MikroTik RouterOS proxy setup

Protocols

SOCKS5 with username and password, through Socksify (RouterOS 7.20 and newer)

UDP

No: Socksify forwards TCP only; UDP (QUIC, DNS, calls) leaves the router directly

Where the setting is

/ip/socksify plus a dstnat rule with action=socksify, in the Terminal

Works with

Residential and mobile proxies

Before you start

• RouterOS 7.20 or newer (/system/resource/print shows the version). Socksify arrived in 7.20 (September 2025), and 7.21 fixed a stability problem with it, so use 7.21 or later if you can.
• Your proxy login and password from the Residential or Mobile page of the dashboard.
• The devices to send through the proxy: one address or a subnet. The examples use the default LAN 192.168.88.0/24.

What RouterOS can and cannot do

• Web proxy (/ip/proxy): its parent proxy has an address and a port, no username or password. Our gateway asks every connection for a login, so this does not work.
• SOCKS server (/ip/socks): makes the router a proxy for your devices. It is not a client.
• Socksify (/ip/socksify): a SOCKS5 client with socks5-user and socks5-password. It takes an IPv4 address only (no host name), forwards TCP only, refuses private LAN destinations, and new records start disabled.

Add the proxy

Run these in a Terminal (WinBox → New Terminal, or SSH). [:resolve gate.aeonproxy.com] puts in the gateway's IPv4 address, looked up with the router's own DNS settings:

/ip/socksify
add name=aeon socks5-server=[:resolve gate.aeonproxy.com] socks5-port=7001 \
    socks5-user=LOGIN-cc-us-sid-office1-ttl-60 socks5-password=PASSWORD disabled=no

/ip/firewall/filter
add chain=input action=accept protocol=tcp dst-port=952 \
    src-address=192.168.88.0/24 comment="LAN to socksify"
add chain=forward action=drop protocol=udp dst-port=443 \
    src-address=192.168.88.0/24 comment="no QUIC, browsers use TCP"

/ip/firewall/nat
add chain=dstnat action=socksify socksify-service=aeon protocol=tcp \
    dst-port=80,443 dst-address-type=!local src-address=192.168.88.0/24

• The NAT rule sends web connections (ports 80 and 443) from the LAN to the service, which opens them through the gateway.
• dst-address-type=!local keeps WinBox, SSH and other connections to the router out of the proxy, so you cannot lock yourself out.
• The input rule lets the connections reach the service on port 952. The UDP 443 drop stops QUIC, which Socksify cannot carry, so browsers fall back to TCP. Move a rule up if an earlier rule in its chain drops or accepts the same traffic.

Check the proxy

On a device in the subnet, open /ip-checker: the IP and country should be the exit's. On the router, /log/print where topics~"socksify" shows what the service did, for example *cannot socksify LAN destination*.

Rotating or sticky

Socksify opens a separate SOCKS5 connection for each TCP connection. With a rotating login one web page would load from many IPs and sign-ins would drop, so use the sticky login above: the whole subnet shares one exit for up to 60 minutes, then the key moves to a new IP in the same country. For a second exit, add another record with another key and a NAT rule for that group's addresses.

RouterOS applies a change to the record only after you disable and enable it again: /ip/socksify disable [find name=aeon], then /ip/socksify enable [find name=aeon]. If the gateway address ever changes, run /ip/socksify set [find name=aeon] socks5-server=[:resolve gate.aeonproxy.com] and restart the record the same way.

If RouterOS cannot do it

On a version older than 7.20, or when UDP must use the proxy too, set the proxy on the devices themselves (Windows, Android).

If it does not work