Forza Horizon Proxy: Which Requests Enter the Tunnel and Which Do Not?
What complicates the proxy decision in a Forza Horizon setup is not the game itself but the processes around it: the launcher handles account verification, the operating system's background service downloads the patch, and the game talks through a separate network stack. This page explains how these three processes behave differently with respect to a proxy.
Three separate processesThe independent network behaviour of the launcher, the background delivery service and the game client.
02
Requests and streamsThe transport difference between request-response traffic over TCP and continuous streaming.
03
The reality of regionsThe practical consequences of the distinction between the server region and the account's registered country.
04
Rule and scopeThe points where you can write the setting and the set of traffic each one covers.
The difficulty of setting up a proxy for a racing game comes less from the game's network code than from the division of labour on the desktop. On screen a single application appears; in the background, a launcher managing the account and entitlement, a system service handling file downloads and the game's own network stack all run separately. They do not all read the same setting.
That is why behind the sentence "I set up a proxy but it isn't working" there is usually not a fault but a scope error: the rule has been written somewhere other than the process producing the traffic. The sections below first separate the processes, then explain which traffic can enter the tunnel and which cannot, and why the region question is most of the time not about the IP at all.
Let us set a boundary up front: a proxy changes your exit address, not your account's registered country or the store rules. These two things are frequently confused, and the confusion always ends in the same disappointment.
What happens from the moment you launch the game until you are in online free roam?
The sequence usually starts with the launcher. The application opens, verifies your account, checks that the game belongs to you and pulls your library. All of this is HTTPS traffic working in request-response form; it is also the easiest part to write into a proxy rule, because the launcher uses the network like an ordinary desktop application.
The second step is version checking. The version of your local files is compared with the version on the server, and if there is a difference the download begins. The important characteristic of this step is that the download is most often carried out not by the game or the launcher itself, but by the operating system's background delivery mechanism. If you wrote your setting only into one application, the download never sees that setting.
In the third step the game opens and connects to the online services: profile, progression, event calendar and player lists are pulled. Up to this point everything is still in request-response order. In the fourth step the picture changes; when you join online free roam, vehicle positions and session state turn into small packets flowing continuously and the transport requirement becomes entirely different.
Separating these four steps makes diagnosis easier. If the launcher opens but the game cannot connect to the online services, the problem is not in the first two steps; if the game opens but the download does not progress, the rule does not cover the delivery service. The HTTP CONNECT method article details how these requests are carried in the tunnel.
DIAGRAMFour steps from launch to online free roam
You can scroll the diagram horizontally to inspect it
The first three steps work in request-response order and can be written into a proxy rule; the fourth step is continuous and requires different transport behaviour.
The distinction between request-response traffic and continuous streaming
On the network side there are two different behaviours, and the two are not carried by the same tool. Request-response traffic is short-lived: a connection is established, data is received, the job is done. Preserving the order and retransmitting a lost piece matter; TCP does exactly that. A proxy tunnel naturally carries this behaviour as well.
Continuous streaming wants the opposite. Position and state information is sent at frequent intervals, a late packet has little value and retransmission is often harmful. That is why real-time game traffic predominantly uses UDP. An HTTP proxy cannot carry this stream; SOCKS5 can carry it only if UDP ASSOCIATE is supported on both the server and the client side. The difference in scope between the two protocols is in the HTTP versus SOCKS5 comparison in detail.
There is one more detail on the Windows side. The console ecosystem's network layer can rely on tunnelling methods designed to carry IPv6 connectivity over IPv4 networks; one of these, Teredo, runs over UDP and appears by name in system network diagnostics screens. If such a mechanism is active, part of the traffic is already inside its own tunnel and moves independently of the HTTP proxy you defined. It is useful to read the difference in scope between the IPv4 and IPv6 sides together with the SOCKS5 UDP support article.
The conclusion is this: when you define a proxy you should expect it to carry not all of the game's traffic, but only the request-response side. Once this expectation is set correctly, the setup is not considered a failure either; its scope simply becomes known.
DIAGRAMTraffic that enters the tunnel and traffic that stays outside
You can scroll the diagram horizontally to inspect it
Although the two sets belong to the same session, they do not travel the same path; what they share is that both serve the session of the same account.
Who downloads the patch: the launcher or the system service?
On PC the game can be installed from different distribution channels, and download behaviour varies by channel. For titles installed through the store client, the file transfer is mostly carried out by the operating system's own delivery service; the game process may not even be running at the time. In versions installed through a game client, the download is handled by that client's own download engine, which has its own settings screen.
