SimpleProxyPAC

• kapad`25, created: 25.291, last update: 26.034

- What is it ?

• A proxy auto-config (PAC) file defines how web browsers and other user agents can automatically choose the appropriate proxy server (access method) for fetching a given URL.
• Read more...
  • https://en.wikipedia.org/wiki/Proxy_auto-config
  • https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol
  • https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file

- Why ?

• While trying proxy i2p and tor traffic, in a common browser, i met the following issues:

  • This very nice proxy addon https://github.com/FelisCatus/SwitchyOmega, doesn't work any more. In reality librewolf refuses to load it at all.

  • Tried to replace the above, with this also nice proxy addon https://github.com/foxyproxy/browser-extension, but it doesn't work for me the way i expected. Cant say, that is not my fault, but very often fails to automatically proxy traffic according to its config, even if the filters are quiet simple, and successfully tested.

  • Try to set an i2p local proxy as the browser's only proxy, and pass tor or any other traffic through it, is slow. Also, this approach have 2 more things:

    • if the i2p proxy is down, nothing works
    • if want to pass some clean traffic outside, that is impossible

- How...

• In general and in short, a PAC script, ( yes they are scripts even if we sense them like config ), consists of a single main function, your browser call each time wants to connect to a uri.

• The main function tests/checks the uri ( i think browsers pass only the domain part for privacy reasons ), and then replies ( directly or through another function ), a string lists the proxies available for the requested domain, separated by ; if more than one proxy is available. Here some example strings:

  • "SOCKS5 127.0.0.1:1234" - for a socks5 proxy
  • "SOCKS5 127.0.0.1:1234; SOCKS 127.0.0.1:5678;" - for a socks5 and a socks4 proxy
  • "HTTP 127.0.0.1:8080; HTTPS 127.0.0.1:8043;" - for http and https proxy
  • "DIRECT;" - for the system's proxy

- Any Example ?

• I make 2 simple PAC config that i currently use.
• It's quiet simple:
  • proxy domains like *.i2p to 127.0.0.1:4447 ( a local i2p proxy )
  • proxy domains like *.exit or *.onion to 127.0.0.1:9050 ( a local tor proxy )
  • proxy *googletagmanager.com or *adservice.google.com through a blackhole ( another way to block things )
  • for the rest:
    • Using SimpleProxy.pac, send rest traffic to default proxy ( if any )
    • Using SimpleProxyTor.pac, send rest traffic through tor

- What if my proxies are different ?

• Look inside SimpleProxy.pac or SimpleProxyTor.pac
  • at line #57 can set the tor proxy
  • at line #62 can set the i2p proxy

- How to Install and Use

• Install:

  • There are 2 ways to install a PAC script

  • 1. The server approach:
    • If you run a server, save this file in some path inside your server, and be sure is discoverable. Note down it's url, for example http://local.host/SimpleProxy.pac
  • 2. The static approach:
    • Save locally the file, in a place readable by your browser, for example /etc/SimpleProxy.pac or /home/user/SimpleProxyTor.pac

• Use:

  • open your browser, and for firefox like browsers,
    • go to: Settings > General > Network Settings, and set the Automatic proxy configuration URL point to your PAC config.
  • For example:

    • set http://local.host/SimpleProxy.pac if choose the server approach. ./browser-settings-url.jpg

    • set file:///etc/SimpleProxy.pac or file:///home/user/SimpleProxy.pac, if choose the static file approach. ./browser-settings-static.jpg

- What i should be care of ?

• Well..., the common things:

  • Don't use an online PAC url ( or any online something ), from a source that don't trust. If that PAC is ok at the time you choose it, an evil site can alter this config at any time, without you to notice it.

  • So, better use the static file approach:

  • • carefully choose your config
  • • and save it locally.

  • Don't use proxies you don't trust. No matter if conspiracy theories exists or not, a proxy is a computer, that watch, maybe log, even worst alter your traffic.

  • Especially protocols like tor or i2p, have to be proxied by yourself, in order to serve their purpose and try their best for your anonymity and your privacy.

  • Read to know, from what such a proxy can or cannot protects you. For example:

  • tor - https://support.torproject.org/about/protections/

  • i2p - https://geti2p.net/en/docs/how/intro , https://geti2p.net/en/docs/how/threat-model