# Configuration outbound proxy **URL:** https://meta.discourse.org/t/configuration-outbound-proxy/65992 **Category:** Self-hosting **Created:** [July 11, 2017, 9:19am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992 "2017-07-11T09:19:03Z") **Posts on this page:** 19 **Page:** 1
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [July 11, 2017, 9:19am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/1 "2017-07-11T09:19:03Z")
Our discourse runs behind a proxy for outbound traffic. We see that with “external system avatars enabled” selected the avatars are not loaded. Also the check for updates does not work. We have set http\_proxy and https\_proxy. In the logging the message “Job exception: invalid address” is repeated. How can we have outgoing requests working? ---
### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam) #### Post date: [July 11, 2017, 12:29pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/2 "2017-07-11T12:29:48Z")
Is this the letter avatars that is an issue or the uploaded avatars? Can you describe in detail how stuff is configured? ---
### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco) #### Post date: [July 11, 2017, 2:45pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/3 "2017-07-11T14:45:23Z")
What’s the format of your http\_ proxy variables? It has user and password inside? ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [July 12, 2017, 9:21am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/4 "2017-07-12T09:21:48Z")
We have no user and password, output from `set | grep -i proxy` ``` HTTPS_PROXY=http://:/ HTTP_PROXY=http://:/ NO_PROXY='127.0.0.1, localhost, ' http_proxy=http://:/ https_proxy=http://:/ no_proxy='127.0.0.1, localhost, ' ``` A curl from within the container, which uses the proxy-settings: ` curl -o /dev/null -v https://avatars.discourse.org/v2/letter/s/5f9b8f/45.png` results in: 200 OK ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [July 12, 2017, 9:27am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/5 "2017-07-12T09:27:08Z")
This is the letter avatars, but also the check for updates doesn’t work. It looks like all outgoing requests are failing. We have a docker-host based on the standalone.yml. In the `env: ` section we added the proxy-settings. Attaching to the running container shows that the proxy-settings are correct. ---
### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco) #### Post date: [July 12, 2017, 4:11pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/6 "2017-07-12T16:11:03Z")
Last time I had to work in an environment like this I found that Ruby is the worst language in this aspect, where most http methods don’t respect the proxy variables unless explicitly set, where java, python, node, php all work fine. _/rant_ You can try to emulate the version check with: ```ruby ssh root@your.server.here cd /var/discourse ./launcher enter app cd /var/www/discourse rails c puts Excon.send( :get, 'https://meta.discourse.org/latest.json', omit_default_port: true).body ## also puts ENV ## does this prints your proxy info? ``` It works or fail? What’s the error message? ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [July 13, 2017, 11:19am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/7 "2017-07-13T11:19:28Z")
No errors, all output looks fine. ``` root@93ca6a8ec7a6-discourse:/var/www/discourse# rails c [1] pry(main)> puts Excon.send( :get, 'https://meta.discourse.org/latest.json', omit_default_port: true).body {"users":[{"id":1,"username":"sam","avatar_template":"/user_avatar/meta.discourse.org/sam/{size}/5243_1.png"}, ... much more ... Frequent Poster","user_id":1,"primary_group_id":47}]}]}} => nil [2] pry(main)> ENV ... "HTTPS_PROXY"=>"http://:8082/", "HTTP_PROXY"=>"http://:8082/", ... "NO_PROXY"=> "127.0.0.1, localhost, ", ... "http_proxy"=>"http://:8082/", "https_proxy"=>"http://:8082/", "no_proxy"=> "127.0.0.1, localhost, "} ``` ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [August 16, 2017, 8:26am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/8 "2017-08-16T08:26:17Z")
Hello @Falco, Any ideas on my output? Peter ---
### Author: ![dvh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dvh/32/76895_2.png) [@dvh](https://meta.discourse.org/u/dvh) #### Post date: [August 22, 2017, 1:37pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/9 "2017-08-22T13:37:56Z")
We can emulate the version check and we can disable remote avatars, but are there any more outbound connections known? If not, these workarounds could work for us, but we’re not sure if we introduce some other problems then… ---
### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror) #### Post date: [August 23, 2017, 12:20am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/10 "2017-08-23T00:20:06Z")
You can simply disable version check in site settings at least. ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [August 23, 2017, 8:01am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/11 "2017-08-23T08:01:30Z")
We are not sure if there are other problems when we disable the version check and remote avatars. Are there any other outbound connections needed? As Dimitri also asked. ---
