n8n takes a proxy in two places: the Proxy option of each HTTP Request node, and the variables HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY for the whole instance. The node's value wins. Two traps sit in between. The node accepts only http:// and https:// proxy URLs, so a socks5:// line is ignored and the request goes out without it. And the variables move the traffic of every node in every n8n process, with no built-in exception for localhost. We read every setting on this page in n8n's code at the stable release 2.39.8, of 18 September 2026, and in its docs. If you searched for "n8n proxy" because n8n runs behind nginx or Caddy, the last section covers that.
Why do n8n's requests get refused?
The HTTP Request node sends a plain request, with no browser behind it. We tested what a plain request gets on 19 September 2026: thirteen sites, twice from our server in a hosting network and twice through a residential line. A residential IP changed the answer at four of them, Zillow, Instagram, Reddit and DuckDuckGo. Indeed, Glassdoor, Amazon and Booking refused both IPs. At Indeed and Glassdoor, Cloudflare asked the client to "Enable JavaScript and cookies to continue", which a plain request cannot do whatever its IP. The table per site is on our OpenClaw page.
How do I set a proxy on the HTTP Request node?
Open the node, choose Add option, pick Proxy and enter a full URL:
http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT
What n8n 2.39.8 does with the value depends on how it starts:
| You enter | What n8n does |
|---|---|
http://user:pass@host:port | uses the proxy and sends the login |
https://user:pass@host:port | uses it, over an encrypted link to the proxy |
socks5://host:port | ignores it, logs a warning, sends the request without it |
host:port, with no scheme | ignores it and sends the request without it |
"Without it" means through the instance proxy if one is set, and directly from your server if not. For socks5://, the server log shows "Ignoring unsupported proxy URL". For a bare IP and port it shows nothing at all. The node's own hint shows the right form: "e.g. http://myproxy:3128".
Write http:// even for HTTPS sites. The scheme names the link to the proxy, not the site, and most proxy lines speak plain HTTP. An https:// value only works with a proxy that accepts an encrypted connection itself.
Each HTTP Request node carries its own proxy. So one node can use a rotating line and another a sticky one, and the rest of the workflow stays direct.
How do I set a proxy for the whole instance?
Put the variables in the environment of every n8n container:
HTTP_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT
HTTPS_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT
NO_PROXY=localhost,127.0.0.1,ollama,minio
n8n's docs say that with these set, "n8n proxies all ... traffic from nodes through the proxy URL". The code goes further. By default every n8n process installs the proxy: the main process, the workers, the webhook processors and one-off CLI commands. In queue mode, set the variables on every container, since each one reads its own environment.
Three details decide whether this works:
- Every node goes through it. Calls to OpenAI, Slack or Google go through the proxy too. On a residential line billed per gigabyte, all of that counts.
- No automatic exception for localhost. n8n's config says so in plain words: "There is no implicit bypass, localhost included." List every internal host in
NO_PROXY, such as a local Ollama or your object storage. The names in the example above are placeholders for yours. - Lowercase wins. When
http_proxyandHTTP_PROXYare both set, n8n uses the lowercase one.
An older setting, N8N_OUTBOUND_PROXY_MODE=main-only, limits the proxy to the main process. n8n marks it deprecated and recommends a longer NO_PROXY instead.
For scraping, the node's option is usually the better tool. It sends only the requests that fetch websites through the proxy, and your API calls stay direct. The instance variables fit a network that demands a proxy for everything, such as a company proxy.
How do I check that n8n uses the proxy?
For the instance, start n8n with N8N_LOG_LEVEL=debug. When it picks up the variables, it logs "Installing global HTTP proxy agents" with the values it found. Those are the full proxy URLs, password included, so mask them before you paste a log anywhere.
For a node, point a test HTTP Request node at https://api.ipify.org with the same Proxy value. Compare the answer with your server's own IP. If the answer is your server's IP, the node's value was not used: check its scheme, and the server log for "Ignoring unsupported proxy URL".
Which proxy type fits n8n?
Residential, for the sites that refuse a hosting network. A rotating line suits nodes whose requests stand alone, such as one request per product page. A sticky line suits a node that logs in and then reads pages as that user, so every request keeps one IP.
HProxy residential gateways fit both. Allow your server's IP on a Residential Premium plan, up to 150 per plan, and the Proxy value needs no password: http://GATEWAY_HOST:GATEWAY_PORT, with a sticky port for the nodes that need one IP. An allowed IP takes no country or city targeting. When a node needs a country, use a generated line with the targeting in its username. The residential proxies page lists the plans, and the plan API generates lines and manages allowed IPs from code.
What breaks when the proxy is on?
- The request still comes from your server. The node's value starts with
socks5://or has no scheme. Write it ashttp://.... - Local services stop answering. The instance proxy has no localhost exception. Add the hosts to
NO_PROXY. - Model calls got slow or cost traffic.
HTTPS_PROXYcarries them. Move the proxy to the HTTP Request nodes, or add the model hosts toNO_PROXY. - Ollama ignores the proxy. n8n's docs warn that the Ollama nodes cannot take a custom HTTP agent, so the variables may not apply.
- 407 Proxy Authentication Required. The proxy refused the login. On our gateways this means a wrong password or a line from another plan. Our 407 guide walks through it.
- A proxy on a private address is refused. That happens when
N8N_SSRF_PROTECTION_ENABLEDis on: n8n checks the proxy's address like any other target. Its SSRF settings have allow-lists for the hosts you still need. - The site still answers with a JavaScript check. A proxy changes the address, not the client. A plain request cannot pass such a check.
What if n8n runs behind a reverse proxy?
That is the other meaning of "n8n proxy", and it is about requests coming in. Set N8N_WEBHOOK_URL to your public URL, which replaced WEBHOOK_URL in n8n 2.35.0. Set N8N_PROXY_HOPS=1, and have the last proxy pass on the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto headers.
What this page does not cover
We read n8n's code at the stable release 2.39.8 and its docs, and we did not run n8n. The blocking test used plain requests from one server IP and one residential line, over one afternoon. We did not check node by node which community or AI nodes use n8n's central HTTP client. The fate of a value without a scheme comes from reading the URL parser, not from n8n's log. n8n ships several releases a week, so we will read these settings again by 19 October 2026.
Where to go from here
Proxies for self-hosted Firecrawl and proxies for OpenClaw cover two tools that n8n workflows often call. Sticky vs rotating sessions explains the choice above, HTTP vs SOCKS5 explains why the scheme matters, and how websites detect proxies explains the checks behind the refusals.
Sources
- HTTP Request node, the Proxy option; deployment environment variables; Configure webhook URLs with reverse proxy; Ollama Chat Model common issues. n8n documentation, n8n-io/n8n-docs at d6f969044f09, 18 September 2026.
- HttpRequestV3 and its Description, backend-network (node-agents, axios utils, http-proxy, proxy-resolution) and the outbound proxy and SSRF configs. n8n source code, release n8n@2.39.8, 18 September 2026.
- Issues #21199, #10901, #15785, #16412 and #7992. n8n issue tracker, 2023 to 2025.
- Plans, IP whitelist and sticky sessions; errors; the proxy API. HProxy documentation, hproxy.com/docs, 19 September 2026.
- Our own test of 19 September 2026: plain GET requests to 13 sites and 3 controls, two runs from our server and two through a residential line of our own house plan, with curl 8.5.0. Raw output is kept in the research folder of our OpenClaw page.
