Proxies for OpenClaw (Clawdbot): the browser, web_fetch and the gateway

OpenClaw sends traffic out through three doors, and a proxy set on one does not reach the others. The browser tool takes a proxy only as a Chrome flag in browser.extraArgs. The web_fetch tool takes one only when you set HTTPS_PROXY and turn on useTrustedEnvProxy. The setting proxy.proxyUrl sends the whole OpenClaw process through a proxy, the calls to your model included, but it never reaches the browser. A plain HTTP_PROXY changes neither the browser nor web_fetch. We read every setting below in OpenClaw's docs and code at version 2026.9.5, released on 19 September 2026.

The project was called Clawdbot, then Moltbot. The npm package openclaw was registered on 29 January 2026. Both old GitHub addresses now lead to openclaw/openclaw, so every answer here holds for the old names too.

Why does OpenClaw get blocked on a VPS?

A user raised it in OpenClaw's tracker on 2 April 2026, in issue #59849. On a VPS, the browser tool met Cloudflare blocks and CAPTCHA walls at Indeed, Glassdoor, Bing and DuckDuckGo. The user asked how to route the browser through a residential proxy instead.

We tested which sites refuse a server, and what a residential IP changes, on 19 September 2026. We sent 13 sites the request web_fetch sends: a plain GET with a Chrome User-Agent. Each site got two requests from our server, an IP in Contabo's network (AS51167). Each got two more through a residential line whose exits sat on Comcast, T-Mobile and Verizon. Both sides ran within the same five minutes.

A residential IP changed the answer at four of the thirteen sites. Indeed, Glassdoor, Amazon and Booking refused both IPs. Cloudflare's page at Indeed and Glassdoor asks the visitor to "Enable JavaScript and cookies to continue", and Reddit's answer to the residential IP was a form named js_challenge. A plain request runs no script, whatever its IP. For those sites the agent needs its browser tool, which drives a real Chrome, with the residential IP behind it. We did not test whether that pair passes.

Blocking also changes by the hour. Zillow answered our server twice at 13:20 UTC and refused it at 14:05. The user in issue #59849 saw Bing check a headless Chrome, where our plain requests got Bing's results.

Why does HTTP_PROXY change nothing?

The two tools that get blocked never read it. The browser tool runs Chrome as a separate program. Before it starts Chrome, OpenClaw removes HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY from Chrome's environment. With no proxy flag in the config, it also adds --no-proxy-server. Chromium's own documentation says that flag "overrides any other proxy settings provided", so the system proxy is ignored too.

The web_fetch tool sends each request through a guard that checks the target address itself. It takes a proxy from the environment only when the opt-in is on. OpenClaw's health check says so in plain words. When openclaw doctor finds a proxy variable and the opt-in is off, it prints: "web_fetch still uses direct connections because tools.web.fetch.useTrustedEnvProxy is not enabled."

The chart shows which setting reaches which traffic.

How do I put the browser tool behind a proxy?

It takes four steps: the flag, the SSRF switch, the password and a check.

Step 1: pass Chrome's proxy flag

The only way in is Chrome's own flag, placed in browser.extraArgs in your OpenClaw config. There is no browser.proxy key. A pull request that proposed one, #20578, was closed without merging in March 2026. Restart the gateway after you change the config.

{
  browser: {
    extraArgs: ["--proxy-server=http://203.0.113.10:10000"],
    ssrfPolicy: { dangerouslyAllowPrivateNetwork: true },
  },
}

Step 2: turn on the SSRF switch, and know what it costs

OpenClaw checks every page the browser opens, so a hostile page cannot steer the agent into your private network. A proxy hides the final address from that check. With the default policy, every page load then fails with this message: "Navigation blocked: strict browser SSRF policy cannot be enforced while this browser profile is proxy-routed".

The ssrfPolicy line in the example lifts the block. It also lets the browser open private network addresses, which is the protection you give up. OpenClaw's docs ask you to turn it on only when that access is "intentionally trusted". Run such a browser on a machine where nothing private listens, for example a server that holds only the agent.

Step 3: solve the password

Chrome's flag has no field for a username or a password. Chromium documents its value as a proxy host and port, for all URLs or per URL scheme. OpenClaw 2026.9.5 does not answer a proxy's password request for the Chrome it starts either. We searched its code for that handler and found it only on the path that drives your own Chrome through the OpenClaw extension. There are two ways around it.

