Apple Internet Recovery and Transparent Proxies

If you are running a transparent HTTP proxy on your network, you may have trouble with running Internet Recovery and Apple Hardware Test on Macs that support it.  You’ll see a “-4403D” or “-4403F” error.  For some reason, Apple’s servers return a 403 when they see the “via” header that many proxy servers send.  Here’s the configuration I used in Squid to turn off that header.  I also disabled the “forwarded-for” header – essentially, this makes it impossible for servers to determine that the request is coming through a proxy server:

# Be more anonymous
forwarded_for transparent
via off
visible_hostname proxy.local
httpd_suppress_version_string on