A SOCKS5 proxy forwards arbitrary TCP connections (and optionally UDP) for applications that support it: browsers, curl, messaging and torrent clients, many SDKs. Unlike an HTTP proxy, it doesn’t care about the protocol inside. There are two easy ways to get one on your VPS: an SSH dynamic forward for personal use, or Dante, a dedicated SOCKS server for apps and multiple users.

Option 1: SSH dynamic forwarding (instant, encrypted)

If you can SSH into your VPS, you already have a SOCKS5 proxy:

ssh -D 1080 -N -C user@your-vps
  • -D 1080 opens a SOCKS5 proxy on your computer’s localhost:1080.
  • -N means no remote shell. -C compresses.

Point your browser or app at localhost:1080 (type SOCKS5). Traffic is encrypted between your computer and the VPS, and exits from the VPS’s IP. Keep it running with autossh, or a ~/.ssh/config entry with DynamicForward 1080. See SSH tunnels.

That’s perfect for one person and one device. For apps that must connect to a remote SOCKS server directly, such as other servers or devices that can’t run SSH, use Dante.

Option 2: Dante SOCKS5 server

Install

sudo apt update && sudo apt install dante-server
ip -br addr          # note the external interface name, e.g. eth0

Configure

Create a dedicated, login-less user for proxy authentication:

sudo useradd -r -s /usr/sbin/nologin proxyuser
sudo passwd proxyuser

/etc/danted.conf:

logoutput: syslog

internal: eth0 port = 1080
external: eth0

socksmethod: username
clientmethod: none

user.privileged: root
user.unprivileged: nobody

# which client IPs may connect (tighten this!)
client pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    log: error
}

# what authenticated clients may reach
socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    protocol: tcp
    socksmethod: username
    log: error connect disconnect
}

# block access to the server's own private and local networks via the proxy
socks block {
    from: 0.0.0.0/0 to: 127.0.0.0/8
    log: connect error
}
socks block {
    from: 0.0.0.0/0 to: 10.0.0.0/8
    log: connect error
}

socksmethod: username authenticates against system accounts (PAM/passwd), which is why we created proxyuser. Place the socks block rules before the general socks pass, since Dante evaluates rules in order. Better still, restrict client pass to your known IPs if you have them.

sudo systemctl restart danted
sudo systemctl enable danted
sudo ss -tlnp | grep 1080

Firewall

sudo ufw allow from 203.0.113.50 to any port 1080 proto tcp     # your IP(s)

If you must allow any IP, keep strong passwords and watch the logs. An unauthenticated or weakly protected SOCKS proxy will be abused.

Test

curl --socks5-hostname 203.0.113.10:1080 -U proxyuser:password https://ifconfig.me

--socks5-hostname (or socks5h://) makes the proxy resolve DNS. That avoids DNS leaks, where your local resolver sees every hostname you visit.

Configure clients

  • Firefox: Settings → Network Settings → Manual proxy → SOCKS Host, SOCKS v5, and tick “Proxy DNS when using SOCKS v5”.
  • Chrome / Chromium: --proxy-server="socks5://host:1080". Chrome doesn’t support SOCKS authentication natively, so use the SSH method or an extension.
  • curl / CLI: ALL_PROXY=socks5h://user:pass@host:1080.
  • Apps: many have a SOCKS5 setting. For apps without one, proxychains-ng forces them through the proxy.

Security notes

  • SOCKS5 itself isn’t encrypted. Credentials and traffic (apart from what’s already TLS, like HTTPS) travel in the clear between the client and the proxy. Use the SSH method, or tunnel Dante through a VPN, for sensitive use. See VPN vs proxy.
  • Restrict clients by IP, and use strong, unique passwords.
  • Block internal destinations (as above), so proxy users can’t reach services on the VPS’s localhost or private network.
  • Monitor with journalctl -u danted, and watch bandwidth. Traffic through the proxy counts against your VPS’s transfer allowance.
  • Follow your provider’s acceptable use policy. Running open proxies or using one for abuse gets servers suspended.

Quick reference

Task Command / setting
Instant personal proxy ssh -D 1080 -N user@vps
Install Dante apt install dante-server
Config /etc/danted.conf
Auth via system user socksmethod: username
Test curl --socks5-hostname host:1080 -U user:pass URL
Logs journalctl -u danted

Related: Squid proxy server and frp.

  • Proxy
  • Networking
  • Linux