# Mender client HTTP proxy support **URL:** \ **Category:** General Discussions\ **Tags:** proxy\ **Created:** [December 17, 2019, 7:20am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366 "2019-12-17T07:20:52Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![freibrun](https://avatars.discourse-cdn.com/v4/letter/f/5e9695/32.png) [@freibrun](https://hub.mender.io/u/freibrun)\ **Post date:** [December 17, 2019, 7:20am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/1 "2019-12-17T07:20:52Z")
Hi everyone, I’m trying to understand whether the mender client does support HTTP proxy to connect to a mender server. The only thing I found is this discussion saying it’s currently not supported: [https://groups.google.com/a/lists.mender.io/forum/#!msg/mender/hYak9bd3rXE/8cRKSCpiBgAJ](https://groups.google.com/a/lists.mender.io/forum/#!msg/mender/hYak9bd3rXE/8cRKSCpiBgAJ) And this reflects as well my observation. My mender client is not able to connect to a mender server inside our company network (which is using HTTP proxy). The HTTP\_PROXY setting seems to be ignored. Question: Did I miss something or is the mender client not supporting HTTP proxy? Is it planned to be supported in the future? Thanks, Bruno ---
**Author:** ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)\ **Post date:** [December 17, 2019, 6:29pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/2 "2019-12-17T18:29:57Z")
Hi @freibrun, I must admit I am not an expert on this area, but can’t you just use the “internal company IP” of the Mender server directly (instead of HTTP\_PROXY)? Mender does require TLS for all communication for security reasons, is that supported with HTTP\_PROXY or would HTTPS\_PROXY be needed? If support for this requires plaintext communication it is unlikely we can prioritize this due to security requirements, unfortunately. But again I am not an expert. 🙂 We are looking at adding support for reverse proxy (with TLS termination and initiation) for potentially different reasons (e.g. to forward requests from device to hosted Mender when there are restrictive security policies in place), not sure if this would be relevant here. Does that make sense? ---
**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\ **Post date:** [December 17, 2019, 6:47pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/3 "2019-12-17T18:47:26Z")
I also think that comment on the older thread is still valid and would try it out 🙂 [https://groups.google.com/a/lists.mender.io/d/msg/mender/hYak9bd3rXE/vQL\_ji6rAwAJ](https://groups.google.com/a/lists.mender.io/d/msg/mender/hYak9bd3rXE/vQL_ji6rAwAJ) Please report back if you have the opportunity to test it out. ---
**Author:** ![freibrun](https://avatars.discourse-cdn.com/v4/letter/f/5e9695/32.png) [@freibrun](https://hub.mender.io/u/freibrun)\ **Post date:** [December 18, 2019, 7:55am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/4 "2019-12-18T07:55:25Z")
Unfortunately I’m also not an expert on that topic. I just noticed that I get no connection to mender server inside our company network. Same is valid for any other services (such as apt-get, docker pull, pip install, …) as long as I don’t configure HTTP\_PROXY and HTTPS\_PROXY with our companies proxy. Once I set HTTP\_PROXY and HTTPS\_PROXY (and configure all extra portions needed for the different tools which handles proxies differently), all services are running and are able to connect “to the internet”. All except mender client. That’s why I wondered if there is any additional setting needed to let mender client connecting to mender server via proxy. I don’t think reverse proxy (used by servers) helps in this scenario. I’m looking for a forward proxy (used by clients). ---
**Author:** ![freibrun](https://avatars.discourse-cdn.com/v4/letter/f/5e9695/32.png) [@freibrun](https://hub.mender.io/u/freibrun)\ **Post date:** [December 18, 2019, 8:00am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/5 "2019-12-18T08:00:40Z")
> [@mirzak](#): > > I also think that comment on the older thread is still valid and would try it out 🙂 > > [https://groups.google.com/a/lists.mender.io/d/msg/mender/hYak9bd3rXE/vQL\_ji6rAwAJ](https://groups.google.com/a/lists.mender.io/d/msg/mender/hYak9bd3rXE/vQL_ji6rAwAJ) > > Please report back if you have the opportunity to test it out. Currently I have no opportunity to test it. As a workaround I simply switched to a “proxy free environment” for my ongoing mender tests. 😃 ---
**Author:** ![eystein](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@eystein](https://hub.mender.io/u/eystein)\ **Post date:** [February 11, 2020, 5:16am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/6 "2020-02-11T05:16:39Z")
@freibrun, This might have been fixed already, do you have the chance to test with Mender 2.2.0 or newer? There is also a Mender 2.3.0 beta right around the corner. There is a ticket here, but it looks like this issue has been fixed: [https://tracker.mender.io/browse/MEN-3110](https://tracker.mender.io/browse/MEN-3110) ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 12, 2020, 10:48pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/7 "2020-02-12T22:48:22Z")
What is the best way to rev the mender-client to 2.2.0 or 2.3.0 to test the HTTP/HTTPS\_PROXY env variables? Menderized sdimgs were created using using Mender-convert on raspbian and have client version 2.1.1 I currently have a number of pilot units running behind a proxy. ---
**Author:** ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)\ **Post date:** [February 13, 2020, 7:41am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/8 "2020-02-13T07:41:18Z")
2.1.2 is the latest of the Mender client, though there is a beta, 2.2.0b1 (technically released already, but not announced, very soon though). Don’t be confused by Mender 2.3, this is the whole product line, but it’s not the same as the client version. There will be a 2.0.0 Beta release of mender-convert soon as well, so just give it a few days. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 13, 2020, 2:33pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/9 "2020-02-13T14:33:15Z")
