Some of our systems have extra "security needs", and they are not allowed to initiate outgoing connections by default. This means that IP ACLs are used so that they can only reach neccessary services reach necessary services (SMTP gateway, DNS resolvers, NTP etc).

...

It support both IPv4 and IPv6:

Listen ::
#This# This will accept connections on IPv6, but also on IPv4: (IPv4-mapped IPv6 addresses are used:
#CONNECT Jan 04 15:29:13 [23566]: Connect (file descriptor 6): host.terena.org [::ffff:192.87.30.2]
Listen 0.0.0.0)
Listen ::

# This will listen on IPv4 only
Listen 2001:610:148:dead::6660.0.0.0
# This will listen only on the specified IPv6 address. Not nice, but workable.
Listen 2001:610:148:dead::666

Whitelist

I configured tinyproxy to block everything, except a list of domains, by using this configuration:

...

^(.*\.|)microsoftupdate\.com$
^(.*\.|)(s-)?microsoftmsftncsi\.com$
^(ocsp|crt)\.tcs\.terena\.org$
^(.*\.|)public-trust\.com$
^crl\.globalsign\.net$
^(.*\.|)windowsupdatesecunia\.com$
^(.*\.|)microsoftupdatethawte\.com$
^(.*\.|)secunia)(s-)?microsoft\.com$
^(.*\.|)vmwareusertrust\.com$
^ocsp\.comodoca\.com$
^(.*\.|)msftncsiverisign\.com$
^(.*\.|)public-trustvmware\.com$
^(.*\.|)windowsupdate\.com$
^(api|dellincca|)thawtedownloads|ftp|www)\.dell\.com$
^www\.adobe\.com$
^update\.exactsoftware\.com$

This list is the initial list. By monitoring the log files you can adjust the list. This is an iterative process, it takes a while to establish a list that is 'right'.

...

1. The "Windows Update" start menu items opens up http://update.microsoft.com/windowsupdate/v6/default.aspx in an Internet Explorer browser window. In order for this to work through a proxy, go to Control Panel -> Internet Options. This will bring up the IE settings dialog, settings dialogue  go to Connections -> LAN settings, and fill in the stuff there.

2. For automatic updates to work, go to Control Panel -> System -> Automatic Updates, and configure it to your needs (I usually let them install automatically because I don't have the time to look at all the updates, let alone test them. If an update screws up - though luck).
   The updates downloading is done by BITS, but this does not honour any of the stuff from Internet Options. Proxy settings for BITS are configured using the proxycfg command:

   Code Block

   C:\Documents and Settings\Administrator>proxycfg -p proxy.terena.org:8888 Microsoft (R) WinHTTP Default Proxy Configuration Tool Copyright (c) Microsoft Corporation. All rights reserved. Updated proxy settings Current WinHTTP proxy settings under: HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\ WinHttpSettings : Proxy Server(s) : proxy.terena.org:8888 Bypass List : (none)

     

...

C:\Users\Administrator>netsh winhttp set proxy proxy6.terena.org:8888 "<local>"
Current WinHTTP proxy settings:
    Proxy Server(s) :  proxy6.terena.org:8888
    Bypass List     :  (none)

...