Firefox Proxy Configuration: SOCKS5, PAC Files, FoxyProxy, and Enterprise Deployment

Firefox has one of the most flexible proxy configurations of any browser. Unlike Chrome, which inherits system proxy settings and requires workarounds to override them, Firefox lets you configure proxies per-browser with full manual control, PAC file support, and even SOCKS5 with DNS proxying. Here's the complete picture.

Where Proxy Settings Live

Settings → General → Network Settings → Settings...

Four options:

1. No proxy — direct connections always
2. Auto-detect proxy settings for this network — uses WPAD (Web Proxy Auto-Discovery)
3. Use system proxy settings — follows OS proxy (the default)
4. Manual proxy configuration — custom per-protocol proxies
5. Automatic proxy configuration URL — PAC file

Manual Proxy Configuration

Manual mode lets you set different proxies for different protocols:

HTTP Proxy:    proxy.corp.example.com    Port: 8080
HTTPS Proxy:   proxy.corp.example.com    Port: 8080
FTP Proxy:     (leave empty to not proxy FTP)
SOCKS Host:    127.0.0.1                 Port: 9050
SOCKS v5
☑ Proxy DNS when using SOCKS v5

No Proxy for: comma-separated list of hostnames/IP ranges that bypass the proxy:

localhost, 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, .corp.example.com

The dot prefix (.corp.example.com) matches all subdomains. IP CIDR notation works for ranges.

SOCKS5 Proxy With DNS Proxying

This is the configuration for routing traffic through an SSH tunnel or Tor:

# Create SOCKS5 tunnel via SSH
ssh -D 9050 -N user@remotehost

Then in Firefox:

• SOCKS Host: 127.0.0.1, Port: 9050
• SOCKS v5
• Enable "Proxy DNS when using SOCKS v5" — this routes DNS queries through the tunnel too, preventing DNS leaks

Without the DNS proxying checkbox, Firefox resolves DNS locally even when sending traffic through SOCKS. For privacy use cases (public WiFi, travel), DNS proxying is essential.

PAC Files (Proxy Auto-Config)

A PAC file is a JavaScript function that returns which proxy to use for any given URL. This is the mechanism behind enterprise proxy configurations and is far more flexible than manual settings.

function FindProxyForURL(url, host) {
    // Direct access for local addresses
    if (isInNet(host, "10.0.0.0", "255.0.0.0") ||
        isInNet(host, "192.168.0.0", "255.255.0.0") ||
        host === "localhost" || host === "127.0.0.1") {
        return "DIRECT";
    }

    // Use SOCKS for .onion addresses
    if (shExpMatch(host, "*.onion")) {
        return "SOCKS5 127.0.0.1:9050";
    }

    // Route .corp.example.com through corporate proxy
    if (dnsDomainIs(host, ".corp.example.com")) {
        return "PROXY proxy.corp.example.com:8080";
    }

    // Direct for everything else
    return "DIRECT";
}

To use a local PAC file: file:///path/to/proxy.pac

Built-in PAC functions: isInNet(), dnsDomainIs(), shExpMatch(), isPlainHostName(), isResolvable(), localHostOrDomainIs().

FoxyProxy: Per-Site Proxy Switching

For switching between multiple proxies based on URL patterns, FoxyProxy Standard (free, Firefox Add-ons) is the standard tool.

Features:

• Define multiple proxy profiles (SOCKS5, HTTP, HTTPS)
• Assign URL patterns to each profile using wildcards or regex
• Quick toggle between "all through proxy", "use patterns", "direct all"
• Import/export rules

Example use case: route *.corp.example.com through VPN proxy, *.local direct, everything else through default.

about:config Proxy Settings

For scripted or automated configuration, the proxy settings live in about:config:

These can also be set via user.js in the Firefox profile for automated deployments.

Enterprise Proxy Deployment

For deploying proxy settings across many Firefox instances, use Firefox policies via policies.json:

{
  "policies": {
    "Proxy": {
      "Mode": "manual",
      "HTTPProxy": "proxy.corp.example.com:8080",
      "SSLProxy": "proxy.corp.example.com:8080",
      "NoProxiesOn": "localhost, .corp.example.com",
      "UseProxyForDNS": true
    }
  }
}

Place policies.json at:

• Linux: /etc/firefox/policies/policies.json
• macOS: /Library/Application Support/Firefox/Policies/policies.json
• Windows: %PROGRAMFILES%\Mozilla Firefox\distribution\policies.json

This is managed by IT without touching individual user profiles.

Proxy Authentication

If your proxy requires authentication, Firefox will prompt for credentials when you first connect. You can check "Remember this password" to store it in the Firefox password manager.

For proxies requiring NTLM or Kerberos authentication (common in corporate environments), Firefox supports these natively. The NTLM/Kerberos negotiation happens transparently if your system credentials have proxy access.

Setting network.automatic-ntlm-auth.trusted-uris in about:config to your proxy's hostname enables automatic authentication without prompting.

Debugging Proxy Issues

If connections aren't routing through your proxy, check:

1. Proxy type match: HTTPS sites need the HTTPS proxy field filled, not just HTTP
2. No proxy bypass: your site might be in the no-proxy list
3. PAC file syntax: test with browser console — PAC files run in a restricted JS environment
4. DNS resolution: with manual SOCKS without DNS proxying, DNS resolves locally — this may bypass the proxy for hostname resolution

The Network tab in DevTools doesn't directly show which proxy a request used, but the Timing tab will show higher latency for proxied requests, which can help confirm routing.