This distinction directly determines where the rule should be written. Although the system proxy setting appears in a single place in Windows, applications read this information through different interfaces: some use the setting on the WinINET side, some look at the configuration on the WinHTTP side, and some ignore both and expect their own setting. Which settings screen affects what is broken down in the Windows 11 proxy settings article.
The practical consequence: manage download traffic deliberately. If you are using a metered exit, leaving large patches outside the proxy is usually the right decision; if you are using a fixed, audited corporate exit, you may on the contrary want the download to go through the same gate as well. The equivalent of a similar distinction on the game client side is illustrated in the Steam proxy settings article.
Tip
To understand which process the download goes through, close the game completely and start the update on its own. If the download continues, it means the file transfer is being carried out not by the game but by another component running in the background.
DIAGRAMThe layers on the desktop and who reads the proxy setting?
You can scroll the diagram horizontally to inspect it
These five layers running on the same machine do not read the same setting; whichever layer the rule was written into is the only one it covers.
An exit plan for your Forza Horizon setup
For corporate setups that require a fixed address, an ISP or data centre exit is appropriate; for work that requires verifying a regional view, a residential pool is.
Choose whichever you need from our residential proxies, datacenter proxies, IPv6 and ISP solutions. Every plan comes with unlimited options, 99.9% uptime, rotating proxies, sticky sessions and 24/7 support. Ideal for web scraping, ad verification, SEO monitoring and digital data collection.
ISP ProxyStatic Turkish IPs registered to an ISP
ISP-registered static Türkiye IPs; they combine datacenter speed with the reputation of a real carrier. Ideal for long sessions and low-ping use.
Region assignment and the account's registered country are not the same thing
The region question comes up at two different layers, and when they are confused it produces false expectations. The first layer is the server region: which data centre the online session will be opened in. This decision is mostly made on the matchmaking side; the options the client offers the user vary by version, and if the game has its own network or online settings, that is where to look first.
The second layer is the account's registered country. The store catalogue, currency, price and the availability of some services depend not on the IP address but on the country registered in the account profile and on the payment instrument you use. That is why changing your exit country does not change the account's country; the reverse is also true — the account's country does not hide where your connection comes from.
Once this distinction is understood, the legitimate use of a proxy also becomes clear: verifying how a page, a campaign or a support article looks from different countries. Marketing and support teams do this regularly, and the whole job is on the web side. For exit countries, see location list .
The boundary is equally clear. Taking advantage of regional price differences or purchasing from a catalogue that does not match the account's registered country is a matter explicitly regulated in the platforms' terms of service and falls outside the scope of this page. For the general framework, see terms of use page.
The points where you can write the rule and the traffic they cover
The proxy details are always the same; what changes the scope is where you write them. There are four options on the desktop, and each has a different cost. The table below gives the short summary to look at before deciding.
Setup point
Traffic covered
Its clear limit
Operating system setting
All applications that read the setting
Not every process reads it; patch downloads are also in scope
Per-application routing
Only the processes you select
Narrow scope, requires an additional tool
The launcher's own setting
Launcher requests and its own downloads
Does not cover the game process
A rule on the router
Every device on the network
Affects everyone on the home network, troublesome to undo
A rule covering the entire home network looks at first glance like the most practical option, but it is also the hardest to diagnose: it becomes harder to separate whether the source of a problem on one device is that device or the gateway. The details of the configuration on the router side are using a proxy via the router article.
Apply one rule when making your choice: start with the narrowest scope and widen as needed. If an application-level rule does the job, there is no reason to move to system-wide; if the system setting is enough, do not touch the router. Broad scope only magnifies the side effects.
What do you verify after setup, and in what order?
Assuming the setup works is the most common source of errors on the game side. Verification should seek answers to three separate questions: has my exit address really changed, where is domain name resolution performed, and is part of the traffic bypassing the rule?
Answer the first question with the my IP address page. The important detail is to run the test in the context where the rule applies: if you wrote an application-level rule, checking from the browser gives you wrong information. For the second question, DNS leak test is sufficient; if resolution is done on your network, the target domains are visible to your local provider and the distribution node is also selected based on your location.
The third question is the most insidious. If your exit is IPv4 only but IPv6 is enabled on your device, a request to a target reachable over IPv6 can bypass the proxy entirely; operating systems prefer IPv6 in most setups. No symptom appears, the page loads and the setup seems to work. The solution splits in two: use an IPv6-capable exit, or disable IPv6 on that profile.
