How to Set Up a Proxy Server on Windows and Mac (Step-by-Step)

A proxy forwards supported connections between a client and a destination. The client needs to know where to send those connections. The server needs to be running, reachable and willing to accept them. Both parts matter, but they are different setup tasks.

Using an existing proxy

If your company, school or provider supplied a host and port, the Windows and Mac steps below are the relevant starting point. They configure cooperating applications to use that endpoint. A provider may instead supply a PAC address or its own application, in which case use the documented configuration method.

Hosting your own proxy

If you want your computer to become the server, you need appropriate proxy software and an access-control design before editing client settings. The operating system’s outbound proxy panel does not start a listener. A later section explains the additional requirements without assuming that a public open proxy is the desired result.

Read what a proxy server does and forward versus reverse proxies. These desktop instructions concern an outbound client proxy, not a reverse proxy placed in front of your website.

Collect the connection details before enabling anything. A wrong protocol or port can produce a timeout, authentication loop or misleading browser error. Save the original settings so you can return to the working configuration.

All example.com addresses in this guide are placeholders. They are not working proxy services. Replace them only with details from your administrator or provider. Ports such as 8080 and 1080 are examples; the port number alone does not identify the server’s protocol.

Check access rules before entering credentials

A proxy may authenticate a username and password, authorize your ordinary outward IP, require a client application or use an organization’s integrated authentication. If it uses IP allowlisting, moving between networks or changing VPN state can change the address it sees.

Use the appropriate configuration authority

A managed device may have enforced settings. If controls are locked or a change is overwritten, inspect the approved policy and ask the administrator rather than editing unrelated registry keys or removing profiles. A personal device gives you more freedom, but saving the original values still makes recovery easier.

Proxy terminology can describe the protocol used to reach the proxy, the destination traffic it handles or a product label. Resolve that ambiguity before choosing a field. An endpoint that accepts HTTP proxy requests is not interchangeable with a SOCKS endpoint.

HTTP proxies and HTTPS destinations

An HTTP proxy can forward ordinary HTTP requests and, when supported, establish a CONNECT tunnel for an HTTPS destination. In that latter arrangement, the browser normally negotiates TLS with the destination through the relay. Supporting HTTPS websites does not necessarily mean the client-to-proxy transport itself uses TLS.

A TLS-protected proxy hop is a separate property

Some clients support an HTTPS connection to the proxy itself. That protects that hop, while HTTPS to the destination protects a separate application exchange. Confirm support in the specific client and provider. A setting’s name or a website’s padlock is not enough to establish both properties.

SOCKS requires a compatible client

SOCKS relays supported network connections without using the same request format as an HTTP web proxy. DNS behavior, authentication and supported transports depend on the version and implementation. Do not enter a SOCKS-only endpoint into a generic HTTP proxy field and expect it to work.

See HTTP versus SOCKS proxies and types of proxy servers for a fuller comparison.

For the supported Windows interface, follow Microsoft’s proxy setup instructions. Windows 11 uses an edit dialog; Windows 10 presents similar controls directly.

1. Open Settings → Network & internet → Proxy.
2. Find manual configuration and open its edit controls.
3. Enable Use a proxy server.
4. Put the hostname or IP in the address box and the supplied port in its separate box.
5. Add only approved bypass destinations. Windows separates multiple entries with semicolons.
6. Choose the appropriate intranet-bypass behavior.
7. Save the change, reopen the affected application and test it.

Automatic Windows options

For an approved PAC URL, edit Use setup script, enable it, enter the script address and save. For network-managed discovery, enable Automatically detect settings when instructed. A Windows VPN connection can have separate proxy settings in its advanced options.

Separate fields are not a combined URL

If the form has an address box and a port box, put the hostname in one and the number in the other. Do not paste a credential-bearing URL into an address-only field. A provider’s combined connection string may be intended for another application.

Do not assume every Windows process follows the setting

Browsers and applications can use different networking libraries, their own proxy preferences or environment variables. A service running under another identity can have a different configuration. If only one app ignores the change, investigate its documented proxy support rather than repeatedly toggling the same Windows switch.

Apple’s Mac proxy settings guide documents per-network-service settings in the current System Settings interface.

1. Open System Settings → Network.
2. Select the active service, such as Wi-Fi or Ethernet.
3. Open its details, then Proxies.
4. Enable Web Proxy (HTTP), Secure Web Proxy (HTTPS) or SOCKS Proxy as required, then enter its server and port.
5. If required, enable password authentication and enter the supplied credentials.
6. Review bypass destinations; multiple entries use commas.
7. Confirm the changes and test the intended app.

