Write WebProxy Bypass Entries as Regular Expressions

The BypassList argument of System.Net.WebProxy contains regular expressions. A pattern such as *.office.example is invalid because the leading asterisk has no preceding expression to repeat.

For HTTP and HTTPS requests to office.example and its subdomains, a PowerShell configuration can use:

$bypass = @('^https?://([a-z0-9-]+\.)*office\.example(:[0-9]+)?$')
$proxy = [System.Net.WebProxy]::new(
    'http://proxy.example:8080',
    $false,
    [string[]]$bypass
)

The escaped dots match literal dots. The repeated hostname-label group admits both the base domain and names below it. The anchors keep a name such as office.example.other.test outside this rule. Single-quoted PowerShell strings preserve the backslashes used by the expression.

The current .NET implementation matches these expressions against the destination's scheme, hostname and nondefault port. It does not include the request path or query string. The optional port group therefore allows nondefault ports too; remove or narrow it if the policy requires a specific service.

BypassProxyOnLocal is false in this example so that the regex policy can be inspected separately from that additional bypass setting. Attach the resulting proxy object to the HTTP client that should use it. For a permitted public-URL test outside the bypass domain, an HTTP entry from the HTTP proxy list can supply its address, with no proxy account configured.

Use IsBypassed with representative Uri values to inspect the routing decision: the base domain, one subdomain, an unrelated external host, and a deceptive longer suffix. A true result means direct access was selected; it does not establish that the direct destination is reachable.