StarCraft II Proxy: Which Traffic Goes Through the Tunnel and Which Does Not?
StarCraft II may look like a single connection, but behind it there are three independent jobs: the desktop application's authentication and patch traffic, the account services' requests and the command stream during a match. This page explains which of these three your proxy rule actually reaches.
Scope distinctionThe difference between launcher, account service and match traffic in the face of a proxy rule.
02
The practical consequence of this distinction is that a rule written system-wide does not affect all three processes in the same way. The store client downloads with its own network stack and takes the system setting into account to varying degrees; the game itself mostly uses UDP during a match and never enters a classic tunnel at all.Diagnosing a connection that drops on a campus or office firewall.
03
Compliance limitsWhere a proxy stands in relation to client integrity checks and the terms of service.
04
The real costLatency, transferred data and quota consumption on patch days.
An RTS client has two different characters on the network side. While you wait in the menu it produces small, infrequent HTTPS requests; when a match starts it carries out an exchange that repeats several times per second — very small, but extremely sensitive to latency. A proxy decision cannot be made without separating these two characters.
The sections below answer three concrete questions. Why might the desktop application and the game itself not share the same network setting? On a corporate network, why is a connection that never establishes usually about a closed port rather than your credentials? And how do you verify which requests a proxy exit actually touches in this game?
A boundary has to be drawn from the outset: a proxy is a routing setting that determines which door your traffic leaves through. The address the other side sees changes; your game account, the session token stored on your device and your client's version information stay the same.
What does the client do on the network, and in what order?
When the desktop application opens, the first job is authentication. The client connects to the account service over TLS, identifies itself with a stored token, and the other side sees the address of whichever line you are currently leaving through. If a proxy is defined, the visible address is the proxy server's address; the token, being stored on the device, does not change.
The second job is version checking and, if needed, downloading. Game updates, language packs and community maps on the Arcade side are pulled from separate endpoints, and this is where volume accumulates. Most of your monthly data consumption comes not from the hours you play, but from the day a large patch lands.
The third job is talking to the account services: ladder standings, profile, friends list, chat and matchmaking requests. These are small HTTPS requests that behave like a web page, and this is also the traffic a proxy rule covers most comfortably.
The character changes when a match starts
The common approach in real-time strategy games is to synchronise only player commands rather than sending the entire world state. This keeps bandwidth requirements small, but it makes it essential that every command turn arrives on time. When a packet is delayed, what is lost is not image quality but the game's smoothness.
Note
A proxy cannot read HTTPS content; it opens a tunnel with CONNECT opens an encrypted tunnel and carries the bytes. In exchange, which host you connected to on behalf of can be seen on the proxy side. How the tunnel is established is explained step by step in the the HTTP CONNECT method article.
DIAGRAMResponsibility lanes for the steps in a StarCraft II session
You can scroll the diagram horizontally to inspect it
Which lane a step falls into determines whether the rule you wrote covers that step.
The desktop application and the game may not share the same setting
In the Blizzard ecosystem, the desktop application that launches the game is a separate process and handles its own network work. When the game is launched, a second process comes into play. Do not assume that both processes read a proxy setting defined at the operating system level in the same way; some applications use the system setting, while others go out directly with their own network stack.
The practical result is this: after you define a proxy, the desktop application may log in without trouble and store pages may open, while in-game match traffic continues to leave through your ordinary line. This is not a fault, it is the natural limit of scope. Tools that do per-application routing make this distinction visible: you select which process leaves through the tunnel by process name.
There is a separate decision on the patch download side. If you are using a metered exit, downloading a large update through the tunnel is a pointless cost; in most setups it is smarter to bring the proxy into play after the download has finished. How to plan quota is bandwidth calculation .
Remember that the desktop application runs in the background and downloads updates.
Note from the outset whether you wrote the rule for the system or for a single process.
Download large patches over your ordinary line and enable the proxy afterwards.
If automatic updates are on, quota consumption continues even when you are not playing.
What can the protocol carry, and what can it not?
An HTTP proxy sits at the application layer and passes encrypted traffic only through the TCP tunnel it establishes with the CONNECT method. Because the tunnel carries TCP, a game session running over UDP never takes that path; the client either goes out directly or cannot connect at all. This is not a restriction specific to StarCraft II, it is the definition of the protocol.
SOCKS5 works at the transport layer and can carry UDP through a method called UDP ASSOCIATE However, two conditions are required at once here: the proxy server must explicitly support this method and the game client must know how to send UDP over SOCKS5. The vast majority of desktop game clients do not meet the second condition. How the method works is SOCKS5 UDP support article.
