Multi-user proxy management

Create individual proxy accounts, organize their tags and apply routing conditions to authenticated network-sharing traffic.

Enable and create accounts

1. Configure Network Sharing → Proxy Mode on the Mac, including the interface, port and authentication.
2. Enable multi-user access in Enterprise Settings or the Web console’s Proxy users page. This switch is synchronized. Multi-user access requires username/password authentication.
3. Under Proxy users, add an account with its proxy username, password, display name, enabled state, tags and optional expiry. The username is case-sensitive and must differ from the saved basic sharing account; use a unique password of at least 12 characters.
4. Save, then configure one client with the actual Mac address, sharing port, supported proxy protocol and that account’s credentials. Verify its connection before distributing settings.

The saved basic sharing account can also authenticate. Turning multi-user access off does not stop sharing: access follows the basic-account/anonymous setting, and saved user/group routing conditions are treated as ANY. Disabling an individual proxy user stops that user’s active proxy connections and prevents new authentication.

Configure identity-based routing

In Routing rules, select LAN devices as appropriate and combine source IP, user/group, destination and action conditions. Groups here are proxy-user tags, not SSH connection-start groups. Individual users and groups can be mixed; any selected identity can satisfy the identity condition, but the other conditions must also match. Rules run from top to bottom; unmatched requests use Default.

Access policies summarizes these conditions and links to account/rule editors; it is not an independent allowlist. Mac traffic has no proxy-user identity. With multi-user access enabled, unidentified gateway/LAN traffic skips identity-specific rules. Do not rely on proxy authentication to protect Gateway Mode.

Review activity and limits

Use proxy usage and connection views to review authenticated users, source IPs, destinations, rules, outcomes and payload bytes. Upload/download are from the client’s perspective. Overlapping tags each include their members’ full usage, so do not add tag totals together. Collection has retention limits and does not reconstruct earlier activity.

Per-user/group bandwidth, concurrency and traffic quotas are not available; statistics do not enforce limits. See network sharing and risk guidance.