proxychains-ng proxy setup

Protocols

SOCKS5 and HTTP (CONNECT), username and password in proxychains.conf

UDP

No: proxychains-ng carries TCP only (no UDP, no ICMP)

Where the setting is

[ProxyList] in proxychains.conf; the system file is /etc/proxychains4.conf on Debian and Ubuntu

Works with

Residential and mobile proxies

Before you start

• proxychains-ng 4.x: sudo apt install proxychains4 on Debian and Ubuntu, brew install proxychains-ng on macOS. The command is proxychains4.
• Your proxy login and password from the Residential or Mobile page of the dashboard.
• Traffic on the product you use: a login without traffic is refused.
• The gateway's IPv4 address: proxychains-ng accepts only a numeric IP for the first proxy in the list. The script below looks it up.

Add the proxy

Test the login with curl first, so a typo in it does not look like a proxychains problem:

curl -x socks5h://LOGIN-cc-us:[email protected]:7001 https://api.ipify.org

proxychains-ng reads the first config it finds: the file in PROXYCHAINS_CONF_FILE or after -f, then ./proxychains.conf, then ~/.proxychains/proxychains.conf, then the system file. This script looks up the gateway address (with getent on Linux, dig on macOS), writes your own file and prints its proxy line:

mkdir -p ~/.proxychains
GATE_IP=$(getent ahostsv4 gate.aeonproxy.com 2>/dev/null | head -n1 | cut -d' ' -f1)
[ -n "$GATE_IP" ] || GATE_IP=$(dig +short A gate.aeonproxy.com | grep -m1 -E '^[0-9.]+$')
cat > ~/.proxychains/proxychains.conf <<EOF
strict_chain
proxy_dns
remote_dns_subnet 224
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5 $GATE_IP 7001 LOGIN-cc-us-sid-cli01-ttl-30 PASSWORD
EOF
grep socks5 ~/.proxychains/proxychains.conf

• The printed line must show an IP address after socks5. If it does not, the lookup failed: run the script again.
• strict_chain sends every connection through the one proxy in the list.
• proxy_dns passes host names to the gateway, so they are resolved at the exit. The program gets a placeholder address from 224.x.x.x in the meantime.
• For the HTTP port, the line is http $GATE_IP 7000 LOGIN PASSWORD. Both carry any TCP connection.
• The heredoc is unquoted so that $GATE_IP expands. If your password contains $ or a backslash, edit the file by hand instead.

Check the proxy

proxychains4 -q curl -s https://api.ipify.org

It prints the exit IP, not yours. Without -q, proxychains writes a [proxychains] Strict chain line for each connection with the gateway address and the target, which helps when something fails.

Rotating or sticky

Each TCP connection the program opens is a new SOCKS5 session. With a rotating login every one gets a new IP: fine for a single request, but a tool that signs in and then downloads shows the site several IPs. The sticky key in the script (-sid-cli01-ttl-30) keeps one exit for 30 minutes (60 at most). For a fresh IP, change the key to cli02 or wait for the time to run out.

Programs that ignore proxychains

• proxychains hooks dynamically linked programs. Statically linked tools (many written in Go) skip it: use their own proxy flag or HTTPS_PROXY.
• On macOS, system binaries such as /usr/bin/curl are protected by System Integrity Protection and are not hooked. Use Homebrew's copy, for example $(brew --prefix)/opt/curl/bin/curl.
• ping and other ICMP or UDP tools never go through a proxy. Test with curl.

If it does not work