Set up an authenticated proxy in Firefox

Short answers

Collect the connection details first

In the connection builder, select HTTP, your pool and an available country. Copy the complete generated username, including its pool, country and rotation settings, and obtain the proxy password. The account prefix alone is not the complete connection username.

Keep the password out of the hostname field, address bar and screenshots. Before changing anything, record your current connection mode and any existing server, configuration URL or exclusions. On a managed work device, confirm the required network configuration with its administrator.

Set the HTTP route in Firefox

1. Open Firefox Settings and locate its proxy controls. Mozilla documents versions with Network Settings under General and versions with Proxy settings under advanced privacy and security controls. Follow the layout shown in your version.
2. Open the connection dialog and select Manual proxy configuration.
3. Enter gw.portproof.org in the HTTP proxy host field and 7000 in its port field. Use the hostname alone, without a username, password or URL path.
4. Enable the option that uses this same proxy for HTTPS. Leave the SOCKS fields unused for this HTTP recipe.
5. Review the host exclusions without removing entries your network requires. Save the configuration.

Mozilla’s connection-settings reference shows the available modes. Its dialog also identifies extensions controlling the connection. Resolve conflicting controls before judging the result.

Answer only the expected proxy sign-in

Open the HTTPS echo URL below. If Firefox requests proxy authentication, check that the prompt identifies the gateway you configured before entering the generated username and proxy password. Cancel an unexpected prompt. Never put these credentials into a destination website’s login form.

https://api.portproof.org/v1/echo-ip

HTTP distinguishes a proxy challenge, normally status 407, from a destination challenge, normally status 401. The HTTP authentication reference explains these separate exchanges. Repeated prompts are a reason to check the credential and active gateway, not to keep trying passwords.

The HTTP gateway connection is unencrypted. HTTPS protects the destination exchange inside the CONNECT tunnel, but not Basic proxy credentials sent to that HTTP gateway. Use a trusted network path and keep certificate checks enabled. Do not change the gateway scheme or port to an unverified HTTPS endpoint.

Verify the request your browser made

• Confirm the echo endpoint returns a response with an exit IP rather than an error page or another sign-in prompt.
• Record the selected pool, country, session mode and check time without recording the password.
• Check the active connection mode and exclusions if the route is unexpected. A different browser or terminal can use different settings.
• After the small check, open one page you are authorised to test and inspect the actual content it returns.

An echo IP describes one request. It does not verify a country, prove that every browser connection follows that route or guarantee the next request’s address. A sticky session keeps the same device; the carrier may still change the IP. For a location discrepancy, use the country-check guide.

Keep configuration and DNS scope clear

Manual configuration belongs to Firefox; it does not configure your terminal, scripts or other browsers. System mode follows operating-system settings. Automatic configuration uses a PAC file whose rules may choose different routes. The general proxy-settings guide explains those choices.

Host exclusions select destinations that should not use the proxy. Mozilla’s proxy settings reference also describes SOCKS DNS settings. Those controls are not interchangeable with choosing HTTP in this recipe; changing a DNS preference alone does not establish which route carried a page.

Firefox’s extension API supports SOCKS credential fields. That is a different setup from this built-in HTTP walkthrough. Do not assume a SOCKS connection has been authenticated merely because its host and port are saved.

If the check fails

Connection refused or timed out

Check the hostname and HTTP port. Run the same connection through the curl check to separate a browser-setting problem from gateway reachability.

Repeated authentication prompt

Check the full generated username and current proxy password. Review the active route before following the 407 checklist.

HTTP works but HTTPS fails

Confirm HTTPS uses the same HTTP gateway. If it does, investigate CONNECT tunnel errors; do not disable certificate validation.

Settings cannot be changed

An administrator can lock proxy settings through Firefox policy. Ask the administrator instead of attempting to override that policy.

The echo works but a website refuses the request

A successful gateway check does not grant website access. Respect the destination’s rules and rate limits; do not repeatedly switch routes to repeat a refused request.

Restore your previous route when finished

Return to the connection dialog and restore the mode and values you recorded. Choose No proxy only if direct connection was your intended previous setup; a managed network may require system or automatic settings. Reload the small check after restoration.

Leaving the gateway selected can continue using your GB during later browsing. Close test tabs and keep any stored proxy credential restricted to a browser profile you control. For scripted tests, configure the client explicitly with the Playwright guide.

What is not allowed

Use the connection for authorised QA, ad verification and market research. Follow each destination’s access rules and the acceptable-use policy.

Read next