TRY NOW
book meeting
BACK TO KB LIST

How to Configure HTTP Proxy for Windows-based Veeam Components

KB ID: 4875
Product: Veeam Backup & Replication
Veeam ONE
Veeam Agent for Microsoft Windows
Veeam Cloud Connect
Published: 2026-07-14
Last Modified: 2026-07-14
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Purpose

This article explains how to configure an HTTP proxy for Windows-based Veeam components when the server must reach the internet through a proxy. It applies to Veeam products installed on Windows, including Veeam Backup & Replication, Veeam Cloud Connect, Veeam ONE, Veeam Service Provider Console, and Veeam Agent for Microsoft Windows.

Note: This article covers Windows-based components only. For Linux-based components (the Veeam Software Appliance and JeOS-deployed appliances), see KB4807.

Connecting to a Veeam Cloud Connect Provider

A tenant's Veeam Backup & Replication server cannot reach a Veeam Cloud Connect provider through an HTTP or HTTPS proxy. Cloud Connect traffic from the tenant's backup server is not HTTP(S)-based and therefore ignores proxy settings.

Solution

Summary

Configuring an HTTP proxy for Veeam components on Windows requires setting the proxy in up to three different places:

  • WinHTTP is used by various Veeam components and is configured with netsh.
  • WinINET (Internet Options) is used by components that rely on Windows Internet and is configured per user account.
  • System-wide environment variables (HTTP_PROXY, HTTPS_PROXY, and NO_PROXY) are new in Veeam Backup & Replication 13.

In Veeam Backup & Replication 13, many components were moved to modern .NET Core, and as such, they read their proxy configuration from environment variables first, falling back to WinINET (Internet Options) only when no environment variables are set. These components will not read the WinHTTP (netsh) configuration at all.

HTTP Proxy Authentication Is Not Supported

Proxy authentication is not supported. Because WinHTTP cannot authenticate to a proxy, the HTTP proxy must not require authentication. Use a proxy that permits connections without credentials, for example one that authorizes clients by source IP address.

Configure WinHTTP Proxy
System-Wide Configuration
This change is system-wide and will affect all applications that use WinHTTP, including other third-party or Windows services that use WinHTTP (e.g., Windows Update).

Check Current WinHTTP Proxy Settings

This command will display the current WinHTTP settings:

netsh winhttp show proxy

Set WinHTTP Proxy Settings

This command can be used to set a WinHTTP proxy:

netsh winhttp set proxy proxy-server="<proxy>:<port>"

Note: Replace <proxy> and <port> in quotes with the actual proxy server's hostname or IP and the port it uses. For example, this command would set the proxy for all protocols to use proxy.domain.tld (192.168.111.111) port 8080:

netsh winhttp set proxy proxy-server="192.168.111.111:8080"

netsh winhttp set proxy proxy-server="proxy.domain.tld:8080"

A more advanced example using a specific protocol and exclusions:

netsh winhttp set proxy proxy-server="http=proxy.domain.tld:8080" bypass-list="*.labdomain.tld;*.devlab.tld"

Reset WinHTTP Proxy

This command can be used to reset the WinHTTP settings back to default (no proxy).

netsh winhttp reset proxy
Configure Internet Options (WinINET) Proxy
Proxy settings within Internet Options are configured per user. While the account you are logged in as may be able to access the internet through the proxy, the backup service account may not have access if that account hasn't had its internet connection settings configured.
Account-Level Configuration
Assigning the Proxy Settings for an account, whether a dedicated account or LocalSystem, will allow all services and applications that use that account to access the internet using the configured proxy.

Identify the Service Account

Open Services and check which account is listed in the 'Log On As' column for the following services, based on the Veeam product in use:

  • Veeam Backup & Replication — Veeam Backup Service
  • Veeam Agent for Microsoft Windows — Veeam Agent for Microsoft Windows
  • Veeam ONE — Veeam ONE Monitoring Service
  • Veeam Cloud Connect — Veeam Backup Service
  • Veeam Service Provider Console — Veeam Management Portal Service

The account can also be checked using PowerShell. The following example is for Veeam Backup & Replication or Veeam Cloud Connect:

Get-CimInstance Win32_Service -Filter "Name='VeeamBackupSvc'" | Select-Object Name, StartName

Service Account is Local or Domain User

If the Service Account is a user, perform the following steps.

  1. Log on to the machine using that Service Account.
  2. Open Internet Options (inetcpl.cpl)
  3. Switch to the Connections tab.
  4. Click 'LAN settings'.
  5. Configure the Proxy settings in the 'Proxy server' section.

Service Account is LocalSystem

If the Service Account is the account LocalSystem, it will not be possible to log in as that user.
Documented below are two methods that can be used to configure the proxy settings for the LocalSystem account.

