Does the proxy see our mainframe traffic?

Not on an encrypted connection. TLS runs with the host, inside the proxy's tunnel, so the proxy sees only encrypted bytes.

Where does the proxy password come from?

From the computer's credential store, under the name IT sets in ProxyCredential, or WND Terminal Proxy by default. Otherwise people are asked when they connect, and the password is kept in memory only.

Are PAC files or NTLM proxies supported?

No. WND Terminal doesn't run PAC scripts or WPAD, and it doesn't sign in to proxies that accept only Negotiate, Kerberos or NTLM.

Connect Through a SOCKS or HTTP Proxy

On a small screen, swipe the table to read all columns.

Proxy setting	Kind	Sign-in
`socks5://proxy.example.com:1080`	SOCKS5. The proxy looks up the host’s name, so names only its side of the network knows work too.	None, or a user name and password
`socks4a://proxy.example.com:1080`	SOCKS4a. The proxy looks up the name.	A user ID in the address
`socks4://proxy.example.com:1080`	SOCKS4. The computer looks up the name and sends an IPv4 address.	A user ID in the address
`http://proxy.example.com:8080`	An HTTP proxy, with CONNECT	None, or a user name and password (Basic)
`system`	The proxy set in Windows or macOS	As for the proxy it finds
`none`	Connect directly	None

Choose a proxy

People choose one under Proxy on the connect page, unless IT has set it. IT sets one proxy for every connection with the Proxy policy setting, or the Proxy server setting in Group Policy. A connection IT sets up can have its own Proxy, or none to go directly. With AllowUserProxy = false, people can’t choose a proxy for their own connections.

{
  "Proxy": "system",
  "AllowUserProxy": false,
  "Connections": [
    { "Name": "Production", "Host": "mvs.example.com", "Port": 992, "Secure": true },
    { "Name": "Branch", "Host": "mvsbranch.example.com", "Port": 23, "StartTls": true, "Proxy": "none" }
  ]
}

In Group Policy, a connection line takes |proxy=socks5://proxy.example.com:1080 or |proxy=none at the end.

What goes through it

Every connection a session makes goes through the proxy. That includes backup hosts, reconnects, printer sessions and file transfer.

Encryption runs end to end. The TLS connection is with the host, inside the proxy’s tunnel, so the proxy sees only encrypted bytes. The host’s certificate is checked as it would be without a proxy, and smart cards work the same.

This computer’s proxy settings

system uses the proxy the computer already has.

Windows. The proxy set by hand in Settings or Internet Options, with its exceptions. A socks= entry is used first, then https=, then the single address for everything.
Mac. The active network’s SOCKS, secure web (HTTPS) or web (HTTP) proxy, with its exceptions.
No system proxy. When Windows or macOS has none set, the ALL_PROXY, HTTPS_PROXY and HTTP_PROXY variables, with NO_PROXY.

WND Terminal doesn’t run automatic configuration scripts (PAC) or WPAD. With only a script set, connections go directly, which is what scripts usually say for hosts inside the network. If yours sends mainframe connections through a proxy, set that proxy in Proxy instead.

Proxy sign-in

A user name can go in the address, such as socks5://[email protected]:1080. A password never does. When the proxy asks for one, WND Terminal reads the sign-in IT stored in the computer’s credential store, under the name in ProxyCredential. Without that setting, the name is WND Terminal Proxy.

cmdkey /generic:"WND Terminal Proxy" /user:BANK\jsmith /pass
security add-generic-password -s "WND Terminal Proxy" -a jsmith -w

The first line stores it in Windows Credential Manager. The second stores it in a Mac’s Keychain. Without a stored sign-in, people are asked for their proxy user name and password when they connect. What they type stays in memory until WND Terminal closes and is never written anywhere.

What isn’t supported

Proxies that accept only Windows sign-in (Negotiate, Kerberos or NTLM). WND Terminal says so when it meets one.
Automatic configuration scripts (PAC) and WPAD.

HTTP proxies often allow CONNECT only to port 443. Ask whoever runs yours to allow your mainframes’ ports, such as 23 and 992.

When something goes wrong

Messages say what happened in plain words. The proxy couldn’t be reached, it refused the connection to the host, it needs a password, it didn’t accept the one given, or it isn’t the kind of proxy that was set up. The audit log records the proxy each session went through.

In the browser

The gateway has its own proxy setting, proxy in its [hosts] section, with proxy_user and proxy_password_file if the proxy asks for a sign-in. People in the browser can’t choose a proxy. The gateway looks up each host itself, checks the address against its network rules and gives the proxy that address, so the proxy can’t be used to reach anything the rules don’t allow.

For encryption on the host’s telnet port, see TLS, certificates and smart cards. For every setting, see Policy settings.

Proxy servers