SOCKS5 Help Center

Everything you need to authenticate a SOCKS5 proxy and verify your traffic with ip.sb.

Overview RFC 1928

SOCKS5 is a proxy protocol that relays TCP (and UDP via UDP ASSOCIATE) traffic between a client and a target server. Unlike HTTP proxies, it is protocol-agnostic — perfect for tunneling arbitrary traffic. Cloudflare Workers cannot itself act as a SOCKS5 server, but this page documents how to use a SOCKS5 endpoint and how to test it.

No auth — anonymous connection (method 0x00).
Username / Password — RFC 1929 sub-negotiation (method 0x02).
GSSAPI — enterprise Kerberos-style auth (rare for personal use).

Username / Password Authentication RFC 1929

When a SOCKS5 server requires credentials, the client and server perform a sub-negotiation after the initial method selection:

Client sends 0x05 0x01 0x02 — “I support user/pass auth”.
Server replies 0x05 0x02 — “Let’s use it”.
Client sends 0x01 | ulen | user | plen | pass.
Server replies 0x01 0x00 — 0x00 means success.

Security note: SOCKS5 username/password auth is sent in cleartext unless wrapped in TLS (e.g. via --socks5-hostname over an https:// target, or a SOCKS5-over-TLS tunnel). Prefer servers that you reach over an encrypted channel.

Testing with curl against ip.sb

ip.sb returns your public IP address and can confirm whether your SOCKS5 proxy is actually routing traffic. Three equivalent approaches:

1. Anonymous proxy (no auth):

$ curl --socks5-hostname proxy.example.com:1080 https://ip.sb

2. With username & password:

$ curl -U alice:secret --socks5-hostname proxy.example.com:1080 https://ip.sb

3. Proxy URL syntax (compact):

$ curl -x socks5h://alice:secret@proxy.example.com:1080 https://ip.sb

Bonus — JSON geolocation from ip.sb:

$ curl -x socks5h://alice:secret@proxy.example.com:1080 https://api.ip.sb/geoip
# => {"ip":"203.0.113.7","country":"United States","city":"Ashburn", ...}

Interactive Command Builder

Fill in your proxy details and copy the ready-to-run command.

Proxy host

Port

Username

Password

Target URL (defaults to ip.sb)

Use compact -x socks5h://… URL syntax

curl Flag Cheatsheet

Flag	Meaning
`--socks5-hostname`	Uses SOCKS5 and resolves DNS on the proxy (recommended).
`--socks5`	SOCKS5 but resolves DNS locally first (may leak hostname).
`-x, --proxy`	Generic proxy; prefix with `socks5h://` for proxy-side DNS.
`-U, --proxy-user`	Passes `user:password` for proxy auth.
`socks5h://`	Short form of `--socks5-hostname` in a URL.

Troubleshooting

“Proxy CONNECT aborted” / 407 — wrong credentials or the server rejects user/pass. Double-check the -U values.
DNS leaks even via proxy — you used --socks5 instead of --socks5-hostname/socks5h://.
ip.sb shows your real IP — the proxy connection silently failed and curl fell back to a direct connection; add --proxy-insecure only if testing a self-signed tunnel, otherwise fix the proxy.
Connection refused — verify host/port and that the SOCKS5 listener is reachable from your network.