> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/unigetui/for-it-teams/organization/network-and-proxy.md).

# Use UniGetUI behind a proxy or firewall

Send UniGetUI's traffic through your proxy, know which servers it needs to reach, and keep updates from running on metered connections.

On a corporate network, UniGetUI and the package managers it drives need a way out to the internet. This page shows how to point UniGetUI at your proxy, which servers to allow through your firewall, and how to keep automatic updates off metered connections.

## Set up a proxy

{% stepper %}
{% step %}

### Turn on the proxy

1. Go to ***Settings*** – ***Internet connection settings***.
2. Turn on ***Connect the internet using a custom proxy***.
3. In ***Proxy URL***, enter the address of your proxy, including the scheme and port, for example `http://proxy.contoso.com:3128`.
   {% endstep %}

{% step %}

### Add credentials (if your proxy needs them)

1. Turn on ***Authenticate to the proxy with a user and a password***.
2. Under ***Credentials***, enter the ***Username*** and ***Password***. They're saved as you type.

{% hint style="danger" %}
UniGetUI warns that it can't guarantee the credentials are stored safely. On Windows they're kept in the Windows Credential Manager. On macOS and Linux they're saved as a plain file in the `SecureStorage` folder of the UniGetUI data folder. Use a dedicated proxy account with as few rights as possible.
{% endhint %}
{% endstep %}

{% step %}

### Check which package managers follow it

Scroll down to the ***Proxy compatibility table***. For each package manager, it shows whether it's ***Compatible with proxy*** and ***Compatible with authentication*** (***Yes***, ***Partially*** or ***No***).

UniGetUI passes the proxy to each manager the way that manager supports, for example as a command-line option. Managers marked ***No*** don't get it from UniGetUI: configure their own proxy settings, or the system-wide proxy, separately.
{% endstep %}
{% endstepper %}

At the time of writing, the table looks like this. The version in your app is the one to trust.

<table><thead><tr><th width="250">PROXY SUPPORT</th><th>PACKAGE MANAGERS</th></tr></thead><tbody><tr><td><strong>Yes</strong>, with authentication</td><td>Chocolatey, pip</td></tr><tr><td><strong>Partially</strong>, with authentication</td><td>.NET Tool, Cargo, PowerShell 5.x, PowerShell 7.x</td></tr><tr><td><strong>Partially</strong>, without authentication</td><td>WinGet</td></tr><tr><td><strong>No</strong></td><td>Scoop, npm, Bun, vcpkg, Homebrew, APT, DNF, Pacman, Snap, Flatpak</td></tr></tbody></table>

{% hint style="warning" %}
**WinGet and authenticated proxies:** WinGet doesn't accept proxy credentials. If ***Authenticate to the proxy with a user and a password*** is on, UniGetUI doesn't pass the proxy to WinGet at all, and WinGet connects directly. If your WinGet traffic must go through the proxy, use a proxy address that doesn't need authentication for it, or configure the proxy in Windows.
{% endhint %}

### Set the proxy on many computers

The proxy options are regular settings, so you can set them from a deployment script with the [command-line interface](/unigetui/reference/cli.md):

```powershell
UniGetUI.exe --enable-setting EnableProxy
UniGetUI.exe --set-setting-value ProxyURL http://proxy.contoso.com:3128
```

Credentials can't be set this way. Type them in ***Credentials*** on each computer, or use a proxy that doesn't need them.

## What to allow through the firewall

UniGetUI talks to a few servers of its own. The package managers talk to many more, and the installers they download come from each publisher's servers.

### UniGetUI itself

<table><thead><tr><th width="250">WHAT</th><th>SERVER</th><th>WHEN</th></tr></thead><tbody><tr><td>Checking for UniGetUI updates</td><td><code>devolutions.net</code> (<code>https://devolutions.net/productinfo.json</code>)</td><td>When <em><strong>Update UniGetUI automatically</strong></em> is on, or you check for updates.</td></tr><tr><td>Downloading a UniGetUI update</td><td><code>devolutions.net</code> and its subdomains, <code>github.com</code>, <code>objects.githubusercontent.com</code>, <code>release-assets.githubusercontent.com</code></td><td>When an update is found. UniGetUI refuses to download its own updates from any other host.</td></tr><tr><td>Icon and screenshot database</td><td><code>github.com</code> (file in the UniGetUI repository)</td><td>At startup, unless a custom address is set in <em><strong>Use a custom icon and screenshot database URL</strong></em>.</td></tr><tr><td>Package icons and screenshots</td><td>The addresses listed in that database, on many different hosts</td><td>When icons are shown. Turn off <em><strong>Show package icons on package lists</strong></em> if you'd rather not load them.</td></tr><tr><td>Anonymous usage data</td><td><code>telemetry2.devolutions.net</code>, port <code>9200</code></td><td>Only in official builds, and only if you didn't opt out in <em><strong>Manage telemetry settings</strong></em>. See <a href="/unigetui/guides/understand/privacy.md">What data UniGetUI sends</a>.</td></tr><tr><td>Cloud backup</td><td><code>github.com</code>, <code>api.github.com</code></td><td>Only if you sign in with GitHub for <a href="/unigetui/guides/new-computer/backup.md">backups</a>.</td></tr></tbody></table>

All these requests use HTTPS. They go through the proxy you configured, except the UniGetUI updater, which uses the system's default proxy settings.

