Proxy settings in Datto RMM
Security and navigation
PERMISSIONS Refer to Sites > Sites in Permissions.
NAVIGATION Sites > All Sites > Create Site > Proxy type section
NAVIGATION Sites > All Sites > click the name of a site > Settings (left navigation menu) > Proxy type section
Overview
A proxy server is an intermediary connection between a device and the internet. It processes outbound requests from the device and returns the requested data. Organizations use proxy servers to cache frequently accessed content, control or filter internet traffic, improve security, and hide internal IP addresses.
Datto RMM supports proxy configuration at two levels: the site level, which applies settings automatically to any new agent installed at that site, and the agent level, which lets you configure individual devices manually. HTTP, Socks4, and Socks5 proxy types are supported.
Proxy environments generally fall into two scenarios, each of which has different implications for the Datto RMM Agent:
- Caching proxy: The proxy caches and optimizes outbound traffic, but devices can still reach the internet directly if the proxy is bypassed or unavailable. The agent connects successfully in this environment, routing through the proxy when configured to do so.
- Filtering proxy: The proxy enforces network policy and devices cannot communicate with the internet unless traffic passes through it. In this environment, the agent must be correctly configured with the proxy details; without them, the agent will appear offline.
NOTE Not all Datto RMM features work through a proxy. Review the Limitations section before deploying proxy settings across your environment.
Proxy type section
The Proxy type section appears on both the New Site page when creating a site, and the Settings page when editing an existing site. The fields available depend on the proxy type you select.
Proxy type fields
Select a proxy type to reveal the connection detail fields. Select None to disable proxy use for the site.
| Field | Description |
|---|---|
| Proxy Type | The protocol the proxy server uses. Select None, HTTP, Socks4, or Socks5. Selecting anything other than None reveals the fields below. |
| Proxy Host | The DNS name or IP address of the proxy server. |
| Proxy Port | The port number used to communicate with the proxy server. |
| Proxy Username | The username required to authenticate with the proxy server, if applicable. |
| Proxy Password | The password required to authenticate with the proxy server, if applicable. |
Limitations
The following Datto RMM features do not work through a proxy, or have reduced functionality in proxy environments.
| Feature | Limitation |
|---|---|
| Web Remote | Web Remote does not use proxy settings when establishing a connection. If outbound traffic to the required ports and URLs is blocked by a filtering proxy, Web Remote sessions may fail to connect. Ensure that the Web Remote URLs and port 3478 (UDP) are permitted at the network level. Refer to Allowlist requirements for IP addresses and URLs. |
| Advanced Software Management | Advanced Software Management (ASM) does not currently support proxy-configured Datto RMM agents. If the agent is configured to use a proxy, ASM will not function on that device. Refer to Advanced Software Management. |
IMPORTANT In a filtering proxy environment where devices cannot reach the internet directly, Web Remote and Advanced Software Management will be unavailable on proxy-configured agents until the respective network-level allowlist entries are in place or the features gain proxy support.
Important reminders
- Site proxy settings apply to new agents only. Proxy settings saved at the site level apply only to agents installed after the settings are saved. Agents already installed at the site before proxy settings were configured will not update automatically; you must update each existing device manually. Refer to Configure proxy settings in the Datto RMM Agent.
- Roaming devices fall back gracefully. If a proxy is configured for a site and a device (for example, a laptop) is taken off-site, the agent attempts to connect using the configured proxy settings first, then any browser proxy settings it can detect, and finally without a proxy. As a result, roaming devices continue to check in rather than appearing offline.
- macOS and Linux changes require a restart. After editing proxy settings in the configuration file on macOS or Linux, restart the agent for the changes to take effect.
- WinHTTP settings are separate. Windows Update and other system services use WinHTTP proxy settings, which are separate from the Datto RMM agent proxy settings. If patch data appears inconsistent, check your WinHTTP configuration. Refer to How can I change the WinHTTP proxy settings?
How to...
Configure site proxy settings in the web interface
To configure proxy settings for a site, complete the following steps:
- Navigate to the site settings using either of the first two navigation paths described at the top of this article.
- In the Proxy type section, select the proxy type your environment uses: HTTP, Socks4, or Socks5. Select None if you do not want to configure a proxy for this site.