For an approved PAC URL, use automatic configuration and enter that address. Use discovery only when the network’s administrator calls for it.

Configure the network service you actually use

A Wi-Fi service and an Ethernet service can have separate configuration. Changing one does not establish what happens after switching to the other. If you use multiple network services, record which ones should follow the proxy and test the relevant transitions.

Match the web option to the required traffic

The Mac web proxy options distinguish web traffic categories, but the label for secure web traffic should not be treated as proof that the proxy hop itself uses TLS. Check the endpoint’s documented protocol and the client’s actual support. When the same endpoint is intended for both web categories, verify that instruction rather than selecting every available proxy option.

Older interface names may differ

Older macOS versions use a different network-preferences layout. Follow the documentation for that version rather than looking for buttons from a newer screenshot. Keep the same conceptual values—service, protocol, server, port, authentication and exceptions—regardless of the layout.

A proxy auto-configuration file, or PAC file, provides routing decisions to a compatible client. It can direct one destination through a proxy and allow another to connect directly. It does not install a server or supply a device-wide traffic firewall.

A script can intentionally return a direct path

Some scripts include direct access as an exception or fallback. That may be appropriate for an organization’s policy, but it can conflict with a personal expectation that every request must use the proxy. Read the approved behavior instead of assuming a configured script always means a proxied connection.

Use a trusted configuration source

The script influences where supported requests go. Obtain its URL from the responsible operator and confirm that the host is correct. An automatic-discovery option depends on the network environment; it is not a mechanism for finding a trustworthy public proxy for you.

Exceptions are deliberate direct connections

A bypass rule changes coverage. Keep it as narrow as the actual requirement and use the syntax the particular client supports. A wildcard that appears safe in one client may not mean the same thing in another. Do not add a broad pattern simply because an internal site is failing.

Corporate internal names may also depend on company DNS or a VPN. A proxy exception alone does not make them resolve or become reachable. Diagnose name resolution and routing separately.

Authentication establishes whether the proxy accepts your connection. A username and password, source-IP rule and integrated enterprise login are different methods. Use the one supported by the endpoint and application.

A browser prompt may be normal

If the system proxy form does not store credentials, a compatible application may prompt when it first contacts the proxy. Other clients may need their own credential settings or enterprise authentication support. Repeated prompts can indicate a wrong credential, incompatible method or rejected source address.

Provider credentials may have a required structure

Some providers encode a location or session option in the username. Copy the documented format exactly rather than inventing suffixes. A dashboard login is not necessarily the same as the proxy credential. Also distinguish an account password from the separate endpoint authorization details.

Source-IP authorization changes with your network

If the proxy approves an outward IP, verify the address it sees from your current connection. A VPN, mobile hotspot or changed ISP address can alter that source. Do not solve the mismatch by expanding an allowlist to everyone.

Keep passwords out of screenshots, public diagnostics and shared configuration examples. A secure website connection does not necessarily encrypt proxy authentication on the client-to-proxy hop; use a supported protected path when that requirement matters.

A successful system configuration only helps applications that use it. Browsers can follow the operating system’s proxy choice, use their own settings or be controlled by an organization. Check the effective setting before assuming a browser failure means the endpoint is offline.

Chrome, Edge and Safari

For ordinary desktop browsing, start with the system proxy configuration. A browser’s proxy-settings link may open the operating system panel rather than expose a separate endpoint form. An extension, launch option or managed policy can change the effective behavior. Check those influences if one browser behaves differently from another.

Firefox

Firefox offers its own connection options. In Settings, search for “proxy” to find the configuration control for your installed version. Choose the system setting if you want it to follow Windows or Mac. Choose manual configuration only when you intentionally want a separate browser route. Mozilla’s connection-settings guide explains the available modes and exceptions.

For a SOCKS endpoint, select the supported version and check whether hostname lookup is delegated to the proxy. A SOCKS setting and a DNS setting answer different questions. Review any remote-DNS option rather than assuming the default is the same across versions and applications.

Test a second browser only after identifying its settings. A browser that is deliberately direct is a useful comparison, but it does not prove that every background application follows either route. See VPN vs. proxy for the difference in application coverage.

A command-line test can isolate the endpoint from a browser’s extensions, cache and system configuration. The following examples specify a proxy explicitly. They are diagnostic examples, not commands that install a server or change your computer’s permanent settings.

Replace the reserved example host and port with your authorized endpoint. These examples omit credentials and assume the server accepts your connection through its supported authorization method. They will not authenticate a username/password endpoint automatically.

