on the port number specified here and writes all logging information to the screen as well as to a log file, if requested.  Although it is possible to send logging information outside of the intranet, this is not recommended, since it would be a significant security risk.

This parameter, along with the Logging Port, tells WinProxy the location of a logging application, which can be located anywhere on the network or on the same machine as WinProxy.  See Logging Port or Logging Application for more information on logging.

This value must be a valid IP Address and should be somewhere within the intranet for security.  The Logging Port must also be specified for logging to be enabled.


Cascading Port

WinProxy can be run on a subnet behind another proxy server, providing an additional layer of security for that subnet.  In this case computers outside of the subnet will not have access to the computer inside of this subnet, and computers inside this subnet can communicate with other computers beyond a second firewall.

See Proxy Cascading for more information on cascading.

This value must be set to the port number of the next proxy server.  If this is left blank (or is invalid), then proxy cascading is disabled.  The Cascaded Proxy IP Address must also be configured for Proxy Cascading to function.

The allowed values are from 1 through 32000.


Cascading Proxy IP Address

WinProxy can be run on a subnet behind another proxy server, providing an additional layer of security for that subnet.  In this case computers outside of the subnet will not have access to the computer inside of this subnet, but computers inside this subnet can communicate with other computers beyond a second firewall.

See Proxy Cascading for more information on cascading.

This value must be set to the IP Address of the next proxy server.  If the Cascading Port is left blank, then proxy cascading is disabled.


Administration IP

Some WinProxy features can be configured through remote configuration.  Since there is some security risk in allowing anybody to perform these actions for WinProxy, it is possible to limit this function to be allowed only from a specific IP address.

If this value is set to 0.0.0.0 or left blank, then administration can be done from any computer behind the firewall.  Administration can NEVER be done from outside of the firewall, because WinProxy does not accept connections from outside the firewall.

If administration is to be disabled, then this value should be set to an invalid IP Address.  127.0.0.0 is a good choice, since it is not a valid IP Address.


Use Dial-Up-Networking

Check this box if you want WinProxy to automatically connect to the Internet when it is required.  The Dial-Up-Networking set allows you to configure where WinProxy should dial, what user name and password should be used and when the connection should time-out and be disconnected.


Verify IP Addresses With Reverse Name Lookup

A popular way of breaking into a firewall is to use DNS Spoofing or IP Spoofing.  By performing a Reverse Name Lookup on each connection and caching the results, WinProxy significantly reduces the risk of retrieving invalid information or connecting to a different network than was requested.

This checkbox enables this additional security feature in WinProxy.  If this is not selected, WinProxy will continue to cache names, but will not verify their validity through a Reverse Name Lookup.

If WinProxy finds that the Reverse Name Lookup does not return the requested name, the name and BOTH IP Addresses will be placed in the WinProxy blacklist.  They can be removed from the blacklist using remote configuration or by restarting WinProxy.

This feature protects people inside the firewall from receiving invalid information by connecting to a web server, that is masquerading as another.  For instance, a hacker could create a news report stating that the stock market has crashed, and pretend to be serving the web page for Reuters News Service.  The Reverse Name Lookup feature will add that IP Address to the blacklist, preventing users from receiving invalid information.

Another potential security risk in JAVA, which is usually allowed to connect only to the IP Address from which it was delivered.  Without this feature and Name Caching JAVA applets could connect to another IP Address, causing a security risk.

Some Windows TCP/IP packages do not support aliases correctly, and it may be the case that a reverse name lookup fails on a valid name.  When this happens that name and IP Address will be placed in the blacklist.  If this happens often, this feature should be disabled.  When this DOES happen, the blacklist should be reloaded from disk, using remote configuration.


Supported Protocols

This is a list of all supported protocols.  Each protocol can be enabled or disabled by using its checkbox on the left and can be configured by pressing the button on the right.

Each protocol has a different set of configuration options.

In the future other protocols will be added to this area.


HTTP Protocol

This checkbox enables or disables proxying of the HTTP protocol.

If this box is not checked, then the CERN HTTP proxy feature of WinProxy will be disabled.


HTTP Protocol Setup

Press this button to configure the HTTP Protocol options.

This invokes the HTTP Setup Dialog.


FTP Protocol

This checkbox enables or disables proxying of the FTP protocol.

