How to Configure Windows Sandbox Custom Local Proxy and PAC Scripts via XML in Windows 11

When testing untrusted web applications or inspecting network telemetry, security analysts often require all outbound traffic from an isolated virtual sandbox to flow through an intercepting proxy (such as Burp Suite, OWASP ZAP, or Squid) or evaluate corporate Proxy Auto-Configuration (PAC) scripts. By default, Windows Sandbox connects directly to the Internet through the host virtual switch. By authoring a custom Windows Sandbox (.wsb) configuration file paired with an automated PowerShell logon script, you can enforce static proxy servers or dynamic PAC routing upon startup.

The Architecture of Windows Sandbox Network Redirection

Windows Sandbox shares the host machine’s physical network adapters through an internal Hyper-V Virtual Switch running NAT. The guest environment cannot modify host network routing directly, but its internal WinINet and WinHTTP proxy subsystems can be configured via guest registry policies and netsh winhttp commands executed automatically via the <LogonCommand> directive.

Structuring Host Folders and Assets

Create a directory on your Windows 11 host (for example, C:\SandboxProxy) containing the following structure:

C:\SandboxProxy\
├── proxy.pac
├── Setup-Proxy.ps1
└── Proxy_Sandbox.wsb

Authoring the Proxy Configuration Script

Save the following PowerShell script as C:\SandboxProxy\Setup-Proxy.ps1. This script configures user and system WinINet settings and sets the global WinHTTP proxy:

# Setup-Proxy.ps1 - Automated Windows Sandbox Proxy Configuration
param (
    [string]$PacUrl = "file://C:/SandboxAssets/proxy.pac",
    [string]$StaticProxy = "10.0.0.1:8080"
)

$InternetSettings = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"

# 1. Option A: Configure Dynamic PAC File
Set-ItemProperty -Path $InternetSettings -Name "AutoConfigURL" -Value $PacUrl
Set-ItemProperty -Path $InternetSettings -Name "ProxyEnable" -Value 0

# 2. Option B: Static Proxy Alternative (if PAC not used)
# Set-ItemProperty -Path $InternetSettings -Name "ProxyServer" -Value $StaticProxy
# Set-ItemProperty -Path $InternetSettings -Name "ProxyEnable" -Value 1

# 3. Synchronise WinHTTP System Proxy for Services
netsh winhttp set proxy proxy-server="$StaticProxy" bypass-list="localhost;127.0.0.1;<local>" | Out-Null

Write-Host "Sandbox proxy routing configured successfully." -ForegroundColor Green
Write-Host "PAC URL: $PacUrl" -ForegroundColor Cyan

Creating the WSB XML Configuration

Create Proxy_Sandbox.wsb to map the host folder into the sandbox and execute the setup script on launch:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxProxy</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Setup-Proxy.ps1 -PacUrl file://C:/SandboxAssets/proxy.pac</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Sandbox Outbound Traffic

1. Double-click Proxy_Sandbox.wsb on your Windows 11 workstation.
2. Windows Sandbox spins up, mounts C:\SandboxProxy as C:\SandboxAssets, and triggers PowerShell.
3. The script registers the proxy settings across WinINet and WinHTTP.
4. Launch Microsoft Edge inside the sandbox and navigate to an external site.
5. Observe traffic routing through your designated upstream proxy or intercepting tool without impacting host traffic.
6. Closing the sandbox purges all proxy configurations and temporary certificates completely.