Sign in
Stable

Browser extension user guide

Private-app-only mode, workspace switching, downloads, sign out and common states.

Steps

Follow these in order.

  1. 01Install (Chrome, Firefox, Opera, Edge)Get the build for your browser from Downloads and add it; verify the signature.
  2. 02Sign in and pick a workspaceSign in to BusinessProxy and select the workspace you operate in.
  3. 03Choose a routing modePrivate apps only (default), work scope, or proxy-all. Personal traffic stays direct.
  4. 04Open a private app by its internal namePublished browser hosts can be internal names that do not exist in public DNS; they work only while the extension has an active BusinessProxy route.
  5. 05Route work domains through exit countriesAdd a work domain first, then add an egress rule that selects the exit location for that domain.
  6. 06Connect, disconnect and session statesWhat each status means and how recovery works after a stalled connect/disconnect.
  7. 07Permissions and what is routedWhy each permission exists; the gateway never inspects HTTPS page content on the browser path.

Reference

Implementation details for setup and review.

Routing mode decides what enters BusinessProxyWork domains and exit countries are configured in related but separate blocks. The routing mode defines the normal Chrome route. Regional routing rules are evaluated before the general work-domain fallback and can override the route for a matching domain, host or domain zone.
  • Private apps only: only published private-app browser hosts use BusinessProxy.
  • Work sites and private apps: policy work domains and published private apps use BusinessProxy; other Chrome traffic stays outside the managed path.
  • Proxy all Chrome traffic: browser traffic uses BusinessProxy except local, service, update and explicit bypass entries.
  • A regional rule can send a matching destination through a selected exit location, bypass that location or block the destination.
Private app browser hosts and DNSA private app can have two visible names. The public app address is the BusinessProxy gateway name or a verified customer alias; it must resolve in public DNS because the browser reaches the gateway directly. A published browser host is different: it is an extra hostname that the extension treats as belonging to that private app. It may be an internal name such as admin.acme.internal or shop.local, as long as it is configured on the app and appears in the workspace routing snapshot.
  • When the extension is connected, a matching published browser host is routed through the extension proxy or opened through the managed app address before the browser reaches a normal DNS failure.
  • When the extension is disconnected, BusinessProxy does not control the user device DNS. If that hostname is not resolvable on the user network, it will not open. If the customer network already resolves it locally, the browser may reach whatever that local DNS points to.
  • This is not a wildcard proxy for arbitrary unknown domains. The hostname must be listed as a published browser host for an app the user can access.
  • The connector still needs to reach the configured internal upstream from inside the customer network. The external user does not need public DNS for the browser host; the connector needs DNS or routing for the upstream it actually opens.
How to choose an exit country for a work domainFor a domain that should be treated as a work resource and exit through a specific country, keep both parts explicit: add it to Work domains for work-scope policy clarity, then add a regional routing rule that selects the exit location.
  • Open the policy routing block and select Work sites and private apps, or Proxy all Chrome traffic.
  • Add the destination to Work domains, for example crm.example.com or *.support.example.com.
  • Open the regional routing block, add a rule for the same domain, choose Route through egress and select the exit location, for example US or RU.
  • If the Work-domain egress shortcut is shown, select the exit location there and create the rule without retyping the domain.
  • Save the policy. New browser sessions use the saved routing snapshot.
ExampleA workspace can keep only approved work sites on the managed path and route different domains through different exit locations.
Routing mode: Work sites and private apps

Work domains:
- crm.example.com
- *.support.example.com

Regional routing rules:
- crm.example.com and subdomains -> US exit location
- support.example.com and subdomains -> RU exit location
Fallbacks and plan limitsRegional rules are stronger than the general routing-mode fallback. Use them only for approved work resources because a matching Route through egress rule sends that destination through the selected BusinessProxy exit location.
  • If no regional rule matches in work-scope mode, only Work domains and published private-app browser hosts use BusinessProxy.
  • If a domain uses BusinessProxy without a matching regional rule, it uses the workspace or policy default exit country according to the current settings.
  • Changing the default exit country, available exit locations or regional routing can be limited by the plan and by platform-admin settings.