Drıftstack docs
Docs

Proxy host must be a public internet address

You might be here because: “proxy host must be a public internet address” · “private or local network addresses are not allowed” · “can’t save my proxy on 192.168 or 10.x” · “localhost proxy won’t save” · “WireGuard endpoint and DNS must be public” · “the remote line in my ovpn is refused” · “this proxy address points inside our network”

Short answer

A proxy is refused at save time if its address is private, loopback, link-local or a cloud-metadata address. For a SOCKS5 or HTTP proxy the message is “This proxy address points inside our network. Use your proxy provider’s public address.”; for the address of an OpenVPN or WireGuard proxy it is “The proxy host must be a public internet address. Private or local network addresses are not allowed.” Sessions run on Driftstack’s servers, so such a proxy could never be reached from there anyway — and pointing at an internal address could reach networks it should not.

Check first

  • Signed in and online? Proxies save to your account.
  • Read the exact refusal under the form — it names the line or field.

Likely causes and fixes

  1. SOCKS5/HTTP host is localhost, 127.0.0.1, 10.x.x.x, 172.16–31.x.x, 192.168.x.x, or 169.254.x.x — in any spelling (127.1, 2130706433, [::1]), a name such as printer.local, something.internal or a name with no dot, or a host name whose address is one of these. Use the proxy’s public address from your provider. The same check runs when you edit the address, and a proxy saved before this check is refused when a session starts through it, until you change its address.
  2. OpenVPN: the remote line (or an http-proxy / socks-proxy line) points at a private address — written as an address, or as a host name that resolves to one. The refusal says so explicitly. Get a .ovpn whose server is a public host.
  3. WireGuard: the Endpoint is private (an address, or a host name that resolves to one). “The WireGuard endpoint must be a public internet address.”. A DNS line is different: the private resolver your provider gives you inside the tunnel (such as 10.64.0.1) is fine. A DNS address a session cannot use (loopback, link-local or cloud-metadata, multicast, reserved) is left out with a note when another address on the line can be used, and the save is refused, with the reason, when none can.
  4. A proxy running on your own machine or office router. It cannot be used with Driftstack, whatever the address — see Proxy works on my computer but “fails from Driftstack”.

If it still fails

Press Talk to a person in this chat (or open Help) and include the host you entered (never the password or keys) and the exact sentence. If the address is clearly public and still refused, a person should look.