The first is to allow your server's IP on the proxy, so the proxy knows you by address and asks for nothing. Our gateways take up to 150 allowed IPs on a Residential Premium plan. A connection that is allowed by IP carries no username, so it takes no country or city targeting.

The second keeps the password and moves it into a small local forwarder. Chrome talks to the forwarder with no password, and the forwarder adds it on the way out. This is a minimal Squid setup, built only from directives in Squid's own reference:

# /etc/squid/squid.conf: a forwarder for the agent's browser only
http_port 127.0.0.1:3128
acl agent src 127.0.0.1/32
http_access allow agent
http_access deny all
cache_peer GATEWAY_HOST parent GATEWAY_PORT 0 no-query default login=USERNAME:PASSWORD
never_direct allow all

Point the browser flag at http://127.0.0.1:3128. Squid wants a % inside the password written as %%. On our lines the username carries the country, city and session, so this route keeps the targeting. Our guide to proxies that need a password covers both routes for other software too.

Step 4: check the IP the sites see

Ask the agent to open https://api.ipify.org in the browser. Then run curl https://api.ipify.org on the server itself. If the two answers differ, the browser leaves through the proxy.

A page load pulls many files, and a login spans many pages. A rotating line can leave from a new residential IP on every request, which splits one visit across many IPs. Give the browser a sticky line instead. It keeps one IP for the session, unless that home device leaves the network, so let the agent retry.

How do I send web_fetch through a proxy?

Two settings, and both are needed. First, give the gateway the proxy address. A gateway that runs as a service does not inherit your shell's variables. OpenClaw's docs point to ~/.openclaw/.env for them, followed by a restart of the gateway.

# ~/.openclaw/.env
HTTP_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT
HTTPS_PROXY=http://USERNAME:PASSWORD@GATEWAY_HOST:GATEWAY_PORT

Then turn on the opt-in, the exact command openclaw doctor suggests:

openclaw config set tools.web.fetch.useTrustedEnvProxy true

Three details decide whether it works. The password goes inside the URL, and special characters in it must be percent-encoded. Set both variables, because with only HTTPS_PROXY a plain http:// page goes direct. And check for lowercase copies of the same names. The lowercase one wins, and an empty https_proxy hides a filled HTTPS_PROXY. A value that the service already has also beats the one in the .env file.

The opt-in lets the proxy resolve names after OpenClaw's own host checks. That is why the docs keep it off for proxies you do not trust. A rotating line suits web_fetch, because each fetch stands alone.

Should I set proxy.proxyUrl for everything?

Usually not. The setting proxy.proxyUrl, or the variable OPENCLAW_PROXY_URL, routes the normal HTTP and WebSocket traffic of the whole process through one proxy. That covers the calls to your model, the chat channels and web_fetch. OpenClaw's docs describe it as defence in depth for a proxy you run yourself, for egress control and SSRF protection. It takes http:// and https:// proxy URLs only. For an installed service, the docs add that a change to OPENCLAW_PROXY_URL needs the service reinstalled.

It does not reach the browser, which Chrome runs outside the process. IRC also skips it, since IRC is raw TCP. Our gateways bill traffic per gigabyte, so a process-wide proxy on a residential pool counts every model call and chat message. The blocks in our test sat on the sites, so put paid residential IPs on the browser and web_fetch.

Which proxy type fits an OpenClaw agent?

Match the proxy to the door. The sites that refused our server refused an IP from a hosting network, and a datacenter proxy also leaves from a hosting network. For web_fetch, a rotating residential line lifts the refusals that look only at the IP, as it did at Zillow and Instagram in our test. Each read then comes from a fresh IP. For sites that send a challenge, use the browser tool on a sticky residential line, so one visit keeps one IP. Leave the model traffic direct unless your own network rules require a proxy.

HProxy residential gateways fit both doors. Allow your server's IP on a Residential Premium plan and point the browser at a sticky port with no password. When a task needs a country, generate a line with the targeting in the username and hand it to the Squid forwarder. Give web_fetch a rotating line from the same plan. The residential proxies page lists the plans, and the plan API generates lines and manages allowed IPs from code.

