Use TYO Reach with Firefox
Firefox never uses the system proxy unless you tell it to, which makes it the easiest browser to route on its own. You can let the Reach tray configure it, or set the proxy yourself in Firefox's settings.
Option 1 — the tray's Firefox switch
Turn Firefox on in the Reach tray. Reach finds every profile listed in your
profiles.ini (standard, Snap and Flatpak installs on Linux; the usual locations on
macOS and Windows) and appends a marked block to each profile's user.js:
// --- tyo-proxy begin ---
user_pref("network.proxy.type", 1);
user_pref("network.proxy.http", "127.0.0.1");
user_pref("network.proxy.http_port", 8082);
user_pref("network.proxy.ssl", "127.0.0.1");
user_pref("network.proxy.ssl_port", 8082);
user_pref("network.proxy.no_proxies_on", "localhost, 127.0.0.1, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, .local");
// --- tyo-proxy end ---
Switching Firefox off replaces the block with network.proxy.type = 0 (no proxy), so
Firefox is pinned to direct even if your desktop's system proxy is on for other browsers.
Because user.js is read at startup, restart Firefox after switching on or off. The
block is self-contained and is removed cleanly; nothing else in your profile is touched.
Option 2 — Firefox's own proxy settings
Useful when you want Firefox routed without the tray managing it, or for a profile Reach can't see. In Firefox open Settings → General → Network Settings → Settings… and choose Manual proxy configuration:
- HTTP Proxy:
127.0.0.1, Port:8082, tick Also use this proxy for HTTPS
or, using SOCKS:
- SOCKS Host:
127.0.0.1, Port:1080, select SOCKS v5 - tick Proxy DNS when using SOCKS v5 so hostnames resolve on the gateway side — otherwise DNS lookups leave from your real connection and some sites on restricted networks won't resolve at all.
Add local addresses to No proxy for:
localhost, 127.0.0.1, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, .local
Either configuration can also be saved into user.js by hand using the prefs above
(network.proxy.socks, network.proxy.socks_port, network.proxy.socks_remote_dns
for the SOCKS variant).
Which to use?
| Tray switch | Manual settings | |
|---|---|---|
| Follows Reach on/off automatically | No — Firefox keeps trying the proxy while Reach is off | No |
| Applies to every profile | Yes | One profile at a time |
| Works with portable / custom profiles | No | Yes |
| Managed by org policy | Yes (admins can pre-set it) | No |
In both cases, when the proxy is off the ports aren't listening and Firefox shows "The proxy server is refusing connections" until you switch Reach on again or set Firefox back to No proxy. That's by design — Reach won't silently let routed traffic fall back to your real IP.
Common questions
Can I use Firefox containers or a separate profile just for Reach?
Yes. Create a second profile from about:profiles, apply Option 2 to it, and keep your
main profile on No proxy. Container tabs share proxy settings within a profile, so a
profile is the right unit.
Does the tray switch also set Firefox's DNS-over-HTTPS?
No. Reach only writes the proxy prefs shown above. With the HTTP proxy configuration,
Firefox sends hostnames to the proxy in its CONNECT requests, so remote resolution
happens regardless of your DoH setting.
Why is security.enterprise_roots.enabled in the block?
It lets Firefox trust certificates from the operating system store, which matters on managed corporate machines. Reach itself installs no certificate — HTTPS is never intercepted. See Security.