title: Can CNTLM be configured to passthrough? Trying to achieve zero-configuration proxy switching for browsers, ssh, and the like
body: <p>My primary laptop shuttles between two office wifi environments (one behind an NTLM proxy and one require Cyberoam authentication) and various wifi/LAN environments.</p>
  
  <p>My network connectivity is managed by netctl[1], with a home-brew script which does the following:-</p>
  
  <ol>
  <li>Check if I'm in the NTLM office environment. If so, start cntlm[2].</li>
  <li>Check if I'm in the Cyberoam office environment. If so, start crclient[3] with the appropriate configuration variables. </li>
  </ol>
  
  <p>After this I modify a current_proxy config file and a proxy.pac file according to the current environment (basically set an empty proxy and a direct passthrough proxy.pac for everything except the NTLM environment, where instead I'd set them to point to cntlm).</p>
  
  <p>The current_proxy config file is sourced by my shells (as well as by launch scripts for my various internet-dependent apps like dropbox, skype,  hubic, chromium, etc.). Firefox's connection depends on the proxy.pac file.</p>
  
  <p>This works, though it's not too smooth. In particular it discourages me from simply putting my laptop to sleep, as firefox would need a proxy.pac reload, and basically all applications need to be restarted with a move between network environments. Another big issue is that I need two ssh configurations for every ssh target, one with corkscrew (for the NTLM environment) and one without.</p>
  
  <p>So my questions, in order:-</p>
  
  <ol>
  <li><p>Is it possible to use CNTLM with some sort of configurable passthrough. Such that all my apps simply expect a proxy at localhost:3128 and a CNTLM restart is all that's needed to switch from 'direct' connectivity to connecting through an NTLM proxy at my office.</p></li>
  <li><p>Failing that, is it possible (and fairly easy) to use iptables to configure (on the fly) all traffic to either go through cntlm or not.</p></li>
  <li><p>If both the above are not possible, would running a local squid (or similar) proxy allow for what I'm trying to do?</p></li>
  </ol>
  
  <p>[1] - <a href="https://git.archlinux.org/netctl.git/" rel="nofollow noreferrer">https://git.archlinux.org/netctl.git/</a></p>
  
  <p>[2] - <a href="http://cntlm.sourceforge.net/" rel="nofollow noreferrer">http://cntlm.sourceforge.net/</a></p>
  
  <p>[3] - <a href="https://www.cyberoam.com/cyberoamclients.html" rel="nofollow noreferrer">https://www.cyberoam.com/cyberoamclients.html</a></p>