In Firefox, you can install a VPN extension or set a proxy in the browser's own network settings. As of Firefox 149, there is also a built-in VPN feature being rolled out gradually to users. All of these methods route the browser's requests through an intermediary server. Protecting the connections of other applications requires a separate approach: the browser button does not manage their traffic.
A virtual private network (VPN) usually implies an encrypted tunnel. In browser products, what operates under that name is often a proxy, and the encryption depends on how you connect to it. If you also need to cover your email client or a messenger, first read about the difference between a browser VPN and a system application.
Which method to choose in Firefox
If the built-in feature is available and its limit is sufficient, start with it: you will not need to install a separate add-on. An extension is useful when you need a specific service and its settings. Choose a manual proxy if you already have an address, a port and a server type.
| Parameter | Extension | Built-in Firefox VPN |
|---|---|---|
| Connection | You install an add-on | You switch on the available browser feature |
| Account | Depends on the service | Sign-in to an account is required |
| Traffic allowance | Determined by the service | 50 GB per month |
| Site exceptions | Depends on the implementation | Can be switched on and off for individual sites |
| Corporate restrictions | You must account for device policies | Unavailable to users with corporate policies |
In the Firefox 149 release notes dated 24 March 2026, the built-in VPN is described as a secure proxy for use within Firefox. The United Kingdom is part of the initial group along with the USA, Germany and France. That is the list as of the release date, and gradual rollout does not mean every user has access immediately.
Which method to choose in Firefox
How to install an extension or set a proxy
For an extension, follow this order:
- Choosing an add-on: look for a version made specifically for Firefox and check the developer. The same service name in different browsers does not guarantee identical behaviour.
- Installation: read the requested permissions and confirm the addition. A proxy extension needs permission to manage connections; access to website content should be assessed separately.
- Connection: sign in to the service if it requires it, and switch the connection on. During initial setup, keep just one proxy extension active.
- Verification: open the site in question and check the visible network address in Firefox. A lit icon on its own does not confirm that all connections are being routed through it.
For a manual connection, open the Firefox settings and find the network or connection parameters. Choose manual proxy configuration, enter the server address and port, specify the appropriate type and save the changes. For SOCKS, also check whether DNS lookups are sent through the proxy. Take the address and port from the server operator: the browser does not provide you with a proxy automatically.
Do not keep a manual proxy and an extension enabled at the same time without a clear reason. For example, you set a work proxy manually, then installed an add-on and disabled proxying of one site in it. The site may still go through the manual server. To test the extension specifically, first remove the earlier manual configuration on a personal device.
What an extension changes under the bonnet
The application programming interface (API) allows an add-on to manage Firefox's web requests. The proxy.onRequest handler decides for each matching request which proxy to use, or returns direct (no proxy from the extension). The interception requires the proxy permission and permissions for the relevant website addresses. Another mechanism, proxy.settings, changes the browser's general proxy settings.
This is where the conflict from the example hides: a direct response does not cancel the proxy you set manually in the Firefox connection settings. This is explicitly stated in the Mozilla documentation.
In Chrome and Edge the interface is also called proxy, but it is structured differently. So don't assume an extension's settings and limitations carry over from one browser to the other. There is a separate guide to Chrome and Edge extensions for them.
Which proxies encrypt the connection
Transport Layer Security (TLS) encrypts a segment of the connection. With an HTTPS proxy, it applies between Firefox and the intermediary server. This is a separate segment from the secure connection to the website itself over HTTPS: a website having HTTPS does not turn an ordinary HTTP proxy into an encrypted channel to the intermediary.
The Domain Name System (DNS) translates a website's name into a network address. Where that translation takes place depends on the proxy type and the extension's settings.
| Type in Firefox | Encryption to the proxy | Handling of the website name |
|---|---|---|
http | The type itself does not provide it | The name is passed to the HTTP proxy |
https | TLS to the proxy | The name is passed to the HTTPS proxy |
socks (SOCKS5) | The protocol itself does not provide it | Passing name resolution through the proxy requires proxyDNS=true |
socks4 | The protocol itself does not provide it | Passing supported DNS queries depends on proxyDNS |
masque | A secured tunnel over the QUIC transport protocol | The proxyDNS parameter does not apply to this type |
The masque type was added in Firefox 145. Support in the browser does not mean your extension uses it: the connection method is chosen by the developer.
There is a subtlety with SOCKS. In the general proxy.settings configuration, from Firefox 128 onwards the proxyDNS value is switched on by default for SOCKS5 and off for SOCKS4. But in the ProxyInfo object, which an extension uses to describe the proxy for a request, the default value is false. If the developer has not enabled the option, DNS queries may bypass the proxy. These values are given in the Mozilla documentation mentioned above.
Frequently asked questions about Firefox
Why does the extension ask for access to private windows?
Changing the general proxy settings requires this access: the settings affect both ordinary and private windows. Without the permission, a call to proxy.settings.set() will throw an exception. The decision is yours; enable access in the settings of the chosen add-on, understanding that it will then be able to operate in private windows too.
Why is there no built-in VPN in my Firefox?
Version 149 or later does not in itself guarantee the feature is available. Check that you are signed in to your account and bear in mind the gradual rollout; on a device with corporate policies, the feature is unavailable. For a user in the United Kingdom, the country's inclusion in the initial list does not confirm activation in a particular browser.
Do proxy extensions work on Android?
That depends on which mechanism the add-on uses. In Firefox for Android, the proxy.settings object exists, but reading or modifying it throws an exception. Therefore the compatibility of a particular extension with Android must be checked separately.
What to check before use
For work within Firefox, choose the available built-in VPN with its 50 GB monthly limit, the extension for your chosen service, or a manual proxy with known parameters. For an extension, check the permissions; for SOCKS, check DNS handling; and if traffic takes an unexpected route, look for a leftover manual proxy. Then check the Internet Protocol (IP) address visible to the website. The result applies to the tested Firefox connection and does not confirm protection for the other programs on the device — check their connections separately, including when using CitadelVPN through a compatible client.