feat(ai-gateway): Forward proxy support

app/_includes/ai-gateway/forward-proxy.md

@@ -0,0 +1,5 @@
+Set `config.proxy_config` on this plugin to route its outbound requests through an HTTP forward proxy. Use this in network-isolated deployments where {{site.ai_gateway}} cannot open direct connections to LLM providers or auxiliary services.
+
+The `proxy_config` record is identical across all {{site.ai_gateway}} plugins that support forward proxying. Existing capabilities such as load balancing, health checking, streaming, WebSocket, and HTTP/2 continue to work when the proxy is active.
+
+For the full field reference, traffic flow, and limitations, see [Forward proxy support](/ai-gateway/forward-proxy/).

app/_kong_plugins/ai-aws-guardrails/index.md

@@ -93,3 +93,7 @@ The AI AWS Guardrails plugin emits structured log data for every inspected reque
 
 To log the raw content of blocked requests and responses, enable [`config.log_blocked_content`](/plugins/ai-aws-guardrails/reference/#schema--config-log-blocked-content). {% new_in 3.14 %} When enabled, the blocked prompt or response body appears under `ai.proxy.aws-guardrails.input_faulty_prompt` and `ai.proxy.aws-guardrails.output_faulty_response` in each log entry.
 
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-azure-content-safety/index.md

@@ -115,3 +115,7 @@ To log the raw content of blocked requests and responses, enable [`config.log_bl
 
 This plugin works with all of the AI Proxy plugin's `route_type` settings (excluding the `preserve` mode), and is able to
 compose an Azure Content Safety text check by compiling all chat history, or just the `'user'` content.
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-custom-guardrail/index.md

@@ -130,4 +130,8 @@ The [`config.metrics`](./reference/#schema--config-metrics) field allows you to
 * `block_details`: Additional details about the blocked request or response.
 * `masked`: Whether content was masked in the request or response.
 
-The values can be set to Lua expressions. You can also use the [`config.custom_metrics`](./reference/#schema--config-custom-metrics) field to define additional metrics.
+The values can be set to Lua expressions. You can also use the [`config.custom_metrics`](./reference/#schema--config-custom-metrics) field to define additional metrics.
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-gcp-model-armor/index.md

@@ -171,4 +171,8 @@ To log the raw content of blocked requests and responses, enable [`config.log_bl
 * Only chat prompts and chat responses are inspected; embeddings and other modalities are not checked.
 * Inspects one chat message or one response body at a time. Combining multiple messages reduces accuracy.
 * For SSE streaming, unsafe content may appear briefly before termination with `"stop_reason: blocked by content safety"`.
-* Only one `template_id` can be configured per plugin instance.
+* Only one `template_id` can be configured per plugin instance.
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-lakera-guard/index.md

@@ -170,4 +170,8 @@ When a request is blocked, the log captures the violation reason, detector detai
     }
   }
 }
-```
+```
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-prompt-compressor/index.md

@@ -215,3 +215,7 @@ sequenceDiagram
 <!-- vale on -->
 
 The AI Prompt Compressor plugin applies structured compression to preserve essential context of prompts sent by users, rather than trimming prompts arbitrarily or risking token overflows. This ensures the LLM receives a well-formed, focused prompt keeping token usage under control.
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-proxy-advanced/examples/forward-proxy.yaml

@@ -0,0 +1,45 @@
+---
+
+title: 'Route inference traffic through a forward proxy'
+description: 'Configure AI Proxy Advanced to send outbound inference requests through an HTTP forward proxy for network-isolated deployments.'
+
+weight: 950
+
+group: network
+
+config:
+  targets:
+    - route_type: llm/v1/chat
+      auth:
+        header_name: Authorization
+        header_value: Bearer ${openai_key}
+      model:
+        provider: openai
+        name: gpt-5.1
+  proxy_config:
+    http_proxy_host: proxy.internal
+    http_proxy_port: 3128
+    https_proxy_host: proxy.internal
+    https_proxy_port: 3128
+    proxy_scheme: http
+    auth_username: ${proxy_user}
+    auth_password: ${proxy_password}
+    https_verify: false
+
+variables:
+  openai_key:
+    value: $OPENAI_API_KEY
+    description: The API key to use to connect to OpenAI.
+  proxy_user:
+    value: $FORWARD_PROXY_USER
+    description: Username for the corporate forward proxy.
+  proxy_password:
+    value: $FORWARD_PROXY_PASSWORD
+    description: Password for the corporate forward proxy.
+
+tools:
+  - deck
+  - admin-api
+  - konnect-api
+  - kic
+  - terraform

