System proxy is green, but the browser still shows your home IP—check in order; most cases resolve by step three. If the real target is Claude Code / Cursor / Codex, system proxy often cannot reach those processes; use Tun instead of flipping the same toggle a dozen times.
Order: Connections has new rows → OS proxy writes 127.0.0.1 with the client mixed port → port not occupied → browser extensions/manual proxy → PAC/old leftovers → then Tun (Tun, Tun & AI). Builds: download center.
Match the symptom to the layer
| Observation | Conclusion | Next |
|---|---|---|
| No Connections rows | OS proxy never captured traffic | Check proxy write / permissions |
| Rows but site fails | Sites blocked or DNS | Use blocked-sites / DNS guides |
| One browser only fails | Browser extension / override | Test private mode, blame extension |
| Browser works, CLI fails | Needs Tun / app proxy | Enable Tun or set env proxy |
Confirm it really bypasses
After opening the target site, check Connections: no rows means the OS proxy never captured traffic; rows present but the site fails → sites blocked or DNS. Those are different trees—don’t mix them.
Toggle system proxy off/on and watch whether the OS proxy fields appear or disappear. If nothing is written, check permissions, service mode, and startup order (startup proxy). If fields write but Connections stays empty, inspect ports and browser overrides next.
OS settings, ports, browsers
Host/port must match the client mixed port; a mismatch sends the browser to the wrong listener. Conflicts: port conflict; blocks: firewall. After changing ports, update Allow LAN devices too.
Chrome/Edge extensions, Firefox’s own proxy, and corporate PAC can override the OS. Clear leftover agents (uninstall cleanup). One browser only fails: check that browser; if private mode works, blame an extension.
On managed machines, policy may rewrite proxy settings. Stop fighting the write and evaluate Tun or the company-approved egress path.
Lost after reboot / policy
“Looks enabled” but OS fields are empty: the client started after the browser, lacked permission, or was overwritten. Delaying the first browser launch—or enabling start-with-OS plus restore system proxy—often beats reinstalling.
HTTPS still looks direct: check security suites that intercept TLS, and confirm you’re testing a site that should use PROXY, not a domestic host that rules send to DIRECT (DIRECT rows are not a system-proxy failure).
When to use Tun, when to stop
Browser works, CLI/AI does not: stop tweaking system proxy; enable Tun or set per-app proxy env vars. Tun start failures: Tun start failed. Still lost: common errors, getting started.
Stop when Connections reliably shows the target host and the browser behaves as expected. Don’t stack rules, DNS, and Tun “just in case.” One hypothesis per test turns “feels broken” into a reproducible conclusion.