The Codex "network proxy" is not a way to choose an exit country. This page explains what it is, which keys control it and what to check when a command cannot reach a site.
The first is the Codex network proxy: a listener on your own machine (by default http://127.0.0.1:3128, with a SOCKS5 listener on 8081) that sits between sandboxed commands and the internet and checks each destination against your domain rules.
The second is an outside proxy server, such as a static ISP IP, that your traffic is sent through so that it leaves from another address. That is set with environment variables like HTTPS_PROXY, not with features.network_proxy. The rest of this page is about the first one.
| Item | Setting | What it changes |
|---|---|---|
| Command network access | [sandbox_workspace_write] network_access = true, or permissions.<name>.network.enabled = true | Lets commands in the sandbox use the network at all. By default the workspace-write sandbox has it off. |
| Domain rules | features.network_proxy with enabled = true and domains | Allows or denies destinations once network access is on. The proxy does not grant access by itself. |
| Outside proxy for Codex requests | HTTPS_PROXY in the environment | Sends requests through a proxy server. Not part of features.network_proxy. |
| Exit country | The proxy server you route through | Not a Codex setting. The IP of the outside proxy decides it. |
Read from the Codex configuration reference and the agent approvals page on 15 November 2026. Names may change while the feature is experimental.
| Item | Network access | Network proxy | Result |
|---|---|---|---|
| Case 1 | Off | On | Network stays off; the proxy does nothing |
| Case 2 | On | Off | Commands reach any destination; domain rules are not enforced |
| Case 3 | On | On | Traffic follows your domain rules; destinations not allowed are refused |
From the agent approvals page, read on 15 November 2026. With no allow rules at all, no external destination is allowed.
Set network_access = true under [sandbox_workspace_write], or enable network in the permissions profile you use.
Add [features.network_proxy] with enabled = true and a domains map. Use exact hosts, *.example.com for subdomains only, **.example.com for the domain and its subdomains. If a host matches both allow and deny, deny wins.
Start a new session, then run the three checks below inside it and compare the answers with your rules.
The reference allows a global * rule but the approvals page recommends scoped rules. Add hosts as you meet a real need.
# ~/.codex/config.toml
# 1) Let commands in the workspace-write sandbox use the network at all
[sandbox_workspace_write]
network_access = true
# 2) Start the network proxy so domain rules are enforced (experimental)
[features.network_proxy]
enabled = true
domains = { "api.openai.com" = "allow", "*.github.com" = "allow", "example.com" = "deny" }
Example only. The keys follow the Codex configuration reference; the hosts are placeholders for yours.
# Inside a Codex session, ask it to run these and read the answers:
curl -sS -o /dev/null -w "%{http_code}\n" https://api.openai.com/v1/models # 401 = reachable (no key sent)
curl -sS -o /dev/null -w "%{http_code}\n" https://example.org/ # blocked if not on the allow list
curl -sS https://ipinfo.io/json # which exit IP do commands use?
Example only. A 401 from api.openai.com without a key means the host was reachable; the third line shows the exit IP that commands use.
Check Network access may be off: the proxy does not grant it. Check network_access or the profile's network.enabled.
Fix Turn network access on, restart Codex and test again.
Stop when If it still fails with access on and the host allowed, test the same host without the proxy to rule out your own network.
Check The domains map has no allow rule for it, or a deny rule matches and deny wins.
Fix Add an exact allow rule, or narrow the deny pattern.
Stop when Do not add a global * allow just to make one host work.
Check allow_local_binding is false by default, which blocks loopback and private destinations.
Fix Add an exact allow rule for the local address you need, or set allow_local_binding only if you understand what it opens.
Stop when Keep it off on shared machines.
Check Domain rules do not cover web search, apps, MCP or other hosted tools.
Fix Control those tools with their own settings.
Stop when Do not rely on domain rules to restrict them.
If you sign in to Codex with a ChatGPT account from a place where you want a stable, clean exit, that is done with an outside proxy, not with this setting. A static ISP IP stays the same for the whole lease and does not rotate, so one account keeps one address. A proxy does not change OpenAI's terms: use Codex only where OpenAI supports it, because OpenAI warns that using its services from other places may get an account blocked or suspended. If verification appears, complete it honestly.
A static ISP IP costs US$0.50 for one day and US$7.99 for 30 days, the same in every country, and is issued with HTTP or SOCKS5 chosen at purchase. Codex CLI itself is documented in our guide with HTTP proxies. There is no free trial, and the smallest purchase is one IP for one day.
An experimental, off-by-default local proxy for sandboxed commands. It enforces the allow and deny rules you write under features.network_proxy.
No. It filters destinations. The exit IP is decided by the network the machine uses, or by an outside proxy you set up with HTTPS_PROXY.
No. Set HTTPS_PROXY for Codex's own requests as in the proxy guide. The network proxy is only for domain rules on commands.
Network proxy rules apply only when the proxy is enabled, and the proxy only matters when command network access is on. Check both.
No. The reference says domain rules do not cover web search, apps, MCP or other hosted tools.
How to run OpenAI Codex CLI through an HTTP proxy with environment variables, make the setup permanent and fix common errors.
Set HTTPS_PROXY for the Codex process only, with an http:// address on port 2222; Codex does not accept socks5 addresses.
ChatGPT proxy is the GPT / Grok ISP: a dedicated native IP, 10 PTC for 30 days, one IP per person, HTTP or SOCKS5 — and what a proxy cannot change.
View options and pricingWhat a proxy MCP server is, how local and remote MCP servers differ, how to install one in Claude Code, Codex CLI and Cursor, and how to route the server's own traffic through a proxy.
Fixed static ISP proxies: a residential-grade IP that stays the same for the whole term. For social accounts, stores and AI tools. HTTP and SOCKS5.
View options and pricingProduct observation · Confirmed on:
Product facts file of the site (values checked against the console, the backend and the price table on 18-19 October 2026): prices in US$ (1 PTC = US$1), lease terms, protocols, no free trial.
Official documentation · Confirmed on:
Read on 15 November 2026: features.network_proxy is "experimental; off by default"; enabled, domains (allow or deny, deny wins, exact hosts, *.example.com, **.example.com, *), proxy_url default http://127.0.0.1:3128, socks_url default http://127.0.0.1:8081, allow_local_binding default false, allow_upstream_proxy default true; permissions.<name>.network.enabled "does not start the network proxy"; domain rules do not cover web search, apps, MCP or other hosted tools.
Official documentation · Confirmed on:
Read on 15 November 2026: network access in the workspace-write sandbox is off unless network_access = true; features.network_proxy "does not grant network access by itself"; network on and proxy off means unrestricted; network on and proxy on means traffic follows the domain policy.
Official documentation · Confirmed on:
Read on 15 November 2026: using the services in countries or territories not on the supported list "may result in your account being blocked or suspended."
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.