This enables both the CERN FTP proxy as well as the regular FTP proxy features of WinProxy.

The regular FTP proxy uses the name@host type of proxy server.  It does NOT use a PASV proxy method.  To use the FTP proxy, it is recommended that you use an FTP client that is capable of using the name@host method, such as CuteFTP, available from ftp://papa.indstate.edu/winsock-l/ftp


FTP Protocol Setup

Press this button to configure the FTP Protocol options.

This invokes the FTP Setup Dialog.


Telnet Protocol

This checkbox enables or disables proxying of the Telnet protocol.

The Telnet protocol proxy accepts connections on the specified port, presents instructions for the user and requests the name of the Telnet host.

Because the Telnet protocol basically enables anybody inside the firewall to establish an unfiltered bi-directional connection to the outside of the firewall, MIS managers should consider disallowing this protocol for security reasons.

The Telnet proxy requires the destination connection to be on the Telnet port, 23.


Telnet Protocol Setup

Press this button to configure the Telnet Protocol options.

This invokes the Telnet Setup Dialog.


Mail Setup

Press this button to configure Internet Mail options.

This invokes the Mail Setup Dialog.


News Setup

Press this button to configure Internet News options.

This invokes the News Setup Dialog.


WinProxy Blacklist

WinProxy provides the ability to blacklist a series of host names and/or IP Addresses.  WinProxy compares all requests to the names and IP Addresses in the blacklist before completing the connection.  If the host name, IP Address or an alias is in the blacklist, then the connection will be forbidden.

The following is an example of a blacklist file:

; Comments in the blacklist file should be prefaced with a semi-colon

badhost.com

www.notsobadhost.com

; All connections to Latvia will be denied

lv

; Blacklist a specific IP Address

198.105.232.5

: Blacklist a name along with an IP Address

playboy.com	205.216.146.202

; Blank lines are ignored

; Bad blacklist string, only one name allowed per line,

; only microsoft.com will be blacklisted:

microsoft.com	msn.com

In the above example, the following requests would be allowed or denied:

www.badhost.com	Denied because of badhost.com
www.reallybadhost.com	Allowed, reallybadhost is a different domain from badhost.com
mail.notsobadhost.com	Allowed, only www.notsobadhost.com is disallowed.
web.notsobadhost.com	Denied, if web.notsobadhost.com is an alias for www.notsobadhost.com
www.latnet.lv	Denied, this is in the lv network.
lv.yahoo.com	Allowed, lv only restricts the network name
198.105.232.5	Denied, the IP address is blacklisted
www.playboy.com	Denied, in the playboy.com domain.
205.216.146.201	Denied, Reverse name lookup shows the name to be www1.playboy.com, which is a blacklisted name
205.216.146.202	Denied, the IP Address is blacklisted.

To deny access to a specific computer, it is recommended that the actual IP Address be used, since aliases are not always reported correctly in Windows TCP/IP stacks.  A hacker could use an alias to circumvent the blacklist.

The blacklist is read from a file named blacklist.pxy located in the working directory of WinProxy.  If you use a shortcut to execute WinProxy, then you should make sure that blacklist.pxy is located in whatever working directory is specified in the shortcut.


Logging Application

WinProxy ships with the source code and binary for a Logging console application called ProxyLog.EXE.

Registered WinProxy users (with a permanent serial number) are free to modify and distribute the ProxyLog source code and the binaries created from it.  In fact, we will be happy to help you distribute your logging application through our web site as soon as it is operational.

When WinProxy loads, it establishes a connection to a port and IP Address specified in the properties dialog.  If the connection is lost, remote configuration can be used to instruct WinProxy to reconnect to the logging application.

Once the connection is established, WinProxy will send logging information to the Logging Application, which can display it on the screen, save it in a file and sort or highlight it in any way desirable.  The current version of ProxyLog simply outputs all of the events to the screen and a file specified on the command line.

There is no communication from the logging application to WinProxy.


IP Spoofing

Since IP Addresses can be assigned by anybody to anything they desire, it is possible for a hacker, to publish themselves under an IP Address used by a legitimate business.  Connections requesting that IP Address, could fail to connect to the appropriate computer.  The hacker can then appear to be somebody else.

This is usually used with incoming connections, rather than outgoing connections, where a specific IP Address is required to gain access to a subnet.