Windows: explicitly call curl.exe

Use curl.exe so the command identifies the executable rather than a shell alias. If it is unavailable, use your approved installation method or a documented alternative.

curl.exe --proxy http://proxy.example.com:8080 --connect-timeout 10 --max-time 30 --head https://example.com/

Mac: test an HTTP proxy explicitly

curl --proxy http://proxy.example.com:8080 --connect-timeout 10 --max-time 30 --head https://example.com/

The http:// prefix describes the client’s connection to the proxy. The https:// destination requests an HTTPS website through that proxy, normally using a CONNECT tunnel. Those two schemes describe different hops.

SOCKS: intentionally choose where names resolve

curl --socks5-hostname proxy.example.com:1080 --connect-timeout 10 --max-time 30 --head https://example.com/

Use curl.exe for the equivalent Windows command. In curl, --socks5-hostname delegates destination hostname resolution to the SOCKS proxy; --socks5 resolves it locally. The official curl manual documents proxy schemes, authentication and these DNS options.

The timeouts make a failed test finish rather than wait indefinitely. A destination may reject a HEAD request, so an HTTP method error is not automatically a connection failure. Avoid putting passwords in command examples: shell history, logs and process inspection can expose arguments. Use your client’s supported credential handling and redact diagnostic output before sharing it.

For measured examples, see our HTTP-client routing experiment and proxy-password encryption study. The consumer portal access investigation adds a separate diagnostic boundary: a proxy may reject a tunnel before the destination receives a request. These studies do not directly test the Windows or Mac settings shown here.

A saved host and port are configuration evidence, not proof that the intended traffic uses the proxy. Verification needs an observed result from the actual app and destination you care about.

1. Record a baseline. Before changing settings, record the app, network, outward address and whether the destination works. Avoid mixing a home connection baseline with a later hotspot test.
2. Apply the configuration and open a fresh connection. Close and reopen the app if necessary. An already established connection can obscure the effect of a new setting.
3. Inspect the outward address through the configured app. Use an approved IP-checking service or an endpoint you control. The expected proxy exit may be shared or may rotate.
4. Check a representative destination. Test the site or API you actually need, including its login and downloads where relevant. A working homepage is not a complete application test.
5. Check exclusions separately. Confirm that an intentionally bypassed internal service follows the expected direct path. Do not label that deliberate exception a proxy failure.
6. Check DNS and address-family behavior. Establish what the client resolves locally and what it delegates. Test the actual supported route rather than assuming all IPv4 and IPv6 traffic is covered.
7. Check interruption and recovery. In a controlled session, observe what happens if the endpoint is unavailable, then restore it. A client may show an error or use an allowed fallback.

For rotating services, the exit can legitimately change between connections. Persistent sessions, location selection and rotation intervals depend on the service and account configuration. Compare the result with the provider’s documented mode; see proxy chains and rotating proxies for the underlying concepts.

A proxy changes a connection path. That alone does not specify encryption, anonymity, DNS handling or logging. You need to evaluate each property separately.

HTTPS remains important on both direct and proxied routes

For an ordinary CONNECT tunnel, correctly validated website HTTPS protects the application contents between your client and the website. The proxy still knows your connecting address and can observe the destination requested for the tunnel, timing and traffic volume. Plain HTTP contents do not gain website HTTPS protection merely because they pass through a proxy.

As checked on October 6, 2026, W3Techs reports that 90.2% of websites in its survey use HTTPS by default. Its definition concerns redirecting visitors from HTTP to HTTPS. This is a website-level adoption statistic, not the percentage of all internet traffic encrypted or a measurement of proxy safety. The remaining share does not necessarily mean those sites lack HTTPS support.

A trusted interception certificate changes the model

An organization can operate a proxy that inspects HTTPS using a certificate trusted by managed devices. That differs from an ordinary tunnel. Understand the documented workplace design. For a personal proxy setup, an unexpected certificate installation request deserves investigation before proceeding; do not dismiss browser certificate errors or disable validation as a troubleshooting shortcut.

DNS may take another path

With HTTP proxying, the client commonly sends the destination hostname to the proxy for the forwarded connection. With SOCKS, local versus remote lookup depends on the client and configuration. Browsers may also perform separate lookups or use secure DNS according to their own policy. These details make a single IP-address test insufficient for a DNS conclusion.

Read DNS leaks and prevention alongside WebRTC and IPv6 exposure when investigating traffic outside your intended route. A proxy configuration is not a device-wide VPN with automatic leak protection.

