Q100744: How to send Foundry crash reports in an air-gapped network by adding them to your proxy’s allowlist

Tomas Miguel

Updated: July 24, 2026 14:03

Created: July 23, 2026 15:58

SUMMARY

Many artist machines in studios are air gapped, which restricts access to the internet to increase security. However, this can also block artists from sending crash reports to Foundry through our Crash Report Manager available in Nuke, Mari, and Katana, which relies on a network connection.

This article outlines the general steps to set up a proxy server that allows Foundry crash reports out of an air-gapped network while maintaining system security. This is intended for Systems and Network Administrators, as it involves configuring network gateways, explicit proxies, and egress filters.

For System Administrators with a gateway already setup, these are the attributes required to allow the Crash Report Manager through:

Destination Domain: sentry.foundry.com
Protocol: HTTPS
Port: 443
Method: POST

All third-party technologies mentioned in this article are reference examples only and are not supported by Foundry. The list of steps and example setups are provided as guidance only and are not intended to be followed directly and used in production. Please coordinate with your IT Administrator to set up a similar network workflow that can be used by your studio.

MORE INFORMATION

The architecture:

In this article, we use the following network topology as an example for safely routing crash reports out of an air-gapped environment:

Proxy Server: A dedicated gateway machine or server on your network that does have external internet access. This machine will run forward proxy software.
Clients: The air-gapped artist machines running Foundry applications. These will be configured to route their web traffic to the gateway machine instead of the open internet.

An allowlist on the gateway machine should ensure that the only traffic allowed to leave the studio network consists of crash reports explicitly headed to Foundry

Set up the forward proxy:

First, configure a forward proxy on your internet-connected gateway machine.

While you can use any enterprise proxy solution, this article will use mitmproxy as an example, which is a free, open-source interactive HTTPS proxy.

Install your proxy software on the gateway machine.
Identify and note the gateway machine's local IPv4 address.
Ensure the proxy is configured to listen on a designated port. In this example, we use 8080

Define the allowlist:

Next, configure an egress filter in your proxy with an allowlist that drops all outbound traffic by default, except for the specific traffic required by the Crash Report Manager. The requirements are:

Destination Domain: sentry.foundry.com
Protocol: HTTPS
Port: 443
Method: POST

If you are using mitmproxy, you can achieve this allowlist by passing a Python add-on script when launching the proxy:

from mitmproxy import http

class AllowSentry:
    allowed_domains = ["sentry.foundry.com"]

    def request(self, flow: http.HTTPFlow) -> None:
        if flow.request.host not in self.allowed_domains:
            flow.response = http.Response.make(
                403,
                b"Blocked by Egress Filter: Domain not on allowlist.",
                {"Content-Type": "text/plain"}
            )

addons = [AllowSentry()]

You can then launch the proxy using this script via your command line with a command like:

mitmproxy -p 8080 -s /path/to/allow_foundry.py

Route artist machines to the proxy:

With the gateway machine ready and filtering traffic, now point your air-gapped artist machines to it.

Install the proxy's certificate. Because Foundry applications use HTTPS to send reports, you must install your proxy's SSL certificate onto the artist machines so the connection is trusted. For mitmproxy, this is typically done by navigating to mitm.it on the client machine while routed through the proxy.
Set the network proxy by pointing the artist machine's OS network proxy settings to the IP address and port of your gateway machine.
If your artist machines run on Linux, OS-level proxy settings may not be enough. You should append the proxy routing to your shell profile to ensure the Foundry applications pick it up. Add the following lines, replacing <GATEWAY_IP> with your gateway machine's IP address, and refresh your environment after applying these changes.

export HTTPS_PROXY=http://<GATEWAY_IP>:8080
export HTTP_PROXY=http://<GATEWAY_IP>:8080
export https_proxy=$HTTPS_PROXY
export http_proxy=$HTTP_PROXY

Guidance on setting environment variables can be found here:
Q100015: How to set environment variables

Verify the Setup:

Next time a crash occurs, you can verify the upload:

When the Crash Report dialog appears (either immediately or upon reopening the app), click Send Report.
Observe your proxy's UI or logs. You should see a successful POST request to sentry.foundry.com
The dialog on the artist machine will say "Uploaded Foundry crash report ID".

SUMMARY

MORE INFORMATION

FURTHER READING