When you put these two facts side by side the picture becomes clear: what a proxy exit actually covers in this game is login, the store, patch downloads and account services. Rather than aiming to cover match traffic, verifying that the covered part works correctly is a more productive goal. Which protocol suits which job is compared in the protocol selection guide compares.
DIAGRAMTraffic coverage matrix by protocol
You can scroll the diagram horizontally to inspect it
The values describe technical capability, not measurement: they show whether a protocol can carry that traffic.
Choose an exit for your StarCraft II setup
If patch and store traffic dominate, a datacenter exit is more suitable; if you need a fixed address, an ISP solution is.
Choose whichever you need from our residential proxies, datacenter proxies, IPv6 and ISP solutions. Every plan comes with unlimited options, 99.9% uptime, rotating proxies, sticky sessions and 24/7 support. Ideal for web scraping, ad verification, SEO monitoring and digital data collection.
ISP ProxyStatic Turkish IPs registered to an ISP
ISP-registered static Türkiye IPs; they combine datacenter speed with the reputation of a real carrier. Ideal for long sessions and low-ping use.
Diagnosing a dropped connection on campus and office networks
Most university and corporate networks restrict outbound access to the two ports used for the web. TCP sessions to any other destination port are silently dropped at the firewall. If your provider gave you an exit listening on an unusual port, the very same credentials that work flawlessly on your home line will never open on the corporate network.
The misleading part of the symptom is that the error comes from a timeout rather than from authentication. The fastest way to tell them apart is comparison: if the same address and port work from another line, your credentials are correct and the difference is the filter. Confirm that the exit is up from outside with the proxy checker tool confirm it and compare the result with your attempt on the corporate network.
What you observe
Where to look
No response at all, it waits a long time and then drops
The destination port may be closed outbound; try the same exit from a different line
Websites open but the proxy does not work
Only the web ports are permitted; ask your provider for an endpoint on a permitted port
A certificate warning appears in the browser
There is TLS inspection at the gateway; ask the administrator before clicking past the warning
Name resolution fails
DNS is permitted only to the corporate server; try a setup that leaves resolution to the proxy side
It connects, then drops after a few minutes
A captive portal or a session time limit is in effect
What port numbers tell you is explained in the port numbers article. The correct order is this: first check whether your provider has an alternative endpoint on a commonly permitted port, then use the administrative route.
Warning
The corporate or campus network is not yours; the usage policy defines what is permitted, not what is technically possible. The right step is to request permission from the network administrator. The administrative side of the subject is access blocks on school and workplace networks article.
Choosing an exit type and what it costs
Because the covered traffic is largely web-like, the exit type decision here is simpler than people assume. Datacenter exits give the highest bandwidth and the most stable line; if you need to download a large patch through the tunnel, this is what you are looking for. ISP proxy is an intermediate solution that is hosted on a provider network but has server-grade stability, and it is preferred in setups that require a static address.
Residential exits are real subscriber lines; speed is not under your control, and because billing is based on transferred data, cost grows quickly on large downloads. Attaching this type to a game client's update traffic is, in most cases, the most inefficient way to spend money.
After the type, the second decision is how many people the exit is shared with. In a shared pool you do not know how many sessions are open at once, and download speed varies noticeably over the course of the day. On a dedicated exit you carry only the trace of your own usage. The third decision is location: keeping the exit close to both you and the target avoids an unnecessary intercontinental trip. The options are listed on the proxy locations page.
DIAGRAMSuitability weighting of exit types by job type
You can scroll the diagram horizontally to inspect it
The cells are relative weights between 0 and 100; they are not measured speed, latency or success rates.
Client integrity, account rules and compliance
Competitive online games run an integrity check on the client side. The purpose of this check is to determine whether the game's memory or files have been tampered with, and it has no direct relationship with the network layer. A proxy neither hides nor affects this check; changing which door your traffic leaves through does not change the client's own verification.
The conclusion is clear: thinking of a proxy as a way to bypass an integrity layer is both technically wrong and risky in terms of account rules. This page was not written for such a use. Complying with the terms of service your account is bound by is your responsibility, regardless of the network tool used.
The legitimate and commonly seen uses of a proxy, on the other hand, are clear: leaving a corporate network with a fixed, known address, observing how a service looks from a different country, examining the regional presentation of store pages, or determining whether a network problem originates on your own line or beyond it. These are all observation and administration tasks.
The boundary
Account multiplication, account sharing, behaving outside what the matchmaking system expects, or neutralising client checks are not the subject of this page. Changing a network setting does not change the rules of the game.
The latency budget: where is the extra hop recorded?
A proxy adds an extra hop to your connection: the packet first calls at the server at the end of the tunnel, continues from there to the target, and passes back through the same server on the return path. That is why adding a proxy generally increases total latency; do not expect it to improve your ping. The rare exception is when your default route is unusually convoluted and the proxy connects to a more direct backbone; this is not a rule and cannot be assumed without measurement.
In a game that synchronises commands, the cost of this extra hop is far more visible than with web traffic, because the same round trip repeats many times per second. The good news is that match traffic already stays outside the tunnel in most setups; so the proxy's latency effect is felt on the menu, store and download side.
Do not decide without measuring. Measure the same exit at different times of day ping test measure, and remember that in shared pools the difference at peak hours is hidden by a one-off measurement. What latency is made up of is proxy latency article.
Tip
The most common expectation fallacy about the relationship between games and proxies does a proxy lower game ping is handled with measurement logic in the article; it is worth reading before you buy.
Verifying your setup and commonly seen symptoms
After setup, opening a single page and declaring it "working" is not enough. Verify three things separately: is your exit address in the country you expect, where is domain resolution happening, and which process actually leaves through the tunnel. The first with the my IP address page, the second with DNS leak test can be used.
The format of the connection details is the same regardless of provider: a hostname, a port, and if required a username and password. As an example, the proxy.example.com and 8080 values only show where the fields go; the real details are in your panel. Do not try to guess the protocol behind a port number; the same provider can offer two protocols on a single port or on two separate ports.
Symptom
Possible cause
What to do
The desktop application logs in but the game will not connect
The rule covers only one process
Extend the per-application rule to both processes
407 Proxy Authentication Required
Credentials are not being sent or the IP authorisation has dropped
Verify the username and the authorised address list
The download is progressing very slowly
The shared exit is busy or the quota has been throttled
Check the remaining quota and the concurrent connection limit
The interface opens in an unexpected language
The exit country differs from the account's usual country
Match the exit country to your account's country
The connection drops after a while
The concurrent connection ceiling has been reached
Raise the limit from the panel or reduce the number of open clients
What these symptoms have in common is that most of them are the result of scope or limits, not a proxy fault. Running the test twice, once with the proxy on and once with it off, and putting the results side by side noticeably shortens diagnosis time.
A path quietly skipped: IPv6
If your exit speaks only IPv4 but IPv6 is enabled on your device, a request to a target reachable over IPv6 can bypass the proxy entirely. In most setups, operating systems prefer IPv6 on a dual-stack target. The symptom is insidious: no error appears, the page opens, the download starts and the setup looks like it is working; yet the address the other side sees is your real address.
To diagnose, look at both the IPv4 and the IPv6 results when you query your exit address. The solution is one of two paths: use an exit that supports IPv6, or disable IPv6 on that profile. If you choose the second path, also review whether other services on your network need IPv6, because the setting takes effect device-wide.
Frequently asked questions about StarCraft II and proxies
01Does a proxy improve latency in StarCraft II matches?
No, do not expect that. Because the tunnel lengthens the path, the measured value rises in most setups. On top of that, match traffic usually stays outside the tunnel on desktop clients, so the proxy never touches that flow.
02The desktop application runs but the game will not connect. Why?
The most common reason is scope: if you wrote the rule for a single process, only that process leaves through the tunnel. The second possibility is the protocol; CONNECT the tunnel carries TCP, so if the game session uses UDP it never takes that path.
03Is it a problem to view the store page from a different country?
Only if two conditions are met at once: the proxy server must support the UDP ASSOCIATE method and the game client must know how to send UDP over SOCKS5. Most desktop game clients do not meet the second condition.
04Does it make sense to download patches through the proxy?
Usually not if you are using a metered exit. Large updates are the biggest single item in your monthly consumption. Unless you have an unmetered, high-bandwidth datacenter exit, it is more economical to leave downloads on your ordinary line.
05The connection never establishes on the campus network. Is the problem with my credentials?
Most likely not. If the same address and port work from another line, your credentials are correct and the block is in the firewall. On a corporate network, the right step is to talk to the network administrator about an approved port.
06Does using a proxy pose a risk to my account?
A network setting on its own does not change your account's rules, but compliance with the terms of service is your responsibility in every case. Keeping the exit country consistent with your account's usual country also reduces unnecessary verification steps.
07Can this setup be done with free proxy lists?
It can be used for learning and for field verification, but it is not recommended on a client where you are signed in. These addresses often go down within a few hours; on the StarCraft II side, that translates into a patch download cut off halfway through and a ladder request left hanging in the menu. You also cannot verify whose machine the HTTPS session carrying your account token passes through.