Hi @jem2e4 there is no need for you to upgrade the client in order to test this. The Changes should be present in `2.1.1` as well. ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 13, 2020, 3:38pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/10 "2020-02-13T15:38:56Z")
@oleorhagen Thanks for the reply. Does 2.1.1 use the system proxy or is it pulling from a different configuration. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 13, 2020, 5:08pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/11 "2020-02-13T17:08:24Z")
If by system proxy, you are referring to the internal golang http proxy implementation, then yes. I saw you edited your post, and will refer to that now, as I noticed there was an s missing in your `HTTP_PROXY`. I’m pretty sure you need to set the `HTTPS_PROXY` variable, then this should work transparently. To the best of my knowledge at least. ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 14, 2020, 6:47pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/12 "2020-02-14T18:47:53Z")
@oleorhagen, yes, great observation, both HTTP and HTTPS proxys are being added to the environment during boot as part of the provisioning script. After some review/testing here is some potentially useful data: The proxy server is also the nameserver and in reviewing HTTP and DNS traffic [hosted.mender.io](http://hosted.mender.io) resolves the 3 aws addresses 52.5.180.155, 34.205.112.193, 52.20.53.236 However, following the DNS lookup the proxy appears to be ignored with destinations being set to the aws servers?Src: 10.221.1.138 _Dst: 52.5.180.155_ Curl notes: curl [https://hosted.mender.io](https://hosted.mender.io) or [http://hosted.mender.io](http://hosted.mender.io) responds with a 301 (GET) curl [https://hosted.mender.io/api/management/v1/useradm/auth/login](https://hosted.mender.io/api/management/v1/useradm/auth/login) for a JWT with success (POST and CONNECT) In review Curl is able to traverse the proxy from the unit, but the mender client isn’t. Thoughts or ideas on configuration? ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 14, 2020, 7:07pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/13 "2020-02-14T19:07:25Z")
Note I downloaded the latest vanilla raspbian build and used the mender-convert master and added HTTP HTTPS proxy address into /etc/environment for testing purposes. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 17, 2020, 7:33am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/14 "2020-02-17T07:33:35Z")
Hmm, I see. Interesting. I will set aside some time later today, to dig into this a bit further. Thanks for the detailed information. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 17, 2020, 10:18am UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/15 "2020-02-17T10:18:06Z")
@jem2e4 is there any chance that you could run the client with the `-debug` flag, and attach the logs here, for my perusal? ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 17, 2020, 2:22pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/16 "2020-02-17T14:22:58Z")
@oleorhagen thank you, I believe we were able to get this working on the vanilla Raspbian Lite. Will post on details. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 17, 2020, 2:34pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/17 "2020-02-17T14:34:30Z")
Great! Curious to hear what the issues were! A good write-up will probably be a good reference for the community later on also. ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [February 19, 2020, 11:04pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/18 "2020-02-19T23:04:13Z")
@oleorhagen I hope this information is of use: Although, both env and my shell had the HTTP/HTTPS http/https proxy variables set correctly in my Golden Image and cURL as well as chromium browser would navigate the proxy correctly, Mender would not traverse it. The current Raspbian Buster Lite download had changes in relation to proxies. There is a file created under sudoers.d/010\_proxy with the following entries: > Defaults env\_keep += “http\_proxy HTTP\_PROXY” > Defaults env\_keep += “https\_proxy HTTPS\_PROXY” once the file was created on my GI build manually, mender client would check-in and download artifacts as expected. All that being said I’m a novice, and you may have a better understanding of these changes were needed and why. ---
**Author:** ![oleorhagen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/oleorhagen/32/297_2.png) [@oleorhagen](https://hub.mender.io/u/oleorhagen)\ **Post date:** [February 20, 2020, 12:08pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/19 "2020-02-20T12:08:08Z")
I see I might have been stupid here, but have a second look at your environment setup for the systemd service file for the mender-client. Good that it works now with the sudo environment (which mender needs). But the HTTPS\_PROXY variable can also be set on a unit file basis through the ENVIRONMENT variable 🙂 [https://www.freedesktop.org/software/systemd/man/systemd.service.html](https://www.freedesktop.org/software/systemd/man/systemd.service.html) ---
**Author:** ![jem2e4](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/jem2e4/32/504_2.png) [@jem2e4](https://hub.mender.io/u/jem2e4)\ **Post date:** [March 16, 2020, 5:45pm UTC](https://hub.mender.io/t/mender-client-http-proxy-support/1366/20 "2020-03-16T17:45:20Z")
Yes, I was not checking the active environment for mender-client. The HTTPS\_PROXY is not added to the mender-client environment during the mender-convert process nor when the service launches. Also, to speed up testing i was launching the mender -daemon which does pull the current environment HTTPS\_PROXY. The Squid Proxy server setup added a little more confusion as well. Simply put the HTTPS\_PROXY needed to be manually added to the Environment of mender-client.service [Next page](https://hub.mender.io/t/mender-client-http-proxy-support/1366.md?page=2)