Proxies, VPN and network

Adding SOCKS5, OpenVPN and WireGuard proxies, what each test result means, and why a session refused a proxy. Back to the Help center.

• Add an OpenVPN (.ovpn) or WireGuard (wg0.conf) proxy — Open Proxies → Add proxy, choose Type OpenVPN or WireGuard, then paste the whole .ovpn or wg0.conf into the box or use Upload a .ovpn file / Upload a wg0.conf file.
• Add and save a SOCKS5 proxy in the desktop app — Open Proxies → Add proxy, choose Type SOCKS5, give it a label, fill Host, Port and (if the provider gave them) Username and Password, then press Add proxy.
• Use one proxy for several profiles (Assign to profiles) — In the Proxies tab, open a proxy's Assign to profiles… ("Use this proxy for profiles you choose"), tick the profiles, and press Use for N profiles.
• HTTP proxies can be saved but not used for a session — You can save and manage an HTTP proxy, but it cannot carry a session on this deployment.
• .ovpn refused or 'Proxy config was rejected': unsupported lines / script-security — Driftstack never runs scripts from a VPN config, so a .ovpn with a script line (up, down, route-up, plugin…) is refused and the message names the line.
• .ovpn references an external ca/cert/key file (must be inline) — Only the .ovpn text itself is sent to the session, so a line like ca ca.crt, cert client.crt, key client.key, tls-auth ta.key or tls-crypt … that points at a separate file cannot…
• 'Proxies are not configured' / 'VPN proxies are not available on this installation' — These messages come from the installation itself, not from your account or your proxy.
• 'This proxy changed since you last loaded it' / folders and tags changed elsewhere — Proxies live on your account, so another computer, a teammate, or a script using your key can change one between the moment you loaded it and the moment you save.
• Stored proxy configuration could not be used, nothing was dialled — Driftstack could not turn this proxy's saved configuration into something it could connect with, so it never tried to connect.
• Where proxy passwords are stored (encrypted, never shown again) — Proxy secrets are write-only.
• Profile shows 'proxy deleted — choose another' and will not launch — When a proxy is deleted, every profile that used it is detached: it shows "proxy deleted — choose another" and refuses to launch until you pick a proxy.
• Proxy works on my computer but 'fails from Driftstack' — Your profiles run on Driftstack's servers, not on your computer.
• IP-allowlist proxies do not work; use username/password — IP-allowlist access does not work with Driftstack.
• Proxy limit reached: delete a proxy or upgrade — Each plan caps how many proxies the account can hold. Every paid plan gets as many saved proxies as saved profiles; the free trial keeps more proxies than profiles.
• Proxy host must be a public internet address — A proxy is refused at save time if its address is private, loopback, link-local or a cloud-metadata address.
• Session refused: choose one of your saved proxies (proxy_required) — Every session runs through a proxy you saved and chose — Driftstack has no connection of its own to run a session on.
• Proxy test says 'Driftstack was busy; try again in a minute' — This is not a result about your proxy — nothing was measured.
• Testing a proxy: quick check vs full check — A proxy test answers one question: would a session through this proxy work right now?
• What the UDP / QUIC / HTTP/3 chips on a proxy mean — The chips say whether UDP traffic, and HTTP/3 (QUIC) on top of it, get through this proxy.
• Proxy rejected the username and password — The proxy answered, then refused the username or password Driftstack sent.
• Proxy connects but cannot reach the internet (egress_blocked) — Driftstack connected to the proxy and logged in, but the proxy then refused or failed to reach the destination.
• Proxy was too slow to respond (timeout) — The proxy accepted the connection but did not finish in time.
• Proxy could not be reached (host/port/online) — Before a session starts, Driftstack makes a real connection through your proxy.
• Only the team owner and admins can launch through the team's proxies — In a team workspace, a team member can only see the team's proxies by name — not their address, username, or whether a password is stored — and cannot launch through them.
• To change a VPN password or server address, paste the full config again — A VPN proxy's password and its server address live inside its configuration (the remote line of a .ovpn, the Endpoint of a wg0.conf), and they are stored together with the keys.
• OpenVPN/WireGuard not included on this plan (trial/free) — OpenVPN and WireGuard proxies need a paid plan.
• Session ended: VPN tunnel did not finish connecting / handshake failed — The session ended because the VPN never came up.
• wg0.conf not accepted (incomplete, bad PresharedKey, private endpoint) — Paste the whole wg0.conf into the WireGuard box (or upload the file); the app fills the keys, endpoint and allowed IPs from it.