---
schema_version: "1"
id: 670a7f1de3de856897943b24d2bc6799f107426af80d6c20df01458c5201a2fc
title: Configuring a Forward Proxy for Omni Gateway in Connected Mode
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/conn-forward-proxy.md
canonical_url: https://docs.mulesoft.com/gateway/latest/conn-forward-proxy
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 21d4509fe16132c25ab8a25161619ecefdfa735302b89e70144fdec5a1c93ee8
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
---

# Configuring a Forward Proxy for Omni Gateway in Connected Mode

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

A forward proxy, such as Squid, enables you to route external HTTP Omni Gateway connections through
a proxy connection.

For both Connected Mode and Local Mode, you configure a forward proxy using YAML configuration
files.

The following diagram demonstrates how an internal network communicates with an external network
using a forward proxy.

![A flowchart that illustrates the journey of data from an app to a database to the cloud and back](/mulesoft/current/en-us/gateway/latest/_images/forward-proxy-diagram.png)

As in the diagram, when using a forward proxy, HTTP communication out of your internal network must
travel through the forward proxy.

In this example, all HTTP API upstream communication must also pass through the forward proxy. For
more information about how to enable some connections to communicate directly without the forward
proxy, see [noProxy Parameter](#noproxy-parameter).

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><div><div><p><span><a href="#linux"><img src="https://docs.mulesoft.com/gateway/latest/_images/install-linux-logo.png" alt="20%" width="20%"></a></span></p></div></div></td><td><div><div><p><span><a href="#docker"><img src="https://docs.mulesoft.com/gateway/latest/_images/install-docker-logo.png" alt="25%" width="25%"></a></span></p></div></div></td><td><div><div><p><span><a href="#kubernetes"><img src="https://docs.mulesoft.com/gateway/latest/_images/install-kubernetes-logo.png" alt="20%" width="20%"></a></span></p></div></div></td></tr><tr><td><div><div><p><a href="#linux">Configure a Forward Proxy for Omni Gateway as a Linux Service</a></p></div></div></td><td><div><div><p><a href="#docker">Configure a Forward Proxy for Omni Gateway in a Docker Container</a></p></div></div></td><td><div><div><p><a href="#kubernetes">Configure a Forward Proxy for Omni Gateway in a Kubernetes Cluster</a></p></div></div></td></tr></tbody></table>

## Forward Proxy Connections

Only HTTP connections route through the forward proxy.

The following connections route through the forward proxy:

- Connections to Anypoint Platform

- Outbound policy connections

- Connections to upstream services

- HTTP (Fluent Bit) log connections

Using the `noProxy` parameter, you can configure HTTP and HTTPS connections to connect directly
without using the forward proxy.

Configuring a forward proxy does not alter these connections:

- Connections to shared storage

- Lightweight Directory Access Protocol (LDAP) connections

- Non-HTTP log connections

## noProxy Parameter

Adding the `noProxy` parameter enables HTTP services you trust to communicate without using the
forward proxy.

For example, when you enable `noProxy`, you can list HTTP log connections and connections to
upstream services to have them connect directly to Omni Gateway.

When using the `noProxy` parameter in the YAML configuration file to communicate with HTTP logs, you
must list the exact domain name. You cannot list the domain suffix, for example,
`.svc.cluster.local`. You need to list full domain name, `<logging-name>.svc.cluster.local`, for all
HTTP log connections.

The following diagram demonstrates the differences in communication using noProxy:

![Shows the difference between internal connections when <code>noProxy</code> is enabled or disabled](/mulesoft/current/en-us/gateway/latest/_images/no-proxy-diagram.png)

In the diagram, when you do not enable `noProxy`, Omni Gateway communicates with the internal API
endpoint using the forward proxy. When you enable `noProxy` and list the API Upstream domain, Omni
Gateway communicates directly with the internal API endpoint.

