Mozilla Firefox Proxy Settings: Manual, PAC and Policy

Firefox keeps its own proxy configuration. A new profile starts on Use system proxy settings, but Manual proxy configuration gives that profile its own route while other applications keep the system one. Use the route only for destinations you own or are permitted to access, and follow each destination's terms.

Current releases, including ESR 153, reach the dialog through Settings › Privacy and security › Connection and software security › Advanced settings, then Configure proxy under Proxy settings. Older releases such as ESR 140 use Settings › General › Network Settings › Settings…. Typing proxy into Find in Settings works on either layout, and Mozilla's Connection settings in Firefox article documents each option.

The Connection Settings window, headed Configure Proxy Access to the Internet, offers No proxy, Auto-detect proxy settings for this network, Use system proxy settings, Manual proxy configuration and Automatic proxy configuration URL. The choice is stored as network.proxy.* preferences in the current profile, covering all of its windows, private ones included, and no other profile.

Databay exposes one gateway, gw.databay.co on port 8888, for HTTP proxying, HTTPS CONNECT tunnelling and SOCKS5. In Firefox, the HTTP row carries both web schemes:

1. Select Manual proxy configuration.
2. Enter gw.databay.co in HTTP Proxy and 8888 in its Port box.
3. Check Also use this proxy for HTTPS so the HTTPS Proxy row mirrors those values.
4. Leave SOCKS Host empty and keep No proxy for short.
5. Select OK. The dialog will not close while a filled host lacks a port or fails its hostname check, which catches a pasted scheme or path.

No proxy for (network.proxy.no_proxies_on) accepts comma-separated hosts, domains and CIDR ranges, such as the dialog's example .mozilla.org, .net.nz, 192.168.1.0/24, and <local> matches hostnames without a dot. Firefox never proxies localhost, 127.0.0.1/8 or ::1, and every listed entry goes direct.

Connection Settings has no username or password field. Firefox asks only after the gateway answers with 407 Proxy Authentication Required, showing an Authentication Required prompt that reads “The proxy moz-proxy://gw.databay.co:8888 is requesting a username and password.” Check that it names the gateway, not a website, before typing.

Paste the complete username from the Databay dashboard, such as USER-zone-residential-countryCode-us, and its password; copy the whole value rather than assembling flags by hand. Firefox reuses an accepted credential for later requests to the gateway during the session, so a prompt that keeps returning usually means the gateway rejected the values.

A remembered password becomes a saved login in this profile, and Do not prompt for authentication if password is saved (signon.autologin.proxy) then signs in silently, prompting only when authentication fails; leave it off on shared machines. Keep the master copy in a secret manager, never screenshot or record the prompt with the password visible, keep it out of tickets, chat and logs, and rotate it in the dashboard after any exposure. Never circulate a USER:PASS@gw.databay.co string; that format leaks the credential wherever it is copied.

The dialog's SOCKS Host row, with SOCKS v4 and SOCKS v5 choices, has no credential fields, and Firefox does not show its proxy prompt for SOCKS. Its SOCKS5 client offers RFC 1929 username and password authentication only when the proxy configuration carries a username, which neither the dialog, about:config nor the enterprise policy can supply. A Databay route is selected by the dashboard username, so a SOCKS entry that cannot send it cannot authenticate or select your route.

Extensions can attach SOCKS credentials through Firefox's proxy API, but that is outside this runbook. For SOCKS5 with proxy-side DNS, use a client that sends credentials itself, such as cURL with socks5h:// in the cURL proxy runbook; HTTP versus SOCKS5 covers the trade-offs. In Firefox the HTTP row is the working path, and because each CONNECT request carries the destination hostname, the gateway resolves that name without any SOCKS DNS setting.

Each dialog control is a preference: open about:config, choose Accept the Risk and Continue, and search by name. A user.js file in the profile folder applies the same values at every startup:

user_pref("network.proxy.type", 1);
user_pref("network.proxy.http", "gw.databay.co");
user_pref("network.proxy.http_port", 8888);
user_pref("network.proxy.ssl", "gw.databay.co");
user_pref("network.proxy.ssl_port", 8888);
user_pref("network.proxy.share_proxy_settings", true);

network.proxy.type is 1 for manual, 2 for a PAC URL and 5, the default, for system settings. network.proxy.share_proxy_settings only drives the HTTPS checkbox; Firefox's source notes that the network code ignores it, so set the network.proxy.ssl pair explicitly or HTTPS requests can go direct. Firefox 128 and later store the SOCKS v5 DNS checkbox as network.proxy.socks5_remote_dns (on by default) and the SOCKS v4 one as network.proxy.socks_remote_dns, which ESR 115 and older guides use for SOCKS v5. network.proxy.socks_version (default 5) matters only when network.proxy.socks is set. Delete the user.js lines to hand control back to Settings. No preference stores the proxy password; the Selenium runbook sets these preferences from automation.

