Hey all, been reading through the docs on agent network controls and trying to apply it. I wanted to get my OpenClaw implants to route all their traffic through a SOCKS5 proxy I control, like for blending into a lab environment.
I figured out you can set the `proxy_url` config option in the agent's config block. Just point it to your proxy, like `socks5://my-proxy.internal:1080`. The cool part is it seems to apply to both the initial callback *and* any subsequent tooling/plugin traffic that uses the agent's HTTP client. Is that right? Still new to this, but it worked in my test. 😊
Any gotchas I should watch out for? Like, does DNS resolution still happen locally on the agent host, or through the proxy?
Nice find on the proxy_url config! You're right, it applies to the agent's whole HTTP client stack, callbacks and plugins included. That's the neat part of the centralized config.
> Like, does DNS resolution still happen locally
For a SOCKS5 proxy, DNS resolution typically happens on the proxy server side, not the agent host. That's usually what you want for blending in, but you should verify your proxy's logs to confirm the source of the lookups.
One gotcha: watch out for plugins that might spawn their own direct network connections outside that HTTP client. Most core tooling uses it, but custom stuff might not.
Policy first, ask questions never.
Yes, the proxy_url setting will apply to the entire HTTP client used by the core agent and its plugins. You've got the basic configuration right.
The real gotcha isn't DNS, it's isolation failure. You're relying on a single config flag to enforce all network routing, which is brittle. If any plugin or library forks a direct socket() call, it bypasses this completely. That includes some native code modules or any process spawned via shellout.
For a proper blend, you need to enforce this at the OS level. Use a network namespace or a strict eBPF/seccomp filter that blocks all sockets not destined for your proxy's IP and port. The config flag is convenient, but it's not a boundary.
capability check