Home

Name Resolution Policy Table (NRPT) Support

%3CLINGO-SUB%20id%3D%22lingo-sub-664177%22%20slang%3D%22en-US%22%3EName%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-664177%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20%2F%20will%20Edge%20Chromium%20support%20reading%20of%20NRPT%20tables%3F%20If%20not%2C%20is%20this%20on%20the%20roadmap%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-667989%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-667989%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F353590%22%20target%3D%22_blank%22%3E%40Dave_Lee%3C%2FA%3E%26nbsp%3B-%20Chromium%20detects%20whether%20any%20NRPT%20rules%20have%20been%20configured%20and%20if%20so%20takes%20that%20into%20account%20in%20a%20few%20places%2C%20but%20it%20does%20not%2C%20itself%2C%20utilize%20the%20NRPT%20tables.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHowever%2C%20I'm%20interested%20in%20learning%20more%20about%20your%20scenario.%20On%20Windows%2C%20by%20default%2C%20Chromium%20uses%20the%20system's%20DNS%20resolver%20(instead%20of%20using%20its%20own%20built-in%20resolver)%20and%20that%20means%20that%20the%20NRPT%20tables%20should%20be%20taken%20into%20account.%20If%20you're%20seeing%20something%20else%2C%20I'd%20be%20interested%20in%20learning%20more.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%5BIn%20Edge%2C%20you%20can%20see%20the%20details%20of%20DNS%20resolutions%20for%20the%20current%20process%20by%20visiting%26nbsp%3B%3CSTRONG%3Eedge%3A%2F%2Fhistograms%2FNet.DNS.TotalTimeTyped%3C%2FSTRONG%3E%26nbsp%3Bin%20the%20address%20bar.%20If%20you%20see%20a%20Net.DNS.TotalTimeTyped.%3CSTRONG%3ESystem%26nbsp%3B%3C%2FSTRONG%3Ehistogram%2C%20that%20means%20that%20the%20system%20resolver%20is%20getting%20used.%20IF%20you%20see%20instead%26nbsp%3BNet.DNS.TotalTimeTyped%3CSTRONG%3E.Async%26nbsp%3B%3C%2FSTRONG%3Ethat%20means%20that%20the%20built-in%20(non-system)%20resolver%20is%20getting%20used.%5D%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-673542%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-673542%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F317619%22%20target%3D%22_blank%22%3E%40ericlaw%3C%2FA%3E%26nbsp%3B%20Thanks%20for%20the%20response.%20We%20are%20big%20users%20of%20Direct%20Access%2C%201000%2B%20machines%2C%20and%20in%20order%20to%20send%20traffic%20for%20specific%20sites%20%2F%20domains%20down%20through%20the%20DA%20tunnel%2C%20we're%20utilising%20%22Selective%20Tunnelling%22%20which%20requires%20us%20to%20manipulate%20our%20NRPT%20tables.%20Here%20is%20an%20article%20on%20the%20subject%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdirectaccess.richardhicks.com%2F2018%2F05%2F14%2Fdirectaccess-selective-tunneling%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdirectaccess.richardhicks.com%2F2018%2F05%2F14%2Fdirectaccess-selective-tunneling%2F%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20cannot%20use%20%22Force%20Tunnelling%22%20as%20we%20use%20S4B%20voice%20which%20cannot%20go%20through%20the%20DA%20tunnel.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAt%20the%20moment%2C%20only%20IE%2011%20and%20old%20Edge%20read%20the%20NRPT%20tables.%20Chrome%2C%20Firefox%20and%20Edge%20Chromium%20ignore%20the%20entries%20we've%20made.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20the%20scenario%20-%26nbsp%3BWe%20have%20many%20hosted%20services%20that%20are%20locked%20down%20to%20our%20two%20corporate%2C%20public%20facing%20IP's.%20Any%20attempt%20to%20access%20these%20services%20over%20other%20connections%20will%20not%20work%2C%20i.e.%20on%20DA%20when%20working%20remotely.%20Via%20the%20use%20of%20NRPT%20table%20manipulation%20and%20Selective%20Tunnelling%2C%20we%20can%20make%20these%20services%20available%20to%20our%20remote%20users%20as%20we%20force%20the%20traffic%20back%20down%20the%20DA%20tunnel%20and%20out%20of%20our%20corporate%20DIA's.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-692464%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-692464%22%20slang%3D%22en-US%22%3E%3CP%3EAny%20thoughts%20on%20this%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F317619%22%20target%3D%22_blank%22%3E%40ericlaw%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20think%20this%20ability%20will%20be%20needed%20by%20DA%20and%20Always%20On%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-751163%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-751163%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239638%22%20target%3D%22_blank%22%3E%40Elliot%20Kirk%3C%2FA%3E%26nbsp%3BCan%20you%20help%20answer%20this%20one%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-912372%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-912372%22%20slang%3D%22en-US%22%3E%3CP%3EStill%20hoping%20for%20further%20clarification%20on%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-912441%22%20slang%3D%22en-US%22%3ERe%3A%20Name%20Resolution%20Policy%20Table%20(NRPT)%20Support%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-912441%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F353590%22%20target%3D%22_blank%22%3E%40Dave_Lee%3C%2FA%3E%26nbsp%3BAt%20present%2C%20Chromium-based%20browsers%20do%20not%20make%20use%20of%20name-resolution%20policy%20tables%20for%20determining%20the%20proxy.%20Investigations%20into%20changing%20that%20remain%20underway.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3ENRPT%20rules%20that%20govern%20DNS%20lookups%20(e.g.%20getHostByName())%20continue%20to%20impact%20those%20resolutions%20as%20long%20as%20Chrome%20is%20set%20to%20use%20the%20system%20DNS%20resolver%20(as%20it%20is%20by%20default%20on%20Windows).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%20that%20you%20can%20direct%20the%20new%20Edge%20to%20use%20the%20%22system%22%20Proxy%20resolver%20instead%20of%20the%20one%20built%20into%20the%20browser%2C%20which%20means%20that%20NRPT%20should%20be%20taken%20into%20account.%20To%20do%20so%2C%20launch%20Edge%20thusly%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%3CSTRONG%3Emsedge.exe%20--winhttp-proxy-resolver%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3EI%20would%20be%20interested%20to%20learn%20if%20this%20helps%20in%20your%20scenario.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Dave_Lee
Occasional Contributor