WinProxy does not accept connections from anybody outside the intranet, and is, therefore, not susceptible to being fooled by incoming connections masquerading as another IP Address, but if the logging application is external to the intranet, a hacker could gain access to your private logging information.

Without authentication it is impossible to completely shield a company from IP Spoofing, but it is very difficult to do without direct access to an access provider or other key routers on the backbone.  Since the greatest danger is for incoming connections WinProxy is as safe a firewall as is possible.


Dial-Up-Networking Setup

Dial Up Networking enables WinProxy to connect to the Internet as necessary.  When a user connects to WinProxy, then WinProxy will automatically use Microsoft’s Dial-Up-Networking to dial the modem and connect to your service provider.

To enable Dial-Up-Networking, check the “Use Dial Up Networking” box in the Properties dialog, and then press the Dial-Up Setup button, to configure dialing.


DNS Spoofing

DNS (Domain Name Server) Spoofing is similar to IP Spoofing except that instead of pretending to be a different IP Address, a name lookup is faked to return an incorrect IP Address.  This is a fairly common way for hackers to gain access to proprietary information, including credit card numbers and bank accounts.

Each time the computer looks up a name, such as WWW.OSITIS.COM, it makes a request to a domain name server, which, if it does not know the IP Address, makes a request to another domain name server.  At any point, a hacker can intercept the request and provide a fake response pointing to their own IP Address.  Then when a request is made to that computer, instead of requesting a document from the computer specified by the name, the request will be made of the hackers’ computer.

WinProxy provides three types of protection against this type of attack:

Reverse Name Lookups are used to verify that the IP Address really represents the name that was requested.  This feature is enabled by the Verify IP Address option in the Properties dialog.

Name Caching remembers names that have been verified, reducing the number of name requests and, hence, reducing the risk of retrieving a false response.

Blacklisting is used to prevent subsequent requests to an IP Address that has been spoofed or to domain names that have been spoofed.  All names and IP Addresses that do not pass the Reverse Name Lookup are immediately Blacklisted.


HTTP Setup Dialog

Invoke this dialog by pressing the HTTP Setup button in the Properties Dialog.

The HTTP Setup Dialog allows you to configure HTTP command filtering.  To enable command filtering check the “command filtering” checkbox at the top of the dialog.  When command filtering is enabled, only the commands checked will be allowed in HTTP.  Most of the commands are proposed HTTP extensions and are not generally used.

The following commands are the most common.

Get	Retrieve a document from the server.  This is the most common command
Put	Put a document onto the server.  Used when authoring a web page.  This should only be permitted if it is necessary.
Connect	Used to establish a secure sockets connection.  WinProxy supports secure sockets proxying.  To disable secure sockets, disable this command.
Post	Used when filling out a form on the web and submitting the results.  If this is disabled, many standard web features will also be disabled.
If command filtering is disabled, then all commands will be permitted, even those that are not recognized.


Telnet Setup Dialog

Invoke this dialog by pressing the Telnet Setup button in the Properties Dialog.

The Telnet Setup Dialog allows you to configure the port number used to listen for Telnet connections.

The standard port number used is port 23.  For security reasons, the Telnet proxy will only connect to Telnet servers on port 23.  This, however, determines on which port Telnet is listening.


FTP Setup Dialog

Invoke this dialog by pressing the FTP Setup button in the Properties Dialog.

The FTP Setup Dialog allows you to configure the port number used to listen for FTP connections.

The standard port number used is port 21, but if your firewall is already running an FTP server on port 21, you may want to choose another port.


Mail Setup Dialog

Invoke this dialog by pressing the Mail Setup button in the Properties Dialog.

The Mail Setup Dialog allows you to configure the port number and IP Address used to connect to an external SMTP and POP3 server.

Mail Host IP:	This specifies the IP Address used to connect to an external SMTP server.  WinProxy will always use the SMTP port, 25, to connect to this computer.
Mail Proxy Port:	This is the port number on which WinProxy listens for SMTP connections.  All connections will be forwarded to the SMTP port on the IP Address specified by the Mail Host IP.  The default value for this field is 25.
POP 3 Server IP:	This specifies the IP Address used to connect to an external POP3 server.  WinProxy will always use the POP3 port, 110, to connect to this computer.
POP 3 Proxy Port:	This is the port number on which WinProxy listens for POP 3 connections.  All connections will be forwarded to the POP3 port on the IP Address specified by the POP 3 Server IP.  The default value for this field is 110.

Users should configure their e-mail mail servers to use the proxy server as their Mail and Post Office hosts.  Even though all e-mail transactions will take place with another computer, outside the firewall, to the e-mail application, WinProxy will appear to be the server.

Command filtering is not currently implemented for the mail protocols.


News Setup Dialog

Invoke this dialog by pressing the News Setup button in the Properties Dialog.

The Internet News (NNTP) Setup Dialog allows you to configure the port number and IP Address used to connect to an external News server.

News Server IP:	This is the IP Address of the external News server.  WinProxy will always use port 119 to connect to this computer.
News Proxy Port:	This is the port number on which WinProxy listens for News requests.  All connections will be forwarded to the News port on the IP Address specified by the News Server IP.  The default value for this field is 119.

Users should configure their news readers to use WinProxy as their News server.  Even though all News responses will ultimately come from the external News, outside the firewall, to the News clients, WinProxy will appear to be the server.

Command filtering is not currently implemented for the news protocol.


Host Name

Since IP Addresses are not easy to remember, users can identify computers by names instead.  The TCP/IP protocol can convert a name into an IP Address using a process called name resolution.  Names are organized in a hierarchical structure with a network name, a domain name, and a computer name.  For example in the name WWW.OSITIS.COM, COM is the network name, OSITIS is the domain name and WWW is the computer name.  Multiple names can point to the same computer, using aliases


URL

A URL (Universal Resource Locator) is a string that identifies a specific document on the network.  A full URL consists of a protocol, such as HTTP or FTP, a host name and a document path.  As an example:

HTTP://WWW.OSITIS.COM/Welcome.html

is a full URL.  the characters before the “//” designate the protocol, HTTP in this case, the subsequent string, WWW.OSITIS.COM, before the next slash are the host name and the remainder, Welcome.html, designate the document.  Any computer on the internet can use this URL to retrieve the same document.


Aliases

Computers on the internet can be referred to by names, which can be translated to an IP Address of the serving computer.  Several names, however can point to a single computer.  When this is the case, then one of those names is specific to that computer, and the others are aliases.


Reverse Name Lookup

Computers on the internet can be referred to by names, which can be translated to an IP Address.  After the name is translated to an IP Address, a Reverse Name Lookup can be used to translate the IP Address into a name, as well as its aliases.  This allows WinProxy to verify that the computer it is connecting to really is the computer that is expected.


Secure Sockets

In order to facilitate secure connections on the internet, the Secure Sockets (SSL) protocol was invented.  This protocol is used on a separate connection than regular HTTP and is encrypted to prevent hackers who have access to the network from tapping the connection.  This is often used to purchase products on the internet when private information such as credit card numbers must be exchanged.

WinProxy supports proxying of secure sockets.  This feature is automatically enabled with HTTP and can be disabled by enabling HTTP command filtering and refusing the connect command.


Telnet Proxy

WinProxy supports proxying of the Telnet protocol.  Since there is no industry standard way of proxying Telnet, WinProxy implements its own method of doing it.  To use the Telnet proxy, make sure that it is enabled in the Properties Dialog and perform the following steps in your Telnet application.

No special configuration is necessary to make your Telnet client work with WinProxy.

1) Connect to the Telnet port (usually 23, but this can be configured in WinProxy) on the WinProxy server

2) When prompted, enter the name of the Telnet server you wish to connect to.

3) When the connection is established, log onto the external server, as if you were directly connected to it.

The Telnet proxy requires the external server to be listening for a connection on the standard port, 23.  Other ports will not be allowed for security reasons.

Once the connection is established, the communication between the Telnet client and the host is not monitored or logged by WinProxy.

The Telnet Proxy feature of WinProxy can be enabled and configured from the Properties Dialog.


HTTP Proxy

WinProxy supports proxying of the HTTP protocol.  The method used is the industry standard CERN proxy method, and includes support for a CERN FTP proxy as well.

When a computer inside the firewall wants to view a document on the World Wide Web it makes a request to WinProxy, which makes a request on the network on its behalf.  If the request is for an FTP document, then WinProxy establishes a connection with the specified FTP server and returns the requested document in HTTP.