These visuals separate a sourced statistic from two chosen examples. The worksheet and timing samples help organize verification; neither is a survey of providers or a promise about your connection.

Website HTTPS defaults: a sourced adoption statistic

A ten-check setup worksheet

Compare repeated requests instead of one impression

For your own comparison, keep the destination, request size, device and network consistent. Record whether connection reuse, DNS caching and TLS setup are included. A geographically distant exit can add delay; caching or a different network route can change the result in either direction. Do not generalize from these invented values.

Start with the smallest reproducible failure. Identify the app, endpoint, protocol, authorization method and destination. Change one variable at a time so you know which change helped.

Read errors at the correct layer

A name-resolution error may concern the proxy host itself or the destination. A timeout can occur before authentication is attempted. A 407 is a proxy authentication response; a 403 requires identifying the responder. Once the proxy successfully forwards a request, the destination can still reject it for its own reasons.

Do not fix an endpoint problem by weakening every setting

Turning off certificate checks, removing authentication or opening a listener to everyone may hide the immediate symptom while creating a separate problem. Fix the address, policy, trust chain or supported authentication method that the evidence points to.

Record the original state before starting: enabled modes, endpoint, PAC URL and exceptions. A clean rollback restores that known state. It does not mean disabling every network feature indiscriminately.

Windows rollback

Return to Settings → Network & internet → Proxy. Turn off the manual proxy or setup script you enabled, or restore the original values. Restore automatic detection to its previous state rather than treating it as a universal on-or-off recommendation. If you configured a particular VPN connection’s proxy options, restore those separately.

Mac rollback

Return to the active network service’s proxy panel. Disable the specific protocol entries or automatic configuration you added, or restore their original values. Save the change and repeat the check for another service only if you also changed it. Restore exception lists if you edited them.

Remove app-specific overrides separately

System rollback does not necessarily change Firefox’s manual entry, a browser extension, a development tool’s environment variables or a command that explicitly supplies a proxy. Review each layer you touched. Restart the affected app to establish a fresh connection and test the direct or original route.

Hosting requires server software as well as client configuration. Choose software that supports your required HTTP or SOCKS behavior and operating environment. There is no universal installation command that safely covers every Windows or Mac deployment.

1. Define the users and purpose. A local development proxy, a household service and an enterprise gateway need different access rules, capacity and management.
2. Install maintained software from its official source. Follow that product’s platform instructions and review its supported authentication and transport options.
3. Choose the listening address. Loopback restricts access to the same machine. A LAN address or broader interface can accept other clients subject to firewall and server rules.
4. Restrict access before allowing remote clients. Configure appropriate authorization and network controls. Do not expose a public unauthenticated listener as a default setup.
5. Plan connectivity and naming. The clients need a reachable address. Router forwarding, remote access and DNS are separate tasks, and may be unnecessary for a local-only server.
6. Test with one authorized client. Use the configured listener’s actual protocol, host and port. Check permitted and rejected requests as well as normal browsing.
7. Maintain the server. Apply updates, review access records according to your privacy requirements, protect credentials and document shutdown and recovery.

A listener bound only to 127.0.0.1 is reachable through IPv4 loopback on its own machine; typing that address on another computer refers to that other computer. IPv6 loopback is ::1. Confirm which addresses the chosen server actually listens on instead of assuming both families are covered.

A forward proxy for clients and a reverse proxy in front of a website solve different routing problems. Installing the latter does not automatically create an outbound browsing proxy. Refer to reverse proxy vs. forward proxy before selecting the software category.

Choose against requirements that you can test: protocol, compatible applications, authentication, destination access, location, session behavior, support and data handling. A label such as residential or datacenter does not establish encryption or universal compatibility.

Compare residential and datacenter proxies when the exit network is relevant. If your actual goal is broader device traffic protection, read how VPNs work and split tunneling vs. full tunneling before choosing a system proxy as the solution.

A provider is one way to obtain an endpoint; an organization’s approved gateway or a properly maintained server may be appropriate instead. Evaluate the route and policy you need before selecting a service.

To configure a proxy on Windows or Mac, first identify the supported endpoint, protocol and authorization method. Enter them in the correct system or application panel, use trusted automatic configuration only when supplied, and keep bypass rules intentional.

Then verify the application’s actual route, DNS behavior and recovery. A proxy setting does not create a server, encrypt every hop or cover every process. With those boundaries clear, you can use an existing proxy confidently, troubleshoot a specific failure and restore your original connection when needed.