Does / will Edge Chromium support reading of NRPT tables? If not, is this on the roadmap?

7 Replies

@Dave_Lee - Chromium detects whether any NRPT rules have been configured and if so takes that into account in a few places, but it does not, itself, utilize the NRPT tables.

 

However, I'm interested in learning more about your scenario. On Windows, by default, Chromium uses the system's DNS resolver (instead of using its own built-in resolver) and that means that the NRPT tables should be taken into account. If you're seeing something else, I'd be interested in learning more.

 

[In Edge, you can see the details of DNS resolutions for the current process by visiting edge://histograms/Net.DNS.TotalTimeTyped in the address bar. If you see a Net.DNS.TotalTimeTyped.System histogram, that means that the system resolver is getting used. IF you see instead Net.DNS.TotalTimeTyped.Async that means that the built-in (non-system) resolver is getting used.]

@ericlaw  Thanks for the response. We are big users of Direct Access, 1000+ machines, and in order to send traffic for specific sites / domains down through the DA tunnel, we're utilising "Selective Tunnelling" which requires us to manipulate our NRPT tables. Here is an article on the subject https://directaccess.richardhicks.com/2018/05/14/directaccess-selective-tunneling/

 

We cannot use "Force Tunnelling" as we use S4B voice which cannot go through the DA tunnel.

 

At the moment, only IE 11 and old Edge read the NRPT tables. Chrome, Firefox and Edge Chromium ignore the entries we've made.

 

Here is the scenario - We have many hosted services that are locked down to our two corporate, public facing IP's. Any attempt to access these services over other connections will not work, i.e. on DA when working remotely. Via the use of NRPT table manipulation and Selective Tunnelling, we can make these services available to our remote users as we force the traffic back down the DA tunnel and out of our corporate DIA's.

Any thoughts on this @ericlaw 

 

I think this ability will be needed by DA and Always On users.

@Elliot Kirk Can you help answer this one? 

Still hoping for further clarification on this.

@Dave_Lee At present, Chromium-based browsers do not make use of name-resolution policy tables for determining the proxy. Investigations into changing that remain underway.


NRPT rules that govern DNS lookups (e.g. getHostByName()) continue to impact those resolutions as long as Chrome is set to use the system DNS resolver (as it is by default on Windows).

 

Note that you can direct the new Edge to use the "system" Proxy resolver instead of the one built into the browser, which means that NRPT should be taken into account. To do so, launch Edge thusly:

 

   msedge.exe --winhttp-proxy-resolver

I would be interested to learn if this helps in your scenario.




Really appreciate this response @ericlaw 

 

I'll be sure to post back our findings.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
48 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies