I was recently using an application at work, which was unable to download needed files because proxy settings were not configured for the application. The company firewall blocks non-proxy connections.

If my company wants to intercept/ route all external TCP connections, it seems unnecessary to configure every single application individually. Why is application level preferable to network level proxying?

Some posts like the accepted answer here seem to suggest that network-level proxying won't work because the proxy server would need to understand connection state and peer inside packets. I don't understand why this is the case, if at minimum the proxy is just forwarding packets, and if it does more it doesn't matter whether the client is aware of what it's doing.

In contrast, posts like this imply that it's possible to do a fully transparent proxy, seeming to contradict the top answer of the first post. Where does this discrepancy come from?

  • What your company chooses to use or not to use is their decision and you'd need to ask them why and why they fail to roll out the settings to all clients/devices - speculation and guesswork is explicitly off-topic here. Additionally, proxies at the network level don't and cannot exist as Ron has pointed out in the linked answer. A proxy doesn't just forward packets.
    – Zac67
    Feb 11, 2020 at 9:23
  • 1
    Thanks for the reply. If network level proxies don't exist, what does it mean then to do a transparent proxy? Feb 11, 2020 at 9:24
  • A transparent proxy uses various techniques to become transparent in the network, posing as a router or a bridge. However, it still works at the application level.
    – Zac67
    Feb 11, 2020 at 9:27
  • 1
    Thanks Zac, maybe my question is really "What do packets look like, in terms of payload, TCP/IP headers, etc., on a transparent proxy, and what are the advantages/ disadvantages compared to user-set proxy, from an admin/ security/ etc. perspective". Would be happy to read a full explanation to this question. Feb 11, 2020 at 9:29
  • Then you should post that as another question. Note that it depends on the logic - you won't be able to see everything in a single packet/payload. Make sure you ask precisely for what you want.
    – Zac67
    Feb 11, 2020 at 9:38


Browse other questions tagged or ask your own question.