Linux proxy setup
Linux has no single proxy switch. Terminal programs read environment variables, desktop apps read the GNOME or KDE setting, and some programs read neither.
- Protocols
- HTTP (port 7000) and SOCKS5 (port 7001) in environment variables; HTTP in GNOME Settings
- Login and password
- In the proxy URL:
http://LOGIN:PASSWORD@host:port. GNOME Settings has no login fields - UDP
- No: the variables and GNOME settings cover TCP only
- Where the setting is
- Your shell (
export,~/.bashrc), and Settings → Network → Proxy on GNOME - Works with
- Residential and mobile proxies
Before you start
- A shell (bash or zsh) and curl to test, on any distribution.
- Your proxy login and password from the Residential or Mobile page of the dashboard, and traffic on that product.
- Everything that reads the variables sends its traffic through the proxy and counts against your GB, package downloads included: set them only where you need them.
- Host
gate.aeonproxy.com- Port (HTTP / HTTPS)
7000- Port (SOCKS5)
7001- Login
- your proxy login, with targeting keys if you need them:
LOGIN-cc-us-sid-abc123 - Password
- your proxy password
Copy the login and password from the Residential or Mobile page of the dashboard; the generator there also writes ready lines. Key syntax: targeting and sessions.
Terminal programs: environment variables
curl, wget, git, pip and Python requests read these variables. Write the names in lowercase: curl reads http_proxy only in lowercase. The login and password go into the URL.
export http_proxy="http://LOGIN-cc-us-sid-linux01-ttl-30:[email protected]:7000"
export https_proxy="$http_proxy"
curl https://api.ipify.org
wget -qO- https://api.ipify.orghttps_proxy also starts with http://. It names the proxy for HTTPS sites, and the tunnel to our gateway is plain HTTP with CONNECT; an https:// proxy URL makes curl try TLS to the gateway and fail.
For SOCKS5, set all_proxy with socks5h://, so host names are resolved on the proxy side. Unset the HTTP variables first, because curl prefers them. wget has no SOCKS support and goes direct.
unset http_proxy https_proxy
export all_proxy="socks5h://LOGIN-cc-de:[email protected]:7001"
curl https://api.ipify.orgTo use the proxy for one command only, put the variable in front of it: https_proxy="http://LOGIN-cc-gb:[email protected]:7000" python3 job.py. Remove the variables with unset http_proxy https_proxy all_proxy.
Keep the variables
For every new terminal, keep the lines in a file only you can read and load it from ~/.bashrc (or ~/.zshrc):
cat > ~/.aeonproxy <<'EOF'
export http_proxy="http://LOGIN-cc-us-sid-linux01-ttl-60:[email protected]:7000"
export https_proxy="$http_proxy"
EOF
chmod 600 ~/.aeonproxy
echo '[ -f ~/.aeonproxy ] && . ~/.aeonproxy' >> ~/.bashrcPrograms read the variables when they start, so open a new terminal after a change. Commands run with sudo may not see them, because sudo resets the environment by default. systemd services and cron jobs never read your shell files.
Desktop apps: GNOME Settings
- Open Settings → Network and select Proxy.
- Turn on Network Proxy and set Configuration to Manual.
- In HTTP Proxy and in HTTPS Proxy enter
gate.aeonproxy.comand port7000(the host box is called URL in GNOME 46 and Host in later versions). Leave SOCKS empty. - Click Save.
There are no login fields. Chrome, and Firefox at its default Use system proxy settings, follow this setting and ask for the login in a sign-in window. Terminal programs do not read it. KDE Plasma has a similar proxy page in its System Settings.
Programs that ignore both
Games, many messengers, apps with their own network code and anything that sends UDP read neither setting. Force such a program through the gateway with proxychains, use a proxy client such as Clash Verge, or the app's own setting (Telegram).
Check the proxy
curl https://api.ipify.org prints the exit IP. In a browser, open the IP checker: it also shows the country and any WebRTC or DNS leak.
Rotating or sticky
For scripts that make many separate requests, a rotating login (LOGIN-cc-us) gives a new IP for every connection. For a browser or a job that must keep one address, use a sticky key: LOGIN-cc-us-sid-linux01-ttl-60 keeps the IP for up to 60 minutes. Change the key for a new IP at once.
If it does not work
| What you see | What to check |
|---|---|
curl: (56) CONNECT tunnel failed, response 407 | The login, the password or a key in the login is wrong. |
curl: (56) CONNECT tunnel failed, response 402 | No traffic left on the product, or the sub-user reached its limit. |
... response 403 | The target is blocked by default (Acceptable Use, section 4). curl -v shows why in the X-Reason header. |
curl: (35) ... wrong version number | The proxy URL starts with https://. Use http:// for port 7000. |
curl goes direct for http:// sites | It ignores HTTP_PROXY in capitals. Use http_proxy. |
Questions
No. curl reads it, wget ignores it, and many programs read only http_proxy and https_proxy. Use the HTTP variables unless a program needs SOCKS5.
Other users on the machine (root aside) cannot read your programs' environment, but the password sits in plain text in any file you put it in and in your shell history. Keep that file at chmod 600, and use Regenerate password on the product page of the dashboard if it leaks.