Dify Proxy Setup with a Dedicated German Mobile Proxy

Direct Answer

To route Dify through a mobile proxy, point its outbound SSRF proxy at your endpoint. In a self-hosted Docker deployment, set SSRF_PROXY_HTTP_URL and SSRF_PROXY_HTTPS_URL in your .env to your German mobile proxy. Dify sends every outbound web request — the HTTP node and the built-in web tools — through that proxy, so your German mobile IP is what fetches the pages. The call to your LLM keeps its own connection unless you route it through the proxy on purpose.

The One Thing Most Dify Proxy Guides Get Wrong

Dify is a self-hostable platform for building LLM apps and agents: you assemble workflows from nodes and tools and wire them to a model. The common mistake is thinking of "the proxy" as something the whole app or the model sits behind. It isn't.

The proxy binds to Dify's outbound web requests, not the model call. When your workflow's HTTP node or a built-in web tool reads a German page, that request is what should leave through your German mobile IP. The reasoning steps — the calls to your LLM provider — are a separate connection and usually don't need a German exit at all. Get this distinction right and the setup is a two-line change in your .env; get it wrong and you route model traffic through a mobile connection for no reason while your fetch still exits from your own address.

Dify already routes its outbound fetches through an internal SSRF proxy — a request-filtering hop that keeps workflows from reaching internal addresses. You point that hop at your German mobile proxy, and every web fetch inherits the mobile IP.

Before You Start

You'll need four values from your GermanProxy.io account:

Host and port of your endpoint
Username and password

The examples use PROXY_HOST, PORT, USER and PASS as placeholders — replace them with your own. There's no hardware to manage: the proxy is a dedicated mobile connection exposed as a host/port/credentials endpoint.

This guide assumes the self-hosted Dify (the Docker Compose deployment), because the proxy variables live in its .env. On managed Dify Cloud you can't set them.

Step 1 — Point Dify's SSRF Proxy at Your Endpoint

Self-hosted Dify routes every outbound web request through an internal SSRF proxy, configured by two variables. In the .env next to your docker-compose.yaml, replace their defaults with your German mobile endpoint:

# .env — Dify self-hosted
SSRF_PROXY_HTTP_URL=http://USER:PASS@PROXY_HOST:PORT
SSRF_PROXY_HTTPS_URL=http://USER:PASS@PROXY_HOST:PORT

By default these point at Dify's bundled ssrf_proxy container (http://ssrf_proxy:3128). Pointing them at your mobile endpoint sends the HTTP node and built-in web tools out through your German mobile IP instead.

Step 2 — Restart and Confirm the Services Picked It Up

The api and worker services read these variables at start-up, so recreate the stack after editing the .env:

docker compose down
docker compose up -d

Now any workflow that fetches a URL — an HTTP Request node or a built-in web tool — exits through your German mobile IP. No per-node configuration is needed for the common case.

Step 3 — Route a Single Node Explicitly (optional)

If you'd rather keep the platform default and give one workflow a German exit, use an HTTP Request node and set the proxy on that node's request instead of globally. The node's outbound call then carries the mobile IP while the rest of your workflows keep their normal connection.

This is the right choice when one app mixes a German-exit fetch with calls to your own internal API — only the node you configure carries the mobile IP.

Verify the IP First

Before a real run, confirm the exit IP is a German mobile address. The quickest check is a one-line request through the same proxy from the host running Dify:

curl -x "http://USER:PASS@PROXY_HOST:PORT" https://api.ipify.org?format=json

If it returns your own address, the variables didn't reach the api/worker services — re-check the .env values and that you recreated the containers. Confirm the ASN and geolocation look like a German mobile network, not a datacenter range. A full checklist is in test your mobile proxy setup.

Sticky Sessions vs. Rotation

How a workflow should handle IPs depends on the task:

Sticky session — keep the same German mobile IP across a multi-step flow (open a page, follow links, extract) so a sequence of fetches looks like one coherent visitor.
Rotation on demand — request a fresh IP at the proxy between runs to spread load across a longer job.