What breaks when the proxy is on?

• Every page fails with "strict browser SSRF policy cannot be enforced". The browser has a proxy flag, but the SSRF switch is off. Go back to step 2.
• 407 Proxy Authentication Required. The proxy refused the username or password. On our gateways this means a wrong password or a line from another plan. An allowed IP needs no password at all.
• web_fetch still goes direct. The opt-in is off, the variables are not in the gateway's environment, or an empty lowercase variable hides the uppercase one. Run openclaw doctor.
• Local services stop answering under proxy.proxyUrl. A proxy on another machine cannot reach the OpenClaw host's loopback. The default loopback mode keeps the local gateway link direct, and the mode proxy sends it through the proxy. Issue #81249 reported local Ollama embeddings failing with a proxy on in May 2026. Version 2026.9.5 documents a direct path for a local Ollama embedding server.
• A chat channel ignores the proxy. Some channels open their own connections. Telegram reads the proxy variables and OPENCLAW_PROXY_URL separately, and IRC is never carried by the process proxy.

What this page does not cover

We read OpenClaw's docs and code at version 2026.9.5, and we did not run OpenClaw itself. The blocking test used plain requests from one server IP and one residential line, over one afternoon. We did not test whether the browser tool behind a residential IP passes the challenges at Indeed, Glassdoor, Booking or Reddit. We did not test whether the browser's action for site logins also answers a proxy's password request, so this page does not rely on it. OpenClaw ships new releases often, so we will re-read these settings at the newest release by 19 October 2026.

Where to go from here

Proxies for AI agents covers the job in general: which proxy type fits, rotation and pool size. Proxies for browser-use covers the Python library for browser agents. The Playwright guide covers proxies in Playwright, which OpenClaw's browser code uses to drive Chrome. Proxies for MCP servers covers the tools an agent calls over MCP. How websites detect proxies explains the checks behind the refusals in our table.

Sources

• Network proxy. OpenClaw documentation, docs/security/network-proxy.md, release v2026.9.5, 19 September 2026. proxy.proxyUrl, OPENCLAW_PROXY_URL, the URL schemes, the loopback modes, Telegram, IRC and the local Ollama path.
• Browser configuration, SSRF policy. OpenClaw documentation, docs/tools/browser/configuration.md, release v2026.9.5. The proxy variables and the managed browser, browser.extraArgs.
• Web fetch, trusted env proxy. OpenClaw documentation, docs/tools/web-fetch.md, release v2026.9.5.
• Environment variables FAQ. OpenClaw documentation, docs/help/faq/env-vars.md, release v2026.9.5. The service environment and ~/.openclaw/.env.
• chrome.ts, navigation-guard.ts, config.ts, ssrf.ts, proxy-env.ts and doctor-web-fetch-proxy.ts. OpenClaw source code, release v2026.9.5, read on 19 September 2026.
• Pull request #20578, feat(browser): add proxy configuration option. openclaw/openclaw, opened 19 February 2026, closed without merging on 22 March 2026.
• Issues #59849, #8079, #2102, #3898, #43821, #81249 and #27409. openclaw/openclaw issue tracker, January to May 2026.
• OpenClaw release v2026.9.5. GitHub, 19 September 2026. The npm registry records for clawdbot, moltbot and openclaw, and GitHub's redirects for the old repository names.
• Network Settings, the command-line proxy flags. The Chromium Projects, chromium.org, read on 19 September 2026.
• cache_peer, never_direct, acl and http_access. Squid configuration reference, squid-cache.org, read on 19 September 2026.
• ProxyAgent and EnvHttpProxyAgent. Node.js undici documentation, GitHub, read on 19 September 2026.
• Plans, IP whitelist and sticky sessions; errors; the proxy API. HProxy documentation, hproxy.com/docs, 19 September 2026.
• RIPE Database and RIPEstat records for 169.58.183.155 and AS51167. RIPE NCC, read on 19 September 2026.
• Our own test of 19 September 2026: plain GET requests to 13 sites and 3 controls, two runs from our server 169.58.183.155 and two through a residential line of our own house plan, with curl 8.5.0. Exit networks from RIPEstat. Raw output is kept in the page's research folder.