Ubuntu keeps the proxy setting in four separate places, and each one reaches a different set of programs. That is why the panel in Settings can be filled in correctly while sudo apt update still goes straight out. Pick the place that covers the program you care about, then prove it with one command.
Everything below was measured on our own server on 16 September 2026: Ubuntu 24.04.4 LTS with apt 2.8.3, sudo 1.9.15p5 and snapd 2.76. Where a step was not run, the desktop panel above all, this page says so.
| Where you set it | What it reaches | What it leaves out |
|---|---|---|
| Settings, Network, Network Proxy | Desktop apps that read the desktop setting | Terminals, apt, snap |
export in a terminal | curl, wget, git, pip and apt in that terminal | Other terminals, anything under sudo |
/etc/environment | Every login shell, and sudo through PAM | Programs already running, snap |
/etc/apt/apt.conf.d/ | apt, including under sudo | Everything that is not apt |
/etc/systemd/system/snapd.service.d/ | snap downloads | Everything that is not snap |
Canonical makes the same split in its own tooling. The ubuntu-proxy-manager project writes a single proxy into three separate files, one for the environment, one for apt and one for the desktop, and it silently skips values a backend cannot express, such as no_proxy for apt.
What you need before you start
- A proxy address as
host:port, plus a user name and password if the proxy needs a login. If your provider sent four values in a different order, the proxy format guide sorts them out. - A terminal. Every step here except the desktop panel works on a server with no desktop, and inside WSL.
- For a first test, any HTTP entry from our free proxy list will do. Expect it to die within hours.
Step 1: set the proxy for this terminal
export http_proxy="http://user:pass@host:port" https_proxy="http://user:pass@host:port" no_proxy="localhost,127.0.0.1,::1"
Both variables start with http://, including the one for HTTPS, because they name the proxy and the proxy speaks plain HTTP. Write the names in lower case. When we set only the upper-case HTTP_PROXY to a dead address, curl fetched the page anyway, exactly like the control run with no proxy set. With the lower-case name it failed at once, which is the behaviour you want.
This setting lives until you close the terminal. The Linux page carries the per-tool detail for curl, wget, git and pip.
Step 2: make it permanent
For one user, add the same line to the end of ~/.bashrc. A new terminal reads it.
For every user, put the three names into /etc/environment as plain lines:
http_proxy="http://user:pass@host:port"
https_proxy="http://user:pass@host:port"
no_proxy="localhost,127.0.0.1,::1"
On a fresh Ubuntu 24.04.4 install that file holds one line, the PATH, so anything else in it was put there by somebody. The file is read at login, not by the shell you already have open, so log out and back in.
Step 3: give apt its own setting
apt does not read the desktop panel, and under sudo it does not see your shell variables either. It reads its own option. Write it into a fragment so an upgrade never overwrites it:
echo 'Acquire::http::Proxy "http://user:pass@host:port/";' | sudo tee /etc/apt/apt.conf.d/99proxy
echo 'Acquire::https::Proxy "http://user:pass@host:port/";' | sudo tee -a /etc/apt/apt.conf.d/99proxy
The manual for the transport apt uses gives the form scheme://[[user][:pass]@]host[:port]/. It also takes a per-host option, Acquire::http::Proxy::archive.ubuntu.com, and the special value DIRECT for a host that should skip the proxy. On a stock install apt has no proxy at all: apt-config dump printed nothing for that option before we set it.
Step 4: snap needs a setting of its own
Snap downloads follow neither the panel nor your shell. On our server, snapd started with an empty environment, had no drop-in directory, and snap get system proxy answered that the option is not set. The documented snap set system proxy.http option is listed for Ubuntu Core.
On a desktop or server install, give snapd the variables through systemd:
sudo mkdir -p /etc/systemd/system/snapd.service.d
printf '[Service]\nEnvironment=http_proxy=http://user:pass@host:port\nEnvironment=https_proxy=http://user:pass@host:port\n' | sudo tee /etc/systemd/system/snapd.service.d/proxy.conf
sudo systemctl daemon-reload && sudo systemctl restart snapd
Step 5: the desktop panel, and what it is for
On Ubuntu Desktop, Ubuntu own help gives these steps: open the Activities overview and start typing Network, click Network to open the panel, then select Network proxy from the list on the left. The three methods are None, Manual and Automatic. Manual takes an address and a port per protocol, and Automatic takes a URL that holds the configuration.
We did not run this step, because we measured on a server install, and a server has no such panel at all: the proxy schema the desktop uses was absent on our machine. Treat the panel as the setting for desktop apps, and keep the terminal, apt and snap settings above for everything else.
Check that it worked
curl -s https://www.cloudflare.com/cdn-cgi/trace | grep ^ip=
curl -s https://hproxy.com/api/ip/THE_ADDRESS_YOU_JUST_SAW
The first line prints the address a site sees. If it is the proxy address, your traffic is going through the proxy. The second line takes that address and returns its country, city, network and AS number, so you can tell a datacenter range from a home connection. Then paste the entry into our free proxy checker, which reports status, protocol, anonymity, country and latency for every line.
Two of those five entries were dead within the same hour they were published, which is the normal life of a public entry. When a download has to finish, a paid proxy is the part that stops changing under you.
When it does not work
sudo apt updateignores the proxy. sudo runs the command in a minimal environment, so your exported names never arrive. Usesudo -E, or better, the apt file from step 3.- Only the upper-case name is set. curl ignores
HTTP_PROXYfor anhttp://address. Use lower case. - The panel is set and the terminal is not proxied. They are separate settings. See the table at the top.
- snap still downloads directly. snapd reads neither of the first two. Use the drop-in from step 4.
- The password contains an
@. In the URL form,@separates the login from the host, so encode it as%40.
Turning it off again
Unset the names in the shell, remove what you added to ~/.bashrc and /etc/environment, delete /etc/apt/apt.conf.d/99proxy, remove the snapd drop-in and reload systemd, and set the desktop panel back to None. Each place is independent, and a forgotten one keeps sending traffic to a proxy that no longer exists.
