Proxy settings for IIS applications in web.config

For an ASP.NET app on .NET Framework, add a system.net section inside <configuration> in web.config:

<configuration>
  <system.net>
    <defaultProxy>
      <proxy proxyaddress="http://192.168.0.1:8080" bypassonlocal="true" />
    </defaultProxy>
  </system.net>
</configuration>

Outgoing requests from the app (HttpWebRequest, WebClient, and HttpClient on .NET Framework) now go through 192.168.0.1:8080. ASP.NET restarts the app when web.config changes, so nothing else is needed.

An ASP.NET Core app ignores this section, see the last part.

Attributes

• proxyaddress: the proxy as a full URI with the scheme, http://host:port.
• bypassonlocal="true": requests to localhost, 127.0.0.1 and host names without a dot (http://webserver) skip the proxy.
• usesystemdefault="true": take the system proxy settings from Internet Options; attributes you set override them. Those settings belong to a Windows user, and an app pool account usually has none, so on IIS set proxyaddress explicitly.
• useDefaultCredentials="true" on defaultProxy: if the proxy asks for Windows authentication, the app signs in as the app pool account. For ApplicationPoolIdentity that's the computer account on the network.
• enabled="false" on defaultProxy: no proxy for this app.
• <bypasslist>: regular expressions for addresses that skip the proxy.

All of it together:

<configuration>
  <system.net>
    <defaultProxy enabled="true" useDefaultCredentials="true">
      <proxy proxyaddress="http://proxy.corp.local:8080"
             bypassonlocal="true"
             usesystemdefault="false" />
      <bypasslist>
        <!-- A regular expression: every host in corp.local, on any port -->
        <add address="[a-z0-9-]+\.corp\.local(:\d+)?$" />
      </bypasslist>
    </defaultProxy>
  </system.net>
</configuration>

The same section in %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config applies to every 64-bit .NET Framework 4.x app on the server. 32-bit app pools read Framework instead of Framework64.

Check that requests go through the proxy

From the server, check that the proxy lets you out. curl.exe ships with Windows 10 1803, Windows Server 2019 and later:

curl.exe -I -x http://192.168.0.1:8080 https://example.com

Inside the app, ask .NET which proxy it will use for an address:

var target = new Uri("https://example.com/");
var proxy = WebRequest.DefaultWebProxy.GetProxy(target);
// proxy == target means the request goes directly, without the proxy

ASP.NET Core under IIS

.NET Core and .NET 5+ don't read system.net from web.config. HttpClient takes the proxy from the environment variables HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY, and on Windows, if they aren't set, from the user's proxy settings. Set the variables in the aspNetCore section of the same web.config:

<aspNetCore processPath="dotnet" arguments=".\MyApp.dll"
            hostingModel="inprocess">
  <environmentVariables>
    <environmentVariable name="HTTP_PROXY" value="http://192.168.0.1:8080" />
    <environmentVariable name="HTTPS_PROXY" value="http://192.168.0.1:8080" />
    <environmentVariable name="NO_PROXY" value="localhost,.corp.local" />
  </environmentVariables>
</aspNetCore>

NO_PROXY is a comma-separated list without asterisks. .corp.local with a leading dot matches corp.local and all its subdomains, corp.local without the dot matches only that host.

Or set the proxy in code at startup, before the first request:

HttpClient.DefaultProxy = new WebProxy("http://192.168.0.1:8080", true);

The second argument is BypassOnLocal, like bypassonlocal in the config.