Skip to main content

​
Validate One Client First

Explicit proxy configuration is the fastest way to prove that a client can reach SafeSquid, send HTTP and HTTPS traffic through the proxy listener, and generate access-log evidence. Use it for a pilot or troubleshooting session only. Do not rely on manual browser settings for production-wide enforcement.

​
Use this method when

Use explicit proxy when:
  • You need a fast pilot before GPO, MDM, or PAC rollout.
  • You are testing one browser or workstation.
  • You are isolating routing, DNS, certificate, or policy behavior.
Do not use manual explicit proxy as the final enterprise control. Users can remove it unless endpoint policy prevents changes.

​
Validate prerequisites

Confirm:
  • SafeSquid is installed and activated.
  • Proxy listener IP and port are known.
  • Pilot client can reach the proxy network.
  • Access-log review is available.
  • Root CA trust is planned before HTTPS inspection tests.

​
Configure a pilot browser

Open Settings > Network & Internet > Proxy, enable manual proxy, set HTTP proxy to SAFESQUID-IP, and set the port to 8080 or the approved listener port. Add only approved internal bypass entries.
Firefox maintains its own proxy settings and ignores the operating system configuration by default. A pilot that only sets the OS proxy will show Chrome and Edge routing through SafeSquid while Firefox goes direct — and the traffic that bypasses the proxy is the traffic you will not see in any log.Configure it explicitly, on every platform:
  1. Open the menu (☰) and select Settings.
  2. Scroll to Network Settings and select Settings.
  3. Choose Manual proxy configuration.
  4. Set HTTP Proxy to SAFESQUID-IP and Port to 8080, or the approved listener port.
  5. Enable Also use this proxy for HTTPS.
  6. Set No Proxy for to the approved internal bypass entries, comma-separated.
  7. Select OK.
For managed fleets, deliver these through Firefox enterprise policy rather than by hand — see Enterprise Deployment.
On older Windows builds, or where the Settings app is restricted by policy, the same WinINET configuration is reachable through Control Panel:Control Panel → Internet Options → Connections → LAN SettingsEnter the proxy address and port there. The values apply to Chrome, Edge, and most Windows applications, because they read the same WinINET store.
Bypass list syntax differs by platform. Windows separates entries with semicolons (;); macOS and Linux use commas (,). Using the wrong separator makes the whole list parse as a single entry, so every internal destination silently routes through the proxy instead of bypassing it.
1

Set proxy host and port

Set HTTP proxy to SAFESQUID-IP and port 8080 or the approved listener port.Confirm the client setting uses the approved proxy IP and listener port.If the client cannot reach the proxy, confirm firewall policy, route, and listener state.
2

Apply HTTPS proxy settings

Apply the same proxy for HTTPS traffic before testing encrypted destinations.Confirm HTTPS destinations use SafeSquid rather than direct internet access.If HTTPS produces certificate warnings, deploy the SafeSquid Root CA before production testing.
3

Add reviewed bypasses

Add only approved internal bypass entries and record the owner for each exception.Confirm each bypass maps to an approved internal destination and owner.If internal sites fail, add exact reviewed bypasses instead of broad wildcard entries.
4

Save and test

Save the settings and browse to http://example.com.Confirm the request returns an HTTP response through SafeSquid and appears in the access log.If no log appears, retest with curl --proxy http://SAFESQUID-IP:8080 http://example.com.
For command-line validation, run:
Expected result: the request returns an HTTP response through SafeSquid.

​
Verify traffic evidence

On the SafeSquid server:
Expected result: the access log shows the pilot client, destination, timestamp, and action. For a negative check, remove or bypass the proxy setting only in the test window and confirm the request no longer appears in SafeSquid logs. Restore the proxy setting immediately after the test.

​
Capture deployment evidence

Store:
  • Pilot client hostname.
  • Proxy IP and port.
  • Browser or OS used.
  • Internal bypass list.
  • Access-log sample.
  • Rollback steps.

​
Troubleshoot pilot failures

Before assuming the proxy is at fault, confirm the client is actually applying the setting you think it is:
Expected result: the reported proxy matches the approved SafeSquid listener. A setting that was entered but not applied looks identical to a proxy that is not answering.

​
Next steps

Related topics

Connect Your ClientPilot Versus ProductionForward ProxyConfiguration SyncTransparent Proxy