Fiddler 4 with Websense Proxy

[Jim]

We're trying to get the latest version of Fiddler to work with our Websense Proxies. The Proxies have an endpoint which forces a PAC file for all of the local browsers. Is there a way to configure Fiddler to work with the Websense proxies? 

[Eric Lawrence]

Hi, Jim! By default, Fiddler will automatically chain to any previously configured system proxy. So, if your IE settings are set to use a PAC file, Fiddler will automatically adopt that PAC file as its upstream proxy configuration before setting itself as the system proxy. Then, when Fiddler shuts down, it will restore the proxy setting to whatever it was before Fiddler started.

Generally speaking, you shouldn't need to "configure" Fiddler at all; it should just work.



Regards,

Eric Lawrence

Telerik

[Christopher]

I am not albe to get fiddler to work with our websense proxy servers.  I tried to change the settings according to this Link (http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ChainToUpstreamProxy) however I do not have the Connections tab (i assume it's locked by the system admins). 

I also tried to change it via registry settings (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable) but it keeps going back to 0.

Is there anyway to configure fiddler to make this work?

Thanks

[Eric Lawrence]

Hello, Christopher--

Please explain what specifically you mean when you say you're not able to get Fiddler to "work." What exactly happens? What do you see in Fiddler? What do you see in your browser?

Manipulating the registry is pretty much guaranteed not to work; if the IT admins have configured your system with Group Policy, they've probably set the ProxySettingsPerUser=0 setting so that non administrators cannot set the proxy. If you are a machine admin, running Fiddler as Administrator will typically work. If not, you'll need to speak with your IT Admins about getting an exemption, or use Fiddler with Firefox or Chrome, both of which typically are not required to use the system's proxy settings. (Firefox has a manual UI for setting a proxy; Chrome allows you to pass the --proxy-server command line argument). 

Regards,
Eric Lawrence
Telerik

 

 

[Christopher]

Eric, running Fiddler as Administrator worked!  Thank you very much!

[Glenn]

We just had Websense implemented last night.  This morning, Fiddler no longer is capturing any traffic.  We have a production migration of our application in three days, and we use Fiddler to connect to our 20 application servers.  

I checked IE - it uses an automatic configuration script (http://pac....).  I tried running Fiddler as an administrator - it still doesn't capture any traffic.

Any ideas?

[Eric Lawrence]

Hi, Glenn--

It sounds like “WebSense” may be preventing changes in the IE proxy settings through some undocumented or unsupported mechanism.

When Fiddler is running and in “Capturing” mode, click Tools > WinINET Options in Fiddler and click the “LAN Settings” button. What settings do you see? If they aren’t pointed at 127.0.0.1:8888 it means that WebSense is likely breaking the supported API for changing proxy settings.

You’ll want to talk to the WebSense vendor about how to configure their tool to use supported APIs and configurations.

If you’re only interested in traffic from Firefox or Chrome, you can typically configure them not to use the System (IE) proxy settings and thus point them directly at Fiddler.

Regards,
Eric Lawrence
Telerik

 

 

[Christopher]

When I click Tools > WinINET Options in Fiddler and click the “LAN Settings” button I get the following error
    Access to this feature has been disabled by a restriction set by your system administrator.

We will reach out to the vendor to find out what change is needed.  Once we figure this out I'll update you.

Thanks.

[Eric Lawrence]

Hello, Christopher-- the message in question means that your administrator has disabled the Internet Control Panel using Group Policy. This means it is quite likely that they've also locked the IE proxy settings such they can only be set by Administrators/Admin processes.

Regards,
Eric Lawrence
Telerik

 

 

[A]

Hi Eric, 

I am trying to use Fiddler to log traffic and also use an external proxy using a PAC file. 

I want to use Fiddler to debug our app in the schools where we run iton iPads. We suspect that some of the calls are being blocked by the school's proxy (websense), but we can not verify that since we can either have Fiddler's proxy address in iPad or School's pac file's URL. How do I do it so that I can see all the HTTP and HTTPS traffic going through the device which should go through the school's proxy ultimately (may be fiddler picking up the system's proxy and routing all the traffic through it?)

Hope to receive a reply soon. Thanks.

[Eric Lawrence]

Hello, AJ--

In the future, please open a new topic rather than piling onto an older unrelated thread; this will help ensure your question isn't lost and will be less confusing to future readers.

What you wrote below suggests you already understand what to do-- without Fiddler running, set the Fiddler PC's proxy settings to point at the PAC file, then start Fiddler so that it adopts the PAC file as the upstream gateway. Then point your iPads at Fiddler which will forward the requests to the PAC-file-specified gateway proxy.

Having said that, you haven't mentioned whether your WebSense proxy is configured for HTTPS decryption? If so, please understand that this configuration will fail for any site using HTTPS Certificate Pinning, because certificate pinning will cause the WebSense-generated certificate to be treated as invalid.

Regards,
Eric Lawrence
Telerik

[Saeed]

Hi

 we use websense on our organization. the websense agent manage the proxy setting and the users can change/delete the configuration script which have the pac file script. we checked some solutions without success. any idea?     

[Eric Lawrence]

Hi, Saeed--

In the future, please open a new topic rather than piling onto an older unrelated thread; this will help ensure your question isn't lost and will be less confusing to future readers.

I'm not really sure what question you're asking or what problem you're encountering. Can you clarify?

If the problem is that there's some software on the client that constantly reconfigures the proxy setting so that it is not pointed at Fiddler, then yes, you'll need to disable that software to use Fiddler with IE. With Firefox and/or Chrome, the proxy settings can be specified directly (in the Network Settings control panel of Firefox or the --proxy-server command line argument of Chrome) such that it doesn't matter what the system proxy setting is.

Regards,
Eric Lawrence
Telerik