Installing Playwright inside a corporate network can require additional configuration when outbound traffic passes through a proxy, firewall, or custom certificate authority. The browser binaries still need to be downloaded, so the machine running the installation must be able to reach the required download endpoints through your network configuration.
For direct Playwright installations, configure the required proxy or certificate settings before running:
npx playwright install
Leapwork Play takes a different approach when the application you need to test is inside a private corporate network. With Leapwork Connect, Play's cloud browser can reach approved applications inside your network without opening inbound firewall ports. The connector runs inside your network and establishes the connection outbound to Leapwork.
How do you install Playwright behind a corporate proxy?
If your network requires an HTTP or HTTPS proxy for outbound traffic, configure the proxy before installing the Playwright browsers.
For example:
HTTPS_PROXY=https://proxy.example.com:8080 npx playwright install
In environments that use an internal certificate authority, the machine may also need to trust the appropriate CA certificate before the browser download can complete.
The important distinction is:
-
Installing Playwright: your machine needs outbound access to download Playwright browsers.
-
Testing a private application: the browser executing the test needs network access to that application.
These are separate networking requirements.
How does Play reach applications behind a corporate firewall?
With Leapwork Connect, you install a connector on a machine inside the private network.
The connector establishes an outbound HTTPS connection to Leapwork, so you do not need to open inbound ports or make inbound firewall changes.
The workflow is:
Play cloud browser → Leapwork Connect → Approved private target → Internal application
The connector cannot reach arbitrary internal resources by default. You explicitly configure which hosts and ports it may access, and that allowlist is managed on the connector machine rather than from Play.
Allow only the targets Play needs
Leapwork Connect uses an allowlist to control which internal resources can be reached.
During installation, you can specify a port:
443
a hostname and port:
app.internal:8080
or an IP address and port:
192.0.0.1:443
You can also provide multiple entries:
443, app.internal:8080
A port allows access to that port across hosts in the network, while host:port or address:port limits access to that specific target.
The allowlist is empty by default. If no targets are added, the connector blocks all traffic until an allowed target is configured.
Route a Play environment through the connector
Installing Leapwork Connect does not automatically send Play traffic through it.
In Play:
-
Go to Team Settings → Environments.
-
Edit the environment containing your private application.
-
Enable Private.
Tests that use that environment then access its URL through Leapwork Connect, subject to the connector's allowlist.
How Play simplifies private-network browser testing
|
Direct Playwright setup |
Leapwork Play |
|---|---|
|
Configure the environment where Playwright and its browsers execute |
Play provides the cloud browser execution environment |
|
Configure proxy/firewall access required by that execution environment |
Use Leapwork Connect when the target application is inside your private network |
|
Manage browser/runtime connectivity yourself |
Connector establishes outbound connectivity to Leapwork |
|
Configure access to internal targets through your network infrastructure |
Explicitly allow the required internal hosts and ports |
|
Maintain the browser execution environment |
Run the Playwright test through Play |
Play keeps Playwright underneath while providing the browser execution environment and a controlled connectivity model for applications inside private networks.
Troubleshoot private-network access
If Play cannot reach the private application, first check the connector allowlist.
On Windows:
cd C:\ProgramData\LeapworkConnect
.\Leapwork.Connect.Connector.exe allowlist show
On Linux:
cd /var/lib/leapwork-connect/bin
sudo ./Leapwork.Connect.Connector allowlist show
On macOS:
cd "/Library/Application Support/LeapworkConnect/bin"
sudo ./Leapwork.Connect.Connector allowlist show
An empty allowlist, or one that does not contain the required host and port, blocks the request.
The connector also maintains logs that can show whether a target was reached, blocked by the allowlist, failed DNS resolution, timed out, or refused the connection.
Best practices
-
Use Leapwork Connect when Play needs to reach applications available only inside your private network.
-
Allow only the hosts and ports required by your tests.
-
Keep the connector enrollment command and token private.
-
Keep direct Playwright proxy configuration separate from private-application connectivity.
-
Check the allowlist first when Play cannot reach a private URL.
-
Use a dedicated connector machine that can remain available with outbound HTTPS access to Leapwork.
-
Avoid broad allowlist rules when a specific
host:portrule is sufficient.
Frequently asked questions
How do I install Playwright behind a corporate proxy?
Configure the required outbound proxy and certificate settings on the machine performing the Playwright browser installation, then run npx playwright install.
Does Leapwork Connect install Playwright behind my proxy?
No. Leapwork Connect solves a different problem: it lets browser sessions in Play reach approved applications inside your private network.
Does Leapwork Connect require inbound firewall ports?
No. The connector initiates the connection outbound to Leapwork, so the documented setup does not require inbound ports or inbound firewall changes.
Can Leapwork Connect access everything on my private network?
No. The connector is disabled for target access by default until allowed targets are configured. The allowlist is controlled locally on the connector machine.
How do I make a Play environment use Leapwork Connect?
Go to Team Settings → Environments, edit the environment, and enable Private. Tests using that environment then route its URL through the connector, subject to the allowlist.
What should I check if Play cannot reach my private application?
Start with the connector's allowlist show command. Confirm that the application's host and port are allowed. If they are, use the connector logs to investigate DNS, timeout, connection-refused, or tunnel issues.