Method 1: Use PsExec to Configure Internet Options as LocalSystem
  1. Download PsExec from Microsoft's website: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec.
  2. Open the zip and place PsExec.exe in a location that is convenient to access from a command line. (C:\temp\)
  3. Open an Administrative Console (Command Prompt or PowerShell).
  4. Change to the folder where you placed PsExec.exe in Step 2.
  5. Run the following command to launch a Command Prompt as LocalSystem:
PsExec.exe -s -i cmd.exe
  1. In the new command prompt window that appears, open Internet Options by running the command:
inetcpl.cpl
  1. In the Internet Options window that opens, switch to the Connections tab.
  2. Click 'LAN settings'.
  3. Configure the Proxy settings in the 'Proxy server' section.
    Be sure to include all proxy settings you want the LocalSystem to use, including bypasses and exclusions.
Method 2: Copy Proxy Connection Settings From Current User to LocalSystem
  1. Configure the proxy settings for the current user.
    1. Open Internet Options (inetcpl.cpl)
    2. Switch to the Connections tab.
    3. Click 'LAN settings'.
    4. Configure the Proxy settings in the 'Proxy server' section.
      Note: The settings you configure will be duplicated to the LocalSystem account, so be sure to include all settings you want the LocalSystem to use, including bypasses and exclusions.
  2. Open an Administrative PowerShell console.
  3. Run the following command to copy the DefaultConnectionSettings from the current user's settings to the setting used by the LocalSystem account:
Copy-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" -Name "DefaultConnectionSettings" -Destination "Registry::HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"
Configure the System-Wide Environment Variables (VBR 13+)
Three environment variables are used by .NET Core-based Veeam Backup & Replication 13+ components:
Variable Purpose
HTTP_PROXY Proxy used for HTTP requests.
HTTPS_PROXY Proxy used for HTTPS requests.
Most relevant for Veeam Backup & Replication, since traffic to public clouds is HTTPS.
NO_PROXY A comma-separated list of hosts to exclude from proxying.
Swipe to show more of the table

Each proxy variable is a URL that includes the scheme used to reach the proxy itself (normally http), for example http://proxy.domain.tld:8080. The scheme refers to how the proxy is contacted, not to the target, so an HTTPS target reached through a standard proxy still uses HTTPS_PROXY=http://proxy.domain.tld:8080.

Set the variables machine-wide (not per user) so the Veeam services can read them. Environment variables are read only when a process starts, so the services must be restarted (or the server rebooted) afterward.

Set $ProxyUrl and $NoProxy at the top of the script below for your environment, then run it in an elevated PowerShell terminal:

# Run in an elevated PowerShell console. Set these two values for your environment first.
$ProxyUrl = "http://proxy.domain.tld:8080"
$NoProxy  = "localhost,127.0.0.1,[::1],vbr01,vbr01.domain.tld,10.0.0.10,domain.tld,.domain.tld"

# Apply the variables machine-wide
[Environment]::SetEnvironmentVariable("HTTPS_PROXY", $ProxyUrl, "Machine")
[Environment]::SetEnvironmentVariable("HTTP_PROXY",  $ProxyUrl, "Machine")
[Environment]::SetEnvironmentVariable("NO_PROXY",    $NoProxy,  "Machine")

# Restart the Veeam services so they read the new variables
Get-Service veeam* | Restart-Service -Force
NO_PROXY — Considerations and Limitations

Traffic between Veeam Backup & Replication components, on the backup server itself and on other internal servers, must not be sent to the proxy. Entries must be configured within the NO_PROXY variable:

  • Comma-separated, with no spaces between entries.
  • Wildcards are not accepted (unlike the WinHTTP bypass-list).
  • A leading dot matches subdomains but not the apex domain, so list both forms:
    • domain.tld
    • .domain.tld
  • Exact IP addresses must be used. (CIDR ranges are not supported.)
  • IPv6 literals must be bracketed: use [::1], not ::1.
  • Exclude the backup server itself, or local inter-service traffic will be sent to the proxy and fail. Include at a minimum localhost, 127.0.0.1, and [::1]; the server's short hostname and FQDN; the server's IP address(es); and your internal domains.

Extend NO_PROXY with any other internal endpoints the server must reach directly, such as remote Veeam Backup & Replication servers you manage from this console, remote mount servers, backup proxies, and repositories.

Verify

Confirm the variables are set at machine scope, then retry the operation that previously failed (for example, a Veeam Vault repository rescan or a license update):

[Environment]::GetEnvironmentVariable("HTTP_PROXY", "Machine")
[Environment]::GetEnvironmentVariable("HTTPS_PROXY", "Machine")
[Environment]::GetEnvironmentVariable("NO_PROXY", "Machine")

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.