The HTTP Proxy feature of WinProxy can be enabled and configured from the Properties Dialog.

Configuring Netscape (version 3.0b4) to support the HTTP Proxy

1) Select Network Preferences from the Options menu.

2) Select the Proxies tab

3) Select Manual Proxy Configuration

4) Press the View button

5) In the HTTP Proxy: edit box, enter the host name or IP Address of the WinProxy server.

6) Enter the port number specified for the CERN proxy in the WinProxy Properties dialog.

7) Enter the same information in the Security Proxy: section.  See SSL

8) Enter the same information in the FTP Proxy: section.

9) Select OK in the Manual Proxy Configuration dialog

10) Select OK in the Preferences dialog.

11) Use

Configuring Internet Explorer (version 3.0b1) to support the FTP Proxy

1) Connect to a web page.  Internet Explorer can not be configured until is has successfully read a web page.  (I know, how do you connect to a web page without configuring the proxy?... Maybe later releases will fix this problem)

2) Select Options in the View menu.

3) Select the Connection tab

4) Check the box near the bottom labeled Connect to the internet through a proxy server

5) Press the Change Proxy Settings button.

6) If you are using WinProxy to proxy all protocols, check the box labeled Use the same proxy server for all types of addresses.  If you check this box, you will need to enter the data in the next step in the HTTP line of the configuration.

7) In the FTP line of the list of servers, enter the host name or IP Address of the WinProxy server in the first space and the port number of the CERN proxy, specified in the WinProxy Properties dialog in the second space.

8) If you did not select the option to use the same proxy for all protocols, then you will need to enter the same information for the FTP and Security (SSL) lines, if desired.

9) Press the OK button for the Proxy Settings dialog.

10) Press the OK button for the Options dialog

11) Use


FTP Proxy

WinProxy supports two methods for proxying of the FTP protocol.

The first method is the industry standard CERN proxy method which allows popular browsers to access FTP documents through HTTP requests.

The second method supports FTP clients using the “user@host” method.  With this method the FTP client must connect to WinProxy, and when a user name is requested, respond with user@host.  For example, if the client wants to log in as anonymous at FTP.CDROM.COM then they would respond with a user name of anonymous@ftp.cdrom.com.  WinProxy then establishes a connection to the specified host, and enters the requested name.  All future requests are passed through to the FTP client.

Configuring Netscape (version 3.0b4) to support the FTP Proxy

1) Select Network Preferences from the Options menu.

2) Select the Proxies tab

3) Select Manual Proxy Configuration

4) Press the View button

5) In the FTP Proxy: edit box, enter the host name or IP Address of the WinProxy server.

6) Enter the port number specified for the CERN proxy in the WinProxy Properties dialog.

7) Select OK in the Manual Proxy Configuration dialog

8) Select OK in the Preferences dialog.

9) Use

Configuring Internet Explorer (version 3.0b1) to support the FTP Proxy

1) Connect to a web page.  Internet Explorer can not be configured until is has successfully read a web page.  (I know, how do you connect to a web page without configuring the proxy?... Maybe later releases will fix this problem)

2) Select Options in the View menu.

3) Select the Connection tab

4) Check the box near the bottom labeled Connect to the internet through a proxy server

5) Press the Change Proxy Settings button.

6) If you are using WinProxy to proxy all protocols, check the box labeled Use the same proxy server for all types of addresses.  If you check this box, you will need to enter the data in the next step in the HTTP line of the configuration.

7) In the FTP line of the list of servers, enter the host name or IP Address of the WinProxy server in the first space and the port number of the CERN proxy, specified in the WinProxy Properties dialog in the second space.

8) Press the OK button for the Proxy Settings dialog.

9) Press the OK button for the Options dialog

10) Use

Configuring CuteFTP to support the FTP Proxy.

In the Windows environment, we recommend using the CuteFTP proxy client.  This is, by far, the most reliable and convenient FTP server that we have evaluated.

1) Select Options from the File menu.

2) Select the Firewall tab.

3) Enter the host name of the WinProxy server in the Host field.

4) Enter the port number specified in the WinProxy FTP Setup dialog (usually 21)

5) Set the type to USER user@site.

6) Check the Enable firewall access button.

7) Press the OK button.