Repeat the tests with the proxy on and off and put the results side by side.
Note which process you tested in; the result is specific to that process.
After a change, close the launcher and the game completely and restart them.
Before considering a setup "working", try the download, the login and the online connection separately.
Common symptoms and what they actually indicate
The table below matches the symptoms most frequently reported after setup with their likely causes. Read the table by your symptom rather than from top to bottom, and change only one variable at a time.
Symptom
Possible cause
First check
The launcher opens, the game does not go online
The rule covers the launcher but not the game process
Verify which process the rule applies to
The download does not start or crawls
The delivery service does not read the setting, or a distant node was selected
Take the download outside the proxy and try again
Drops during online free roam
The stream traffic does not enter the tunnel, or the path is variable
Try the same session with the proxy off
Price and catalogue differ from what was expected
The account's registered country is independent of the exit country
Check the country information in your account profile
Authentication error
Credentials are not being sent, or the address is not authorised
Review the list of authorised addresses
Tunnel warning in network diagnostics
The IPv6 transition mechanism is being blocked
Check the router and firewall settings
The connection drops after a while
Concurrent connection limit or exhausted quota
Check the limit and remaining quota in the panel
Most of these symptoms point to a single common cause: the set covered by the rule does not overlap with the process producing the traffic. Always start diagnosis here, because changing the protocol or trying another exit does not fix a scope error.
The second most common cause is the exit itself. Do not guess whether an exit is up: with the proxy checker tool verify it from the outside. If an exit that appears live does not open from your network, the difference is almost always a local filter.
Which exit makes sense, and when is the layer unnecessary?
The network needs of racing games differ from those of data collection or social media work: what is wanted here is not diversity but stability. For corporate setups that want a fixed address and predictable bandwidth, ISP proxy and data centre exits are the right choice. Mobile exits, on the other hand, are not suited to this scenario because of the variable latency of the carrier network.
Three questions are enough for the decision. Does the exit address need to stay fixed? Will large files be downloaded through this exit? Does the process you will write the rule into actually read a proxy setting? If you answer "no" to the third, the type debate has no practical consequence left.
The case where a proxy is not needed is equally clear: if you are playing from your own country, with your own account, in an ordinary setup, adding a layer in between only adds latency and diagnostic difficulty. If your aim is to take all the traffic on the device into a single tunnel, a proxy is not the tool you are looking for, because a proxy covers only where you write the rule.
If you want to compare with the behaviour of other racing and sports titles, the game proxy guides section answers the same questions game by game: which traffic can be carried, which process reads which setting and what actually happens on the latency side.
Frequently asked questions about Forza Horizon and proxies
01I set up a proxy but the game won't go online, why?
The most common cause is a scope error: the rule is written for the launcher or the browser and does not cover the game process. The second possibility is that the online session uses continuous streaming and that stream does not enter the HTTP proxy tunnel.
02Can I route the patch download through the proxy?
It depends on the channel. In versions installed through the store client, the transfer is handled by the operating system's background delivery service, and that service does not read a setting written for the application. In that case either a system-wide rule is required, or the download is deliberately left outside the proxy.
03If I change my exit country, will store prices change?
No. The catalogue, currency and price depend on the country registered in the account profile and on the payment instrument, not on the IP address your connection comes from. Separating these two layers sets expectations correctly from the start.
04I see a tunnel warning in Windows network diagnostics, is the proxy the cause?
Usually not. Transition mechanisms that carry IPv6 connectivity over IPv4 networks run over UDP and are affected by router or firewall settings. The HTTP proxy you defined does not carry this traffic in the first place.
05Isn't it more practical to write the rule on the router?
It is the broadest solution in terms of scope, but the hardest in terms of diagnosis: every device on the home network is affected, and when a problem arises it becomes harder to separate whether the source is the device or the gateway. Starting with the narrowest scope is a more sustainable path.
06How do I definitively verify that my setup works?
Run three checks separately: see that your exit address has changed in the context where the rule applies, test where name resolution is performed, and check whether IPv6 is bypassing the rule. A single page loading is not sufficient proof.
07Will my in-game latency improve with a proxy?
Do not expect it. A proxy adds a hop to the path and lengthens the total time in most setups. The stream in online free roam does not enter the proxy's scope at all in most setups; therefore what determines the smoothness there is the quality of your direct connection.