app/_kong_plugins/ai-proxy-advanced/index.md

@@ -71,6 +71,8 @@ examples_groups:
     text: Native routes
   - slug: claude-code
     text: claude-code
+  - slug: network
+    text: Network configuration
 
 faqs:
   - q: Can I override `config.model.name` by specifying a different model name in the request?
@@ -197,3 +199,7 @@ For setup instructions, see [AI plugin Partials](/gateway/entities/partial/#ai-p
 {% include_cached /plugins/redis/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached /plugins/redis/enterprise.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-rag-injector/index.md

@@ -498,3 +498,7 @@ Use the [Admin API](/plugins/ai-rag-injector/api/) to ingest content with metada
 {% include_cached /plugins/ai-partials-vectordb-embeddings.md %}
 
 {% include_cached /plugins/redis/redis-cloud-auth.md tier=page.tier %}
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-sanitizer/index.md

@@ -245,3 +245,7 @@ You can use the following fields in the `anonymize` array:
 * `custom`: Anonymizes user-defined custom PII patterns using regular expressions only when custom patterns are provided.
 * `credentials`: Anonymizes the credentials, similar to `/sanitize_credentials`.
 * `all`: Includes all the fields above, including custom ones.
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-semantic-cache/index.md

@@ -182,3 +182,7 @@ The plugin respects cache control headers to determine if requests and responses
 {% include_cached /plugins/redis/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached /plugins/redis/enterprise.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-semantic-prompt-guard/index.md

@@ -106,3 +106,7 @@ The matching behavior is as follows:
 {% include_cached /plugins/redis/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached /plugins/redis/enterprise.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/ai-semantic-response-guard/index.md

@@ -101,3 +101,7 @@ To enforce these rules, the plugin:
 {% include_cached /plugins/redis/redis-cloud-auth.md tier=page.tier %}
 
 {% include_cached /plugins/redis/enterprise.md name=page.name heading_level=3 %}
+
+## Forward proxy support
+
+{% include ai-gateway/forward-proxy.md %}

app/_kong_plugins/forward-proxy/index.md

@@ -38,6 +38,10 @@ search_aliases:
 
 min_version:
   gateway: '1.0'
+
+related_resources:
+  - text: Forward proxy support for {{site.ai_gateway}}
+    url: /ai-gateway/forward-proxy/
 ---
 
 The Forward Proxy Advanced plugin allows {{site.base_gateway}} to connect to intermediary transparent HTTP proxies, instead of directly to the `upstream_url`, when forwarding requests upstream. 

app/_landing_pages/ai-gateway.yaml

@@ -169,6 +169,7 @@ rows:
                     - "[{{site.ai_gateway}} resource sizing guidelines](/ai-gateway/resource-sizing-guidelines-ai/): Review recommended resource allocation guidelines for {{site.ai_gateway}}."
                     - "[Deployment topologies](/gateway/deployment-topologies/): Learn about the different ways to deploy {{ site.base_gateway }}."
                     - "[Hosting options](/gateway/topology-hosting-options/): Decide where you want to host your Data Plane nodes, and whether you want Kong to host them or host them yourself."
+                    - "[Route AI Proxy Advanced traffic through a forward proxy](/how-to/route-ai-proxy-advanced-traffic-through-forward-proxy/): Configure a local forward proxy and validate that {{site.ai_gateway}} traffic traverses it."
       - header:
           type: h2
           text: "Tools to manage {{site.ai_gateway}}"
@@ -336,6 +337,15 @@ rows:
             cta:
               url: /ai-gateway/streaming/
               align: end
+      - blocks:
+        - type: card
+          config:
+            title: Forward proxy support
+            description: Route outbound {{site.ai_gateway}} plugin traffic through a controlled HTTP forward proxy
+            icon: /assets/icons/network.svg
+            cta:
+              url: /ai-gateway/forward-proxy/
+              align: end
       - blocks:
         - type: card
           config: