Integrate · Protocols
HTTP, HTTPS and SOCKS5, and exactly what the gateway does with each.
Standard protocols, no custom client. This page is the precise behaviour for people who need to know what happens on the wire.
Cheat sheet#
| Target | Proxy URL in your client | Port |
|---|---|---|
http:// and https:// URLs | http://USER:[email protected]:9000 | 9000 |
| Anything over TCP, hostname resolved at the exit | socks5h://USER:[email protected]:9001 | 9001 |
| Same, hostname resolved by your machine | socks5://USER:[email protected]:9001 | 9001 |
| Dedicated address, HTTP(S) | http://USER:[email protected]:8000 | 8000 |
| Dedicated address, SOCKS5 | socks5h://USER:[email protected]:8001 | 8001 |
HTTP#
For a plain http:// target your client sends the request with an absolute URI and a Proxy-Authorization header to port 9000. The gateway strips that header, relays the request through the exit and streams the response back. HTTP/1.1 with keep-alive is supported; a kept-alive connection keeps its exit (see rotation).
HTTPS#
For an https:// target the client sends CONNECT host:443 and the gateway opens a raw tunnel from the exit. The TLS handshake happens between your client and the target through that tunnel: the gateway never decrypts, inspects or re-signs anything, and the certificate you verify is the target's own. HTTP/2 and HTTP/3-over-TCP fallbacks negotiated inside the tunnel work as they would directly.
SOCKS5#
- RFC 1928 with username/password authentication (RFC 1929) or no authentication from a whitelisted address.
CONNECTto any TCP port except 25.BINDandUDP ASSOCIATEare not supported: no UDP, no inbound connections.- Send the hostname (address type 0x03) so the exit resolves it: that is what
socks5h://means in curl, Python and Node. If your client resolves locally and sends an IP, the request still works but the DNS lookup happened on your side. - Choose SOCKS5 for non-HTTP TCP protocols and for clients that only speak SOCKS; for web traffic the HTTP port is equivalent.
Headers#
The gateway removes Proxy-Authorization and Proxy-Connection and adds nothing: no Via, no X-Forwarded-For, no X-Real-IP. What the target receives is your request as the exit device would send it, which is the point of the network. Set User-Agent, Accept-Language and the rest to match the exit's country yourself.
Not supported#
- UDP in any form (QUIC falls back to TCP in every browser when a proxy is configured).
- IPv6 targets: exits are IPv4.
- TLS to the proxy port itself (
https://as the proxy scheme). The hop to the gateway is plain; see Endpoints. - FTP, SMTP on port 25, and protocols that require the proxy to open a connection back to you.