# Ziti host over corporate proxy? **URL:** \ **Category:** Uncategorized\ **Created:** [December 3, 2023, 7:27pm UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868 "2023-12-03T19:27:40Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ChristianAnton](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/christiananton/32/747_2.png) [@ChristianAnton](https://openziti.discourse.group/u/ChristianAnton)\ **Post date:** [December 3, 2023, 7:27pm UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868/1 "2023-12-03T19:27:40Z")
Hi there, sooner or later it had to happen 🙂 I need to connect a ziti host (yes, using containers) via a corporate proxy. I thought it could "just work" ootb so I added the following to my deployment created by the ziti-host helm chart manually: ```auto - env: - name: ZITI_IDENTITY_BASENAME value: ziti-edge-ziti-host-identity - name: http_proxy value: http://my-awesome-proxy:3128 - name: https_proxy value: http://my-awesome-proxy:3128 - name: no_proxy value: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 ``` Unfortunately, it doesn't .... ```auto 8)[236.342] ERROR ziti-sdk:ziti_ctrl.c:154 ctrl_resp_cb() ctrl[client.sdn.my.company] request failed: -113(host is unreachable) ``` I have of course also tried http\_proxy und https\_proxy with capital letters, but didn't work either. Any tipps for me? Thanks ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [December 3, 2023, 8:13pm UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868/2 "2023-12-03T20:13:32Z")
Hi Christian! Would those proxies support CONNECT method? I know that's implemented in Ziti Router, and I don't believe it's implemented for `ziti-edge-tunnel`, which you're using in that `ziti-host` Helm chart. I found this mention of CONNECT support in the changelog for the main Ziti project where the Router code lives: [https://github.com/openziti/ziti/blob/release-next/CHANGELOG.md#http-connect-proxy-support](https://github.com/openziti/ziti/blob/release-next/CHANGELOG.md#http-connect-proxy-support) I'll check on egress proxy support for ziti-edge-tunnel too, but it may be necessary to host the service with a Ziti Router if that's the only component that can use a CONNECT proxy. To accomplish that with the Router you would install the `openziti/ziti-router` chart. Ensure you enable the router's built-in tunneler when you create the Router in the Ziti management API, CLI, or console. The Router chart has a default tunnel mode of "host," which has the same behaviors as the hosting mode of `ziti-edge-tunnel` that's used by the `ziti-host` chart. When you create the Router with tunneler enabled, you'll see a system-created Ziti Identity too with type "Router." This is the new Router's built-in tunneler. Assign bind privilege to that Ziti Identity in your Bind Service Policy. ---
**Author:** ![ChristianAnton](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/christiananton/32/747_2.png) [@ChristianAnton](https://openziti.discourse.group/u/ChristianAnton)\ **Post date:** [December 7, 2023, 9:38am UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868/3 "2023-12-07T09:38:27Z")
Hi @qrkourier, long time no hear 😉 Actually, I believe corporate proxy support would be very beneficial to be supported by the ziti-edge-tunnel for any kind of enterprise network setups. And yes, of course, talking about CONNECT method and not supporting TLS intercept or anything like that, but just plain proxying. ---
**Author:** ![emoscardini](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/emoscardini/32/753_2.png) [@emoscardini](https://openziti.discourse.group/u/emoscardini)\ **Post date:** [December 7, 2023, 5:33pm UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868/4 "2023-12-07T17:33:36Z")
Hi @ChristianAnton ziti-edge-tunnel doesn't have the capability to use proxies but we've needed to to work around this issue for demos. We were able to use a third party software called proxychains to get this functional. This is not production recommended but it does work. We haven't tried this in a container but imagine it would also work. In order to do this with a container, you'd need to build a custom version of the ziti-edge-tunnel container(or custom container in general) & add in something like proxychains along side ziti-edge-tunnel. If you did so, you could use it to capture the outbound traffic & forward it through the proxy. Here's the steps we followed NOT using a container, this would need to be adapted to a container version: ```auto Proxy Chains setup(install & basic setup): sudo apt install proxychains4 vi /etc/proxychains4.conf Add a proxy config like(protocol/proxy address/port): http 172.18.102.231 3128 Add an exception for the local networks(or any other networks you need), example: localnet 172.18.102.0/255.255.255.0 Uncomment: localnet 127.0.0.0/255.0.0.0 ``` ```auto ZET changes(startup needs to be altered to use proxychains): Edit service file /opt/openziti/share/ziti-edge-tunnel.service Add "proxychains " to the front of both ExecStartPre & ExecStart Reload the daemon: systemctl sudo systemctl daemon-reload ``` Hope that helps until ziti-edge-tunnel has that functionality added. ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [December 17, 2023, 7:15pm UTC](https://openziti.discourse.group/t/ziti-host-over-corporate-proxy/1868/5 "2023-12-17T19:15:41Z")
Note to others following these instructions: I found it necessary to modify the systemd service unit to have an absolute filesystem path to the `proxychains4` executable. I'd installed with Linuxbrew, so my paths were like this. ```bash ExecStartPre=/home/linuxbrew/.linuxbrew/bin/proxychains4 /opt/openziti/bin/ziti-edge-tunnel.sh ExecStart=/home/linuxbrew/.linuxbrew/bin/proxychains4 /opt/openziti/bin/ziti-edge-tunnel run --verbose=${ZITI_VERBOSE} --dns-ip-range=${ZITI_DNS_IP_RANGE} --identity-dir=${ZITI_IDENTITY_DIR} ``` Don't forget to load the changes! ```bash sudo systemctl daemon-reload ```