---
title: Configuring a private proxy
description: Add a private proxy to an on-premise or non-AWS cloud network to enable secure access to resources within that network.
component: privilege
page_id: privilege:human-privilege:configuration/gateways/private-proxies
canonical_url: https://docs.pingidentity.com/privilege/human-privilege/configuration/gateways/private-proxies.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: May 4, 2026
page_aliases: ["configuration:network-infrastructure/configuring-private-gateways.adoc"]
section_ids:
  configure-a-private-proxy-using-the-setup-wizard: Configure a private proxy using the setup wizard
  before-you-begin: Before you begin
  steps: Steps
  next-steps: Next steps
  configure-a-private-proxy-using-docker: Configure a private proxy using Docker
  before-you-begin-2: Before you begin
  steps-2: Steps
  next-steps-2: Next steps
---

# Configuring a private proxy

Private proxies act as a secure entry point, allowing PingOne Privilege to manage and audit access to your internal resources.

PingOne Privilege allows you to add a private proxy using a setup wizard or through Docker.

## Configure a private proxy using the setup wizard

### Before you begin

* In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation.

* Before you add a private proxy, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity:

  * **CPU**: 2 cores, sufficient for processing proxy operations efficiently.

  * **RAM**: 4 GB ensures smooth container operation.

  * **Storage**: 20 GB accommodates system files and application data.

  * **Firewall Policy**:

    * **Outbound**: Allow all traffic.

    * **Inbound**: Open ports `8680`, and `8690` for application communication.

* Supported Operating Systems:

  * `RHEL / CentOS (RPM x86_64)`

  * `Debian / Ubuntu AMD64`

  * `Debian / Ubuntu ARM64`

### Steps

To add a private proxy using the setup wizard:

1. In the PingOne Privilege admin console, go to **Directory > Gateways**.

2. Click **Add New**, and then click **Add via Wizard**.

3. Review the requirements for your VM, then click **Next**.

4. Install Docker based on the official [Docker installation guide for your OS](https://docs.docker.com/engine/install/).

5. Verify Docker is running using the following command in your CLI:

   `sudo docker ps`

   If the command runs without errors, Docker is installed and running successfully.

6. Select **Private Proxy** as your deployment mode. Click **Next**

7. In the following **Gateway Config** wizard, ensure **Private Proxy** is selected.

8. Enter a unique **Proxy Cluster Name** to identify the private proxy group.

9. Enter the **FQDN / Host IP** of the server where the proxy will be installed.

10. Click **Next**.

11. **(Optional)**: Click the **Deploy RDP** checkbox if you're deploying a remote desktop.

12. Create the environment file with the following commands:

    1. To create the directory, if not already present:

       `sudo mkdir -p /var/lib/procyon`

    2. To create the file and open it:

       `sudo vi /var/lib/procyon/procyon-guest-agent.env`

    3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it.

    4. In the setup wizard, click **Next**.

13. Select your operating system from the list. Click **Show Instructions** for the detailed steps for installing the package for your operating system.

14. Click **Finish**.

### Next steps

After adding the private proxy, go to the **Gateways** page in the admin console. Your new private proxy should be listed with a `Verified` status.

## Configure a private proxy using Docker

### Before you begin

* In the PingOne admin console, create an OIDC web application. For instructions, refer to [Creating a web application](https://docs.pingidentity.com/pingone/applications/p1_mfa_creating_a_web_application.html) in the PingOne documentation.

* Ensure the following inbound ports are open on the host where you will install the private proxy:

  * `22`

  * `443`

  * `3389`

  * `8680`

  * `8690`

### Steps

To add a private proxy through Docker:

1. In the PingOne Privilege admin console, go to **Directory > Gateways**.

2. Click **Add New**, and then click **Add via Docker**.

3. Select **Private Proxy**.

4. Enter a unique **Cluster ID** to identify this proxy group.

5. Enter the **Host IP** of the server where the proxy will be installed.

6. Click **Get Docker Command**.

7. Click **Copy Docker Command** to copy the command to your clipboard.

8. On your designated host within your on-premise network, run the copied Docker command you just copied.

   The proxy will start and automatically register with the Endpoint Controller.

|   |                                                                                                                                                                                                |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | The Endpoint Controller doesn't have automatic visibility into on-premises network topology. After deploying the proxy, you must manually configure which resources are accessible through it. |

### Next steps

After adding the private proxy, go to the **Gateways** page in the admin console. Your new private proxy should be listed with a `Verified` status.