Outbound proxy (HTTP CONNECT)¶

Some networks do not let any host reach the internet directly: all outbound 443 must go through a mandatory HTTP proxy. This is common in banks and large enterprises. On those networks the RTA cannot open its OpenVPN tunnel straight to the headend, so it has to be told to route that one connection through the proxy instead.

The appliance supports this. It can send its OpenVPN tunnel through an HTTP proxy using HTTP CONNECT, the same tunnelling method a browser uses to reach an HTTPS site through a proxy. You configure it on the appliance console in a minute or two; no redeploy is needed.

When you need this

Only configure a proxy if outbound TCP/443 on this network must traverse a web proxy. If the appliance can reach the internet directly (even through a plain Layer-3 firewall), leave the proxy unset. See Connectivity troubleshooting for how to tell the difference.

What the appliance supports¶

Capability	Supported
HTTP CONNECT proxy (tunnelling TCP/443 to the headend)	Yes
No authentication (open proxy)	Yes
Basic authentication (username and password)	Yes
NTLM / Kerberos / digest authentication	Not via self-service

NTLM, Kerberos, and digest proxies

The self-service flow on the console handles unauthenticated and basic-auth proxies only. If your proxy requires NTLM, Kerberos, or digest authentication, contact your Sophos engagement lead: those environments need a different setup and we will help you configure them.

Configure a proxy on the appliance console¶

This is the primary path. Everything happens on the appliance's own console screen.

From the dashboard, press 1 (Configure Network), then 3 (Proxy Settings).
What you see next depends on whether a proxy is already set:
- No proxy configured yet: you go straight to the Configure Proxy form.
- A proxy is already configured: you first get a Proxy Settings modal with 1) Change proxy / 2) Remove proxy / Esc) Back. Choose Change proxy to open the form pre-filled with the current host, port, and username. The password is never pre-filled; to keep authentication, re-enter it.
Fill in the Configure Proxy form. The fields, in order:
- Proxy Host (required): the proxy's hostname or IP address.
- Proxy Port (required): the proxy's port, 1-65535.
- Username (optional): leave blank for a proxy with no authentication.
- Password (optional): masked as you type; leave blank for a proxy with no authentication.
Save the form. Within the form, Tab moves between fields, Enter saves, and Esc cancels without changing anything and returns to the menu you came from (the Configure Network menu for a new proxy, or the Proxy Settings menu when changing one).

Changing an authenticated proxy

When you change a proxy that uses authentication, the Username is pre-filled but the Password is not; re-enter the password to keep authentication. If you clear both the username and password, the console first asks you to confirm with a Proxy Authentication prompt: "The current proxy uses authentication. Saving now will remove the username and password." Choose Yes to save it without authentication, or Cancel (the default) to go back and re-enter the credentials. Keeping the username but leaving the password blank is rejected as incomplete ("username and password must be set together"), so re-enter the password.

On save, the appliance writes the proxy into its VPN configuration and restarts the VPN. The banner confirms:

Proxy saved. Restarting the VPN; watch the OpenVPN indicator.

The dashboard then shows a Proxy: host:port row in the Network column, and the Headend indicator turns green once the tunnel comes up through the proxy. If it does not go green after a minute, see Troubleshooting below.

Removing a proxy

To go back to a direct connection: from the dashboard press 1 (Configure Network), 3 (Proxy Settings), then 2 (Remove proxy) and confirm. The VPN restarts and reconnects directly to the headend, with no proxy in the path.

What the proxy must allow¶

The proxy has to permit an HTTP CONNECT to the headend on TCP/443, and it must not try to inspect what flows through that tunnel.

Allow CONNECT to this destination


Method	HTTP `CONNECT` (tunnel establishment)
Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port	TCP 443
Payload inside the tunnel	OpenVPN, not HTTPS

The payload the appliance sends through the CONNECT tunnel is OpenVPN, not HTTPS. A proxy that performs TLS inspection or protocol enforcement (only allowing "real" HTTPS through a CONNECT) will break the connection. On such a proxy, exempt connect.remotetesting.secureworks.com from inspection and allow the CONNECT to pass through untouched. This is the same requirement as for an inspecting firewall; see Connectivity troubleshooting and the firewall guides for the exact framing to hand your network team.

The proxy handles the tunnel, not the firewall rules

Routing through the proxy replaces the appliance's direct path to the headend; it does not remove the underlying requirement to reach connect.remotetesting.secureworks.com:443. The proxy (and anything between the proxy and the internet) still has to allow that destination.

Ship the appliance with a proxy already set¶

If you already know this network requires a proxy before the appliance is even built, you do not have to configure it on the console at all. Tell your Sophos engagement lead the proxy host, port, and (if needed) credentials, and we can preconfigure the proxy into the appliance so it connects through the proxy on first boot. The self-service console flow above stays available either way, so you can still change or remove the proxy later.

Troubleshooting¶

If the Headend indicator does not turn green after you save a proxy:

Check the dashboard proxy row. Confirm the Proxy: host:port row shows the host and port you intended. If it is wrong, re-open Proxy Settings → Change proxy and correct it.
A proxy-path fault shows up on the console as a web-proxy problem with a short "where to look" line and a docs link. Press 2 (Troubleshoot) for the detailed evidence.
Check proxy reachability. From a host on the same segment, confirm the proxy's host and port are reachable and that the proxy allows CONNECT to connect.remotetesting.secureworks.com:443.
Check credentials. For a basic-auth proxy, re-enter the password (the Change-proxy form pre-fills the username but never the password, so a blank password field does not mean the old one was kept).
Check inspection exemptions. If the proxy does TLS inspection or protocol enforcement, make sure connect.remotetesting.secureworks.com is exempt so the OpenVPN payload is not blocked.

Still stuck?

Read the Connectivity troubleshooting overview for the full connection model, then contact your Sophos engagement lead with what the console shows (the proxy row and the Troubleshoot screen).