For managed fleets, the Proxy enterprise policy sets the same controls through Group Policy, Intune or a UTF-8 policies.json in the installation's distribution folder, or /etc/firefox/policies on Linux:

{
  "policies": {
    "Proxy": {
      "Mode": "manual",
      "Locked": true,
      "HTTPProxy": "gw.databay.co:8888",
      "UseHTTPProxyForAllProtocols": true,
      "AutoLogin": false
    }
  }
}

The port follows the hostname after a colon, and UseHTTPProxyForAllProtocols copies the HTTP value into the HTTPS row. Mozilla notes that unless the policy is locked, changes a user already has in place take effect, so lock it when the route must not drift. The policy has no credential field, covers every profile of that installation, and appears in about:policies after a restart.

Choose Automatic proxy configuration URL when a profile should use the gateway for some hosts and go direct for others. Firefox stores the address in network.proxy.autoconfig_url and calls FindProxyForURL(url, host) for each request, as MDN's PAC file reference describes:

function FindProxyForURL(url, host) {
  // Hosts this profile is authorized to reach
  if (host == "databay.com" || dnsDomainIs(host, ".qa.example.com")) {
    return "PROXY gw.databay.co:8888";
  }
  return "DIRECT";
}

Use the PROXY keyword: HTTPS means TLS to the proxy itself, which is not a documented gateway mode, and SOCKS entries share the SOCKS row's credential gap. Do not append ; DIRECT to a rule that must stay proxied, because Firefox moves to the next entry when it cannot reach a proxy and an outage would send traffic out unproxied. The script does not see the path or query of https:// URLs, so route on host, and it cannot carry credentials, so the 407 prompt still appears. Serve it as application/x-ns-proxy-autoconfig, press Reload after edits, and guard the file, because whoever controls the script controls the route.

A Databay route lives in the username: the pool, an optional location selector and an optional sessionId. Every route shares gw.databay.co:8888, and a running profile keeps reusing the credential it gave the gateway, so treat one profile as one route. Mozilla's Profile Manager guide covers creating and switching profiles.

1. Open about:profiles and select Create a New Profile.
2. Name it after the route, such as databay-us-sticky-qa, not a person or account.
3. Choose Launch profile in new browser, configure the proxy there, and answer the prompt with that route's username.

For continuity, use a sticky username such as USER-zone-residential-countryCode-us-sessionId-abc123. You can request sticky windows up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends. Without a sticky session, a new proxy connection may select an available exit, connection or tunnel reuse may retain one, and a different exit is not promised. Browsers open many parallel connections, so without a sessionId one page's assets may arrive through different exits. Premium Residential targets one country, state, city, ZIP, coordinate or ASN at a time; Residential Flex, Datacenter and Mobile target a country or continent. All pools are shared, and every page asset or background request sent through the gateway counts toward per-GB billing.

In the configured profile, open Databay's What Is My IP page, answer the prompt, and record the observed IP, location estimate, profile name and time. For machine-readable output, load https://databay.com/what-is-my-ip/json or https://api.ipify.org?format=json in the same profile, then repeat the check from a profile set to No proxy; matching addresses mean the route is not in effect.

An observed exit describes that request only. It is not proof of anonymity or of what the next connection will use, as the anonymity levels guide explains. Recheck a sticky route at meaningful checkpoints. The gateway carries no UDP, so UDP-based browser features fall outside what this check proves. Open a destination you own or are permitted to use only after the exit matches the plan.

Find the first failing layer before changing anything: errors before the tunnel opens belong to the proxy hop, errors after it to the destination.

If an extension controls the proxy, the dialog names it with “controls how Firefox connects to the internet” and offers Disable Extension; a locked policy disables the controls instead. For scripted Firefox sessions, the Playwright runbook passes proxy credentials through its own proxy option.