8) Use


JAVA

JAVA is a programming language and environment invented by Sun Microsystems which provides a compatible environment over multiple platforms, allowing code written on one platform to be compatible over multiple platforms and easily retrieved over the network.

JAVA requires network support and primarily uses the HTTP protocol to exchange information among computers.


Remote Configuration

WinProxy provides the ability to do routine maintenance on the proxy server by remote configuration.  The features that can be accessed remotely are:

Flush the name cache

Open the logging connection

Reload the blacklist from file

Display the current blacklist

Remote configuration can only be done from behind the firewall and, if an Administration IP Address is specified, then the configuration can only be done from that IP Address.

To use Remote Configuration, execute a World Wide Web browser such as Netscape or Mosaic, which is configured to proxy through WinProxy, and request the URL

HTTP://Proxy.Command/Help

The browser will display a menu of options and how to use each one of them. selecting any of the specified links will perform the requested action.  Any document requested from the Proxy.Command host name will respond with the help menu, unless the requested document is, in fact, one of the commands listed here.

1) Flushing the name cache

WinProxy performs a name lookup and a reverse name lookup for each host name that is requested and places the results in a name cache.  Unless the cache overflows, the name is maintained in the cache for up to three hours.  This reduces the risk of retrieving incorrect IP Addresses from name lookups, accelerates access by reducing name queries, and increases security by causing one name to be guaranteed to resolve to the same address on multiple accesses (a feature that is especially important in JAVA security requirements.)

However, if the name of a server has recently changed, then it may be desirable to flush it from the cache, to allow future connections to retrieve the new IP Address.

2) Re-open the logging port

WinProxy provides logging of all transactions that pass through it.  This allows a network administrator to monitor network access to ensure it is not being abused and to trace any inappropriate activities.  Logging is done by connecting to a process either on the same computer as WinProxy or elsewhere on the network.  If the logging application is closed or the connection is lost, then this command can be used to re-establish the connection.

This command may NOT be used to terminate the connection to the logging application.  If WinProxy is already connected to a logging application, then this command will have no effect, and will report a failure to connect.

3) Reload the IP and URL blacklist

WinProxy provides the ability to Blacklist a list of IP Addresses and URLs.  Since the IP Verification with Reverse Name Lookups feature can automatically add names and IP Addresses to the Blacklist, and may even add valid names to the blacklist, it may be necessary to occasionally reload the Blacklist from disk.

When this command is issued, the blacklist will be purged and re-read directly from disk, as thought WinProxy were restarted.

While the blacklist is being re-loaded, no connections will be accepted in order to prevent allowing connections that are in the blacklist.  This, however, should provide no inconvenience since the blacklist is read very quickly.

4) Display the IP and URL blacklist

Since it is possible for names and IP Addresses to be added to the Blacklist by means of the IP Verification with Reverse Name Lookups feature, it may sometimes be necessary to view the current blacklist to determine if a specific IP Address or name is in it.  This command provides the ability to view the blacklist from any browser inside the firewall.

Network administrators should also use this function to verify that the blacklist was correctly read from the blacklist file.


Serial Number Dialog

This dialog requests a new serial number for WinProxy.  The serial number is separated into three groups of four, eight and three characters.

If there is currently no serial number, then any valid serial number will enable the use of WinProxy.

If an evaluation serial number has already been entered, then only a permanent serial number will be accepted.

When a permanent serial number has been entered, you will not see this dialog.

Contact Ositis Software to receive a permanent serial number.


What is WinProxy, How does it work and how can I use it?

WinProxy is a secure firewall proxy server for Windows ‘95 and NT.  Although it allows people behind the firewall to contact the network on the other side, it does not allow people outside to connect to the inside of the firewall.  Essentially it behaves like a diode for network traffic.

WinProxy is a proxy server that acts as a proxy on the network for users who are behind the firewall.  In essence, all of the users behind the firewall appear, to the external network, to be at the same IP address, hence the term proxy, as well as the mask icon.  As an example, when accessing the World Wide Web, your browser, Netscape for instance, connects to the proxy server, WinProxy, and makes a request for a specific web page, or URL.  WinProxy then creates a connection between itself and the web server, on behalf of your browser.  Retrieves the requested document, and forwards it to Netscape.  All of this happens behind the scenes and the user can use the browser as if they are directly connected from their machine, and computers on the internet, can serve documents, thinking they are serving the firewall machine.

