Proxy auto-configuration (WPAD)

Network → Local DNS → Network proxy (WPAD) (GET|PUT /api/v1/wpad, administrators), off by default. WPAD is a classic way to take over the web traffic of a network: turn it on only to give the devices a proxy you run yourself (a business filter, a cache). When on ({"enabled": true, "host": "proxy.maison.lan", "port": 3128, "exceptions": ["bank.example", "10.8.0.0/16"]}, applied at once):

• Warda answers wpad.<local domain> with its own address, like warda.<local domain>;
• its plain HTTP port serves GET /wpad.dat and GET /proxy.pac, without sign-in (application/x-ns-proxy-autoconfig), to the allowed clients only, and only to a request that names the box or wpad.<local domain> (DNS rebinding): direct for the names without a dot, the local domain, local, home.arpa, localhost, the exceptions, the local IPv6 addresses and the private, loopback, link-local and shared (CGNAT) IPv4 networks; else PROXY host:port; DIRECT (direct when the proxy does not answer);
• with its DHCP server on, Warda gives http://wpad.<local domain>/wpad.dat in the option 252 of its answers (DHCPINFORM included), with the port of WARDA_HTTP_LISTEN when it is not 80 (http://wpad.maison.lan:8080/wpad.dat).

WPAD works best with Warda on port 80: the devices that find the configuration by the name wpad alone (DNS) only try port 80; the page warns otherwise.

The proxy is a name or an IP address and a port (1 to 65535); the exceptions, 50 at most, are domains (with their subdomains) or IPv4 networks: nothing else goes into the file the browsers run. Off, wpad stays a name no device can take, wpad.<local domain> answers nothing (NXDOMAIN) and the file is not served (404). The setting is in the backups.