### Author: ![popey](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/popey/32/481041_2.png) [@popey](https://meta.discourse.org/u/popey) #### Post date: [October 11, 2017, 9:59am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/12 "2017-10-11T09:59:56Z")
@pvdr - did you get this fully resolved? We too are running a discourse behind a firewall which means youtube/github oneboxes don’t work as expected. I’m told by our IS that we may be able to allow outbound access to youtube via our internal corp proxy, and searching for help turned up this thread. ---
### Author: ![pvdr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pvdr/32/120637_2.png) [@pvdr](https://meta.discourse.org/u/pvdr) #### Post date: [October 12, 2017, 12:57pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/13 "2017-10-12T12:57:33Z")
We have problems also with the mail, so we haven’t migrated yet. The problems we had are not solved either. ---
### Author: ![SystemZ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/systemz/32/88354_2.png) [@SystemZ](https://meta.discourse.org/u/SystemZ) #### Post date: [July 29, 2020, 2:40am UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/14 "2020-07-29T02:40:46Z")
Anything changed in newer versions of Discourse? Is there now an easy way to setup outgoing proxy? Is important to hide origin IP from attackers if Cloudflare protection must work correctly. Related topics: > [@Discourse Link previews through a proxy server?](https://meta.discourse.org/t/discourse-link-previews-through-a-proxy-server/72720/21): > > Sure, but which of those 4 billion IPs is the right one if you can’t tell them apart? With proper opsec (e.g. firewall rules to only allow Cloudflare in and whitelisted traffic out) means you will be pretty safe. Until you aren’t because you missed a leak slight_smile For example, better proxy all your DNS as well. > [@Hiding the origin on cloudflare](https://meta.discourse.org/t/hiding-the-origin-on-cloudflare/94496): > > While researching Cloudflare and best practices to use to protect my server I ran into an article by Cloudflare about protecting the origin IP (the IP where the website is actually being ran from) because you would be able to circumvent all of Cloudflares ddos protection if you had it. What interested me was specifically this section: Never initiate an outbound connection based on user action If the attacker can get your web server to connect to an arbitrary address, they will reveal your … I can contribute to code if it’s necessary, I just need some tips which code needs to be refactored to use some kind of proxy settings. ---
### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie) #### Post date: [July 29, 2020, 4:52pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/15 "2020-07-29T16:52:39Z")
> [@SystemZ](#): > > Is there now an easy way to setup outgoing proxy? We don’t support this use case at the moment. My instinct is that this is probably best handled at the system level by intercepting outbound connections (or: all traffic not going to Cloudflare’s IPs) and shunting them to a local proxy of some sort. ---
### Author: ![SystemZ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/systemz/32/88354_2.png) [@SystemZ](https://meta.discourse.org/u/SystemZ) #### Post date: [July 29, 2020, 5:13pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/16 "2020-07-29T17:13:41Z")
> [@supermathie](#): > > We don’t support this use case at the moment. This is unfortunate. All kind of apps have proxy settings. Especially common in corp. closed environment. > [@supermathie](#): > > My instinct is that this is probably best handled at the system level by intercepting outbound connections (or: all traffic not going to Cloudflare’s IPs) and shunting them to a local proxy of some sort. Sure, any tips how to start with that? Iptables? Some example would be much appreciated 🙂 ---
### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie) #### Post date: [July 29, 2020, 5:22pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/17 "2020-07-29T17:22:58Z")
> [@SystemZ](#): > > This is unfortunate. All kind of apps have proxy settings. Especially common in corp. closed environment. For this case, I would suggest starting here: [Install discourse with internet access only via proxy](https://meta.discourse.org/t/install-discourse-with-internet-access-only-via-proxy/66396) In most of the closed environments I’ve worked with in the past, the traffic is usually forwarded transparently via the intercepting proxy. ---
### Author: ![SystemZ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/systemz/32/88354_2.png) [@SystemZ](https://meta.discourse.org/u/SystemZ) #### Post date: [July 29, 2020, 5:26pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/18 "2020-07-29T17:26:17Z")
I have no problem with installation, only with lack of customizable proxy for outgoing connections like crawling other websites. Correct me if I’m wrong, installation process vs working rails are separate in proxy settings. ---
### Author: ![68uproars](https://avatars.discourse-cdn.com/v4/letter/6/6a8cbe/32.png) [@68uproars](https://meta.discourse.org/u/68uproars) #### Post date: [December 28, 2024, 5:05pm UTC](https://meta.discourse.org/t/configuration-outbound-proxy/65992/19 "2024-12-28T17:05:44Z")
Did you solve this?