## Configuring Forward Proxy Parameters

```yaml
apiVersion: gateway.mulesoft.com/v1alpha1
kind: Configuration
metadata:
  name: forward-proxy
spec:
  forwardProxy:
    https:
      address: http://proxy:8888
      basicAuth:
        username: <string>
        password: <string>
    noProxy:
      - fluentd
      - .svc.cluster.local
```

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Description</th></tr></thead><tbody><tr><td><p><code>https.address</code></p></td><td><p>required</p></td><td><p>Proxy adddress.</p></td></tr><tr><td><p><code>basicAuth</code></p></td><td><p>Optional</p></td><td><p>Supplies the authentication username and password.</p></td></tr><tr><td><p><code>basicAuth.username</code></p></td><td><p>Required when <code>basicAuth</code> configured</p></td><td><p>Authentication username</p></td></tr><tr><td><p><code>basicAuth.Password</code></p></td><td><p>Required when <code>basicAuth</code> configured</p></td><td><p>Authentication password.</p></td></tr><tr><td><p><code>noProxy</code></p></td><td><p>Optional</p></td><td><p>Array containing domain names or IP addresses to communicate to without using the forward proxy. Each IP address must be listed in the array. The <code>noProxy</code> does not support CIDR blocks.</p></td></tr></tbody></table>

## Configure a Forward Proxy for Omni Gateway as a Linux Service

1.  Create a YAML configuration file in the Omni Gateway configuration directory:

    ```ssh
    sudo touch /usr/local/share/mulesoft/flex-gateway/conf.d/forward-config.yaml
    ```

2.  Update the file with your desired forward proxy configuration details.

3.  If your Omni Gateway does not have direct internet access, see
    [Forward Proxy Omni Gateway Registration](#proxy-registration).

## Configure a Forward Proxy for Omni Gateway in a Docker Container

> [!NOTE] If you have already added a volume for a folder with your Omni Gateway configuration
> files, skip to the create and save a YAML file step.

1.  Press Ctrl+C to stop your Omni Gateway and any replicas.

2.  Restart your Omni Gateway with an additional volume for the configuration directory:

    ```ssh
    docker run --rm \
    -v "$(pwd)":/usr/local/share/mulesoft/flex-gateway/conf.d \
    -p 8080:8080 \
    mulesoft/flex-gateway
    ```

    > [!NOTE] Specify an optional name you want to assign to your Omni Replica by including the
    > following: `-e FLEX_NAME=<name-for-flex-replica> \`.

3.  Create and save a YAML file with your desired forward proxy configuration details.

4.  If your Omni Gateway does not have direct internet access, see
    [Forward Proxy Omni Gateway Registration](#proxy-registration).

## Configure a Forward Proxy for Omni Gateway in a Kubernetes Cluster

To configure a forward proxy for Omni Gateway, create a new YAML configuration resource with your
forward proxy details.

If your Omni Gateway does not have direct internet access, see
[Forward Proxy Omni Gateway Registration](#proxy-registration).

## Forward Proxy Omni Gateway Registration

If your Omni Gateway is in an internal network where all internet connections pass through the
forward proxy, you must add the `--https-proxy` flag when
[registering an Omni Gateway](https://docs.mulesoft.com/gateway/latest/conn-reg-run).

Add the `--https-proxy` flag with your proxy `address` parameter:

\--https-proxy=http://proxy:8888

Provide your `username` and `password` parameters if you enable `basicAuth`:

\--https-proxy=http://<username>:<password>@proxy:8888

The following sample registration command shows flag placement:

```ssh
flexctl register \
--username=<your-username> \
--password=<your-password> \
--environment=<your-environment-id> \
--organization=<your-org-id> \
--output-directory=/usr/local/share/mulesoft/flex-gateway/conf.d \
--https-proxy=http://<username>:<password>@proxy:8888 \
my-gateway
```

> [!NOTE] Use the relevant registration command for your Omni Gateway deployment.

## See also

- [Register and Run Omni Gateway in Connected Mode](https://docs.mulesoft.com/gateway/latest/conn-reg-run)