- For proxy types other than None, complete the Proxy Host, Proxy Port, Proxy Username, and Proxy Password fields as required by your proxy server.
- Click Create Site or Save Site, depending on whether you are creating a new site or editing an existing one.
The proxy settings are saved and will apply automatically to any new agent added to the site. Agents already installed at the site before these settings were saved are not affected and must be configured manually.
You can also configure proxy settings when creating a new site by completing the Proxy type section on the New Site page.
Configure proxy settings in the Datto RMM Agent
BEFORE YOU BEGIN Use this procedure for devices that were already installed at a site before site-level proxy settings were configured, or for any device that requires individual proxy settings that differ from the site defaults.
Complete the steps for the operating system installed on the device you want to configure.
Windows
- Right-click the Datto RMM icon in the system tray and select Settings.
- Click the Network tab.
- Select the proxy type: HTTP, Socks4, or Socks5.
- Type the proxy details in the DNS/IP (host), Port, Username, and Password fields as required by your proxy server.
- Click OK to apply the settings.
The agent immediately uses the new proxy settings.
macOS and Linux
IMPORTANT You must perform the following steps as root or via sudo.
- Open the agent configuration file for your operating system:
- macOS:
/Applications/AEM Agent.app/Contents/MonoBundle/CentraStage.exe.config - Linux:
/opt/CentraStage/UnixService.exe.config
- macOS:
- Locate the proxy settings section and enter the appropriate values. Use the numeric proxy type codes shown in the comments:
0= None,1= Socks4,2= Socks5,3= HTTP.EXAMPLE For example, an edited file (where proxy type = HTTP, proxy IP = 127.0.0.1, proxy port = 8888, username = ExampleUsername, password = ExamplePassword) would look like this:
- Save the file.
- Restart the agent for the changes to take effect.
The agent connects using the updated proxy settings after it restarts.
FAQ
Will a laptop appear offline when taken off-site if the site is configured to use a proxy?
No. The agent falls back automatically and continues to check in.
When a device leaves the office and the configured proxy is unreachable, the Datto RMM Agent does not simply stop trying. It attempts to connect in the following order: first using the configured proxy settings, then using any browser proxy settings it can detect on the device, and finally without a proxy at all. As a result, roaming devices such as laptops continue to appear online and report back to the platform even when they are off-site.
Will site proxy settings apply to devices that are already at the site?
No. Site proxy settings apply only to new agents added after the settings are saved.
If you configure or update proxy settings for an existing site, any agents that were already installed at that site are not updated automatically. You must configure each existing device individually. Refer to Configure proxy settings in the Datto RMM Agent.
Can I use Web Remote through a proxy?
Web Remote does not use proxy settings, so it requires direct access to its required URLs and ports.
Web Remote bypasses the agent proxy configuration entirely when establishing a connection. In a caching proxy environment where devices can still reach the internet directly, Web Remote typically works without additional configuration. In a filtering proxy environment where all outbound traffic must pass through the proxy, Web Remote will fail unless the required URLs and port 3478 (UDP) are explicitly permitted at the network or firewall level. Refer to Allowlist requirements for IP addresses and URLs for the full list of endpoints to allow.
Will Advanced Software Management work on proxy-configured agents?
No. Advanced Software Management does not currently support proxy-configured Datto RMM agents.
If a device's agent is configured to use a proxy, Advanced Software Management (ASM) will not function on that device. Standard Software Management is unaffected. If ASM is a requirement for your environment, consider whether those devices can have their proxy configuration removed, or contact Kaseya support to discuss your options. Refer to Advanced Software Management.
Why does patch data in Datto RMM not match what I see in Windows Update on the device?
The agent proxy settings and WinHTTP proxy settings are separate. Mismatched patch data often means WinHTTP is not configured correctly.
Datto RMM uses its own proxy configuration to communicate with the platform, but Windows Update uses the WinHTTP proxy settings, which are a separate Windows system setting. If WinHTTP is not configured to use your proxy, Windows Update may not be able to retrieve updates, causing the patch list in Datto RMM to differ from what is shown locally in Windows Update. In some cases, no patches are listed at all. Refer to How can I change the WinHTTP proxy settings? for instructions on correcting this.