Since no requests are made on the network that mention the IP address of the requesting machine, the IP addresses used behind the firewall do not need to be valid internet IP addresses.  In fact, it is a good idea to use invalid IP addresses to make sure that the operating system the firewall is running (Windows NT can do routing, although Windows ‘95 can not) does not route the packets.  Good choices for IP addresses are subnets 192.0.X.X and 127.X.X.X, which are reserved as a test network and loopback tests.  127.X.X.X may not work on some networks.


Name Cache

WinProxy provides a name caching feature that caches names and IP Addresses that have been verified using a reverse name lookup.

Each name is placed into the cache and stored for up to three hours, or until the cache is full and older names are purged from the cache.  Only names that have been verified are stored in the cache.

This security feature significantly reduces the risk of being served a bad name and improves performance by reducing the requirement for repeated name requests.  The JAVA virtual machine requires this feature to enforce its security, which requires that a JAVA applet only connect to the server from which it came.  Without name caching that can not be guaranteed, creating a security risk.

Since all names are cached, however, it is sometimes necessary to purge the name cache when a server’s IP Address has been changed, and the change needs to be implemented immediately.  This can be done through Remote Configuration.


Proxy Cascading

It is sometimes necessary to secure a network within another network, but still maintain the ability to access the internet behind another firewall  WinProxy provides this feature with Proxy Cascading.

Proxy Cascading enables WinProxy to forward requests from itself to another proxy server.  If, for instance, WinProxy is located between Network A and Network B.  Network B is connected to the internet through another WinProxy or other proxy firewall.

Net A -> Cascading WinProxy -> Net B -> Second Firewall -> Internet

Using proxy cascading the appearance to the users in Network A will be as though Net B were not even there.

Net A -> Cascading WinProxy ----------------------------------------> Internet

In reality all requests are still proxied through the external firewall, but users of Network A only have to configure their systems to proxy to the cascading WinProxy.

Cascading can be configured in the Properties dialog with the Cascading Port and Cascaded Proxy IP Address.

Cascaded proxies can be nested as deeply as desired, but network administrators should keep in mind that it degrades performance each time a proxy is cascaded.

Proxy cascading is currently only supported for HTTP and Secure Sockets requests.  Other protocols can be supported indirectly such as Mail and News, by pointing to the external proxy as the server.  Telnet can be done by logging into the first proxy, connecting to the second proxy and then outside.  Cascading does not provide access to the intermediate network, unless the next firewall provides access to it (which will be true in most cases, including the case of WinProxy serving as the external firewall.)

If you desire WinProxy to provide a more complete cascading solution, please contact Ositis Software.


Logging

WinProxy provides the ability to log all network activity that passes through it.

When WinProxy starts, it attempts to establish a connection with another application on the network on a IP Address and port number designated in the Properties Dialog.  When this connection is established, all logging information is transmitted to that application.  This application can be run anywhere on the network.

All HTTP requests and commands, FTP requests, and Telnet connections are logged with the date and time that they occurred.

The logging application can be located anywhere on the network and only needs to store or report the data it receives.  A sample logging application, ProxyLog.EXE is included with WinProxy complete with source code.  This program is written as a Windows ‘95/NT console application and outputs all logging information to standard out, and optionally writes it to a file.

Users of WinProxy are permitted and encouraged to augment the ProxyLog application to better support their needs.  If you make improvements to the ProxyLog application and wish to distribute your program in binary or source code form, please contact Ositis Software and we will consider assisting those efforts.  Any programs based on the ProxyLog source code must display a message stating that the code was based on ProxyLog, developed by Ositis Software.


ProxyLog.EXE

The Logging feature of WinProxy requires a logging application to display and save the logging information.  A Windows 95/NT program, called ProxyLog, is included with WinProxy to facilitate this capability.

Users of WinProxy are permitted and encouraged to augment the ProxyLog application to better support their needs.  If you make improvements to the ProxyLog application and wish to distribute your program in binary or source code form, please contact Ositis Software and we will consider assisting those efforts.  Any programs based on the ProxyLog source code must display a message stating that the code was based on ProxyLog, developed by Ositis Software.


WinProxy License Agreement

Press here to view the WinProxy readme file, containing the License Agreement.