SOCKS5

How it works

SOCKS5, defined in RFC 1928, is a protocol for asking a proxy to open a connection on your behalf. The client connects to the SOCKS5 server, optionally authenticates, and then says "connect me to this address and port." The server does so and relays bytes in both directions from that point on.

Two properties define it. First, it is protocol-agnostic: it carries any TCP traffic, not just HTTP, and it can forward UDP through the UDP ASSOCIATE command, which matters for DNS, QUIC, voice, and games. Second, it operates at the connection level, so it never parses what it is carrying. SOCKS5 added username and password authentication and GSS-API support, which the older SOCKS4 lacked entirely.

When it matters

SOCKS5 matters when you need a general-purpose relay rather than a web-aware one. Developers use it to reach a service through a bastion host, often as the endpoint of an SSH dynamic port forward. Applications use it to route specific traffic through a controlled path without a full VPN.

It matters to defenders for a less comfortable reason. Because SOCKS5 is simple, protocol-agnostic, and invisible to content inspection, it is the standard payload of proxy malware. Families that infect consumer machines and rent them out as residential exit nodes almost always install a SOCKS5 server. A workstation on your network accepting inbound connections and relaying traffic outward is doing something no workstation should do.

Common misconceptions

• "SOCKS5 encrypts your traffic." It does not. There is no encryption anywhere in the protocol. If the traffic you send through it is plaintext, it is plaintext to the proxy operator and to anyone on the path beyond. Any confidentiality comes from TLS inside the tunnel, not from SOCKS5.
• "A SOCKS5 proxy can enforce content policy." It cannot, because it never parses content. If you need to allow one path on a host and deny another, you need a proxy that speaks the application protocol.
• "SOCKS5 makes you anonymous." It substitutes the proxy's address for yours as seen by the destination. The proxy operator sees both ends, and if the proxy is malware on someone's home computer, so does whoever is renting it out.