{% hint style="info" %}
On Windows, an administrator can point the UniGetUI updater at a different `productinfo.json` with the `UpdaterProductInfoUrl` value under `HKEY_LOCAL_MACHINE\Software\Devolutions\UniGetUI`. The installer it downloads must still come from one of the hosts above over HTTPS, and is still checked for its hash and signature.
{% endhint %}

### The package managers

Each package manager needs to reach its own catalogs, called sources, and then the server that hosts each installer. UniGetUI doesn't control these connections. For example, these are the default sources UniGetUI knows for some managers:

<table><thead><tr><th width="250">PACKAGE MANAGER</th><th>DEFAULT SOURCE</th></tr></thead><tbody><tr><td>WinGet</td><td><code>cdn.winget.microsoft.com</code> (<code>winget</code> source), <code>storeedgefd.dsx.mp.microsoft.com</code> (<code>msstore</code> source)</td></tr><tr><td>Chocolatey</td><td><code>community.chocolatey.org</code></td></tr><tr><td>PowerShell 5.x, PowerShell 7.x</td><td><code>www.powershellgallery.com</code></td></tr><tr><td>.NET Tool</td><td><code>api.nuget.org</code></td></tr><tr><td>pip</td><td><code>pypi.org</code></td></tr><tr><td>npm, Bun</td><td><code>registry.npmjs.org</code></td></tr><tr><td>Cargo</td><td><code>index.crates.io</code></td></tr><tr><td>Scoop</td><td>Buckets hosted on <code>github.com</code></td></tr><tr><td>Flatpak</td><td><code>dl.flathub.org</code></td></tr></tbody></table>

This list isn't complete. Sources you add yourself, the installers' download servers, and the managers' own update checks all need access too. The installer address of a package is shown in ***Package details*** – ***Installer URL***, and you can add an ***Installer host*** column to the lists with ***Show the installer host on package lists*** in ***Settings*** – ***User interface preferences***. For the full network requirements of a manager, see its own documentation.

{% hint style="info" %}
Only allowing a fixed list of hosts? Expect some installs to fail: publishers host installers on their own servers and content delivery networks, and these change over time. The failed operation's output shows which address couldn't be reached.
{% endhint %}

## No internet, or a restricted one

By default, ***Wait for the device to be connected to the internet before attempting to do tasks that require internet connectivity.*** is on. UniGetUI then waits until the operating system reports a working connection before loading ***Discover Packages***, ***Software Updates*** and ***Installed Packages***, and before checking for its own updates.

On some isolated or tightly filtered networks, Windows never reports full internet access, so the lists keep waiting. Turn the setting off in ***Settings*** – ***Internet connection settings***, then restart UniGetUI. The package managers then try to connect right away and report their own errors if they can't.

## Don't update on metered connections

To keep automatic updates from using a phone hotspot or another limited connection:

1. Go to ***Settings*** – ***Package update preferences***.
2. Turn on ***Do not automatically install updates when the network connection is metered***.

This only affects updates installed by the ***Install available updates*** task of [Scheduled maintenance](/unigetui/guides/updates/schedule.md). When the connection is metered, UniGetUI notifies you that updates are available instead of installing them, and tries again at the next update check. Updates you start yourself always run.

{% hint style="warning" %}
UniGetUI detects metered connections on Windows only, using the connection's Windows setting (***Metered connection*** in the network properties). On macOS and Linux, the option has no effect.
{% endhint %}

## If it doesn't work

* **Lists stay empty or keep loading behind the proxy:** open ***More*** – ***Package Manager logs*** and look for connection errors from the manager involved. Check its row in the ***Proxy compatibility table***.
* **An install fails with a download or connection error:** the installer's host is probably blocked. See [An update or installation fails](/unigetui/help/troubleshooting/update-or-install-fails.md).
* **UniGetUI can't update itself:** check that the hosts in [UniGetUI itself](#unigetui-itself) are allowed. See [Install UniGetUI](/unigetui/reference/installation.md#update-unigetui).
* **Scheduled updates never install:** a metered or battery rule may be holding them. See [Scheduled updates don't run](/unigetui/help/troubleshooting/scheduled-updates-dont-run.md).

## Next

* [Deploy UniGetUI silently](/unigetui/for-it-teams/organization/deploy.md)
* [Lock down risky settings](/unigetui/for-it-teams/organization/restrict-settings.md)
* [All settings](/unigetui/reference/settings.md#internet-connection-settings)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/unigetui/for-it-teams/organization/network-and-proxy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.