A Local TLS Proxy That Reroutes LM Studio Downloads Through China's Hugging Face Mirror
LM Studio's downloader bypasses the system proxy and ignores standard hosts-only hacks, so developers outside China who use it with a VPN get throttled to ~100 KB/s from Cloudflare. This proxy-and-hosts combination gives full-speed downloads over a domestic Chinese broadband link without consuming proxy data, and the same TLS interception pattern applies to any Electron app that bundles its own Node HTTP stack.
LM Studio's Electron-based Node downloader ignores the Windows system proxy and, when its built-in HF proxy is enabled, first hops to search.lmstudio.ai — not huggingface.co. A Python TLS termination proxy listening on localhost:443 intercepts those requests, strips the /v1/hf-proxy prefix, rewrites the Host header to hf-mirror.com, and connects directly to the mirror's IP over a domestic broadband link. The mirror's 302 redirect to us.aws.cdn.hf.co is handled by a separate hosts entry pointing to a directly reachable CloudFront edge IP, keeping large file transfers out of the local proxy.
The setup requires generating a local CA and a server certificate whose SAN includes search.lmstudio.ai, huggingface.co, hf.co, cdn-lfs.huggingface.co, and us.aws.cdn.hf.co. That CA must be installed both in the Windows root store and exposed to Node via the NODE_EXTRA_CA_CERTS environment variable. IPv6 hosts entries are mandatory because LM Studio will otherwise prefer Cloudflare's IPv6 addresses. Clash and TUN must be fully exited during downloads, and any leftover HTTP_PROXY variables pointing to dead proxy ports will cause Node to time out.
A PowerShell launcher script optionally adds Chromium host-resolver rules as a second layer of DNS enforcement, and a VBS script placed in the Windows Startup folder runs the proxy silently on login. The result is multi-MB/s download speeds without routing model weights through a VPN or hitting Hugging Face's overseas rate limiting.
The core friction is architectural: Electron apps ship their own Node runtime, which ignores OS-level proxy and DNS settings that developers assume are universal. This proxy pattern is a reusable fix for any Electron tool that downloads from Hugging Face.
LM Studio's useHFProxy feature is a well-intentioned relay that actually complicates local mirroring because it introduces an extra hostname (search.lmstudio.ai) that must be separately hijacked and included in the TLS certificate.
The checklist of 13 items and 10 common pitfalls reflects how brittle the setup is — a single missing IPv6 hosts line or a stale HTTP_PROXY variable silently breaks the entire chain, and the failure mode is just slow downloads with no clear error.
Hardcoding mirror and CDN IPs creates a maintenance burden: those addresses change over time, and the tutorial explicitly warns readers to re-test them on the day of replication rather than blindly copying the values.