Keep request rates human-reasonable and don't fan out dozens of parallel fetches. The mechanics are in sticky sessions and IP rotation.

Why a Mobile IP at All

German content is localised. German marketplaces and Google.de serve different results, pricing and stock by country and network. Have a workflow fetch a German site from a US datacenter range and it measures the wrong market. A German IP gives it the in-country view the task needs.

Mobile IPs carry high IP reputation. German sites filter datacenter ranges aggressively — often a 403 Forbidden within a handful of requests. Mobile IPs sit in shared CGNAT pools used by thousands of real subscribers, so they carry high IP reputation — the reason a mobile IP keeps working where a datacenter range stalls.

For the trade-offs between IP types, see mobile vs residential vs datacenter proxy and, on cost, dedicated mobile vs pay-per-GB residential. For the wider agent picture, see mobile proxies for AI agents.

Scrape Responsibly

A mobile proxy improves reliability for legitimate data collection — it is not a tool to circumvent access controls or platform rules. A Dify workflow can run unattended, so the responsibility to keep it clean is higher, not lower:

Respect robots.txt and each site's terms — check them before you point a workflow at a domain.
Throttle — add a delay between fetches and cap concurrency so you don't overload target servers.
Collect only public data you need, and handle any personal data in line with the GDPR.
Identify your client honestly — set a truthful User-Agent; don't impersonate someone else.

Whether a specific task is lawful depends on your jurisdiction and the target's terms — this is general information, not legal advice. See are mobile proxies legal and is web scraping legal in the EU.

[!NOTE]
Note: This article is general information, not legal advice. Whether a specific data-collection task is lawful depends on your jurisdiction, the target site's terms and the data involved.

FAQ

Does the proxy change how Dify talks to the LLM?

No. The SSRF proxy binds to Dify's outbound web requests — the HTTP node and the built-in web tools. The connection to your model provider stays separate unless you deliberately route it through the proxy too. In practice you set SSRF_PROXY_HTTP_URL / SSRF_PROXY_HTTPS_URL so the fetches exit through the German mobile IP, and leave the model traffic alone.

Which Dify variables set the proxy?

In a self-hosted Docker deployment, SSRF_PROXY_HTTP_URL and SSRF_PROXY_HTTPS_URL in your .env control where outbound web requests go. They default to Dify's bundled SSRF proxy container; point them at your German mobile endpoint and the api and worker services route fetches through it after a restart.

Why do I get a 407 error?

407 Proxy Authentication Required means the username and password didn't reach the proxy. Confirm they're in the proxy URL you set (http://USER:PASS@PROXY_HOST:PORT). See how to fix 407 proxy authentication required.

Do I need a rotating pool for Dify?

No. Pool services exist to pick an IP from many. With one dedicated German endpoint you point Dify at a single host and rotate on demand at the proxy — nothing to manage in the app. See dedicated vs shared mobile proxy.

HTTP or SOCKS5?

Dify's SSRF proxy expects an HTTP proxy URL, which is why the examples use http://. SOCKS5 and OpenVPN are available too; reach for SOCKS5 only when a specific client outside Dify needs it — for the SSRF variables, HTTP is the format to use.

Does this work on Dify Cloud?

The SSRF proxy variables are a self-hosting feature — they live in the Docker deployment's .env. On managed Dify Cloud you can't set them, so a bring-your-own mobile proxy needs the self-hosted deployment. If you're building agents in another framework, see mobile proxy with CrewAI and mobile proxy with LangGraph.

Related guides

Get Started

Give your Dify workflows a real German mobile IP to collect from. Get your German mobile endpoint — HTTP/SOCKS5/OpenVPN, sticky sessions, on-demand rotation, fair-use 20 GB/day, from a transparent EU provider. Browse the plans to get started.

Get a German mobile proxy: Real 4G/5G IPs from Germany, fair-use 20 GB/day — see German 4G/5G mobile proxy options or try a shared 5G German proxy.