Socks5 Configurator on Linux: Route Apps Through a SOCKS5 Proxy with Proxychains

Overview

Windows and macOS users get a graphical "SOCKS5 configurator" window. Linux does not ship one, so the same job is done with two small utilities that you configure by hand:

• proxychains-ng — wraps a single command and forces its outbound TCP connections through your SOCKS5 proxy.
• redsocks — redirects traffic transparently through iptables, which is closer to system-wide behaviour.

This tutorial covers both, shows how to prove your IP address actually changed, and explains the situations where per-application SOCKS5 is the wrong tool and a WireGuard tunnel — for example a dedicated gateway from NordLayer — is the better fit.

Prerequisites

• A Linux desktop or server. Commands are shown for Debian/Ubuntu, Fedora and Arch.
• sudo access for package installation and config edits.
• A working SOCKS5 endpoint: host, port, and username/password if the provider requires authentication.
• curl installed for verification (present on most distributions by default).

Steps

1. Verify the SOCKS5 endpoint before touching your system

Always confirm the proxy works on its own first, so you are not debugging two things at once:

curl -x socks5h://YOUR_USERNAME:YOUR_PASSWORD@PROXY_HOST:1080 https://ifconfig.me/ip

Two details matter here:

• socks5h:// asks the proxy to resolve DNS names for you. Plain socks5:// resolves them locally, which can leak the hostnames you visit.
• If your password contains @, : or /, percent-encode it, or use curl --proxy-user instead of embedding it in the URL.

2. Install proxychains-ng

Pick the command for your distribution:

# Debian / Ubuntu
sudo apt update && sudo apt install -y proxychains4

# Fedora
sudo dnf install -y proxychains-ng

# Arch
sudo pacman -S proxychains-ng

Confirm the binary is available as proxychains4 (Debian/Ubuntu) or proxychains (Fedora/Arch):

proxychains4 -h || proxychains -h

3. Configure the proxy chain

Open the configuration file (the path differs by package) and edit the [ProxyList] block:

sudo nano /etc/proxychains4.conf   # Debian / Ubuntu
sudo nano /etc/proxychains.conf    # Fedora / Arch

strict_chain
proxy_dns
remote_dns_subnet 224
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5 203.0.113.10 1080 YOUR_USERNAME YOUR_PASSWORD

Notes on the settings:

• proxy_dns forces DNS lookups through the proxy instead of your local resolver.
• strict_chain uses every proxy in order. Use dynamic_chain if you want failed hops skipped, or random_chain with chain_len to rotate between several entries.
• Replace 203.0.113.10 1080 with the host and port from your provider, and drop the username/password arguments if the endpoint does not require authentication.

4. Test that a command now exits from the proxy IP

Compare a direct request with a wrapped one:

curl -s https://ifconfig.me/ip          # your normal IP
proxychains4 -q curl -s https://ifconfig.me/ip   # should show the proxy IP

The -q flag suppresses proxychains' banner so you only see the response. You can wrap GUI applications the same way:

proxychains4 -q chromium https://ifconfig.me/ip

If both commands return the same IP, stop here and work through the troubleshooting section before continuing.

5. Set proxy environment variables for cooperating tools

Many command-line tools read standard proxy variables, which is useful when you do not want to prefix every command:

export ALL_PROXY="socks5h://YOUR_USERNAME:YOUR_PASSWORD@PROXY_HOST:1080"
export HTTPS_PROXY="$ALL_PROXY"
export HTTP_PROXY="$ALL_PROXY"

curl, wget, git, pip and Python's requests respect these by default, but many other applications ignore them entirely. Treat this as a convenience layer, not a system-wide configuration.

6. Optional: transparent redirection with redsocks

If you need applications that know nothing about proxies to be routed automatically, redsocks plus an iptables rule does the job. Create the configuration:

base {
    log_debug = off;
    log_info = on;
    daemon = on;
    redirector = iptables;
}

redsocks {
    local_ip = 127.0.0.1;
    local_port = 12345;
    ip = 203.0.113.10;
    port = 1080;
    type = socks5;
    login = "YOUR_USERNAME";
    password = "YOUR_PASSWORD";
}

Start the service and add the redirect rules. The first rule is essential: traffic to the proxy itself must never be redirected back into the proxy, or you create a loop.

sudo systemctl restart redsocks

sudo iptables -t nat -N REDSOCKS
sudo iptables -t nat -A REDSOCKS -d 203.0.113.10 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
sudo iptables -t nat -A OUTPUT -p tcp -j REDSOCKS

Redsocks only redirects TCP. UDP traffic, ICMP and anything that bypasses iptables still leaves on your normal connection, so this is not equivalent to a VPN.

SOCKS5 on Linux vs. a WireGuard Gateway

Per-application SOCKS5 and a WireGuard tunnel solve overlapping problems in different ways:

Choose the SOCKS5 route when you only need one tool to exit from another IP. Choose a WireGuard tunnel when the whole machine — or a whole team — needs consistent, encrypted routing. A managed option such as NordLayer provides WireGuard tunnels with dedicated gateways, onboarding aimed at teams, and flat monthly billing that is easier to forecast than usage-metered pricing.

Troubleshooting

proxychains has no effect on a specific binary

proxychains works by preloading a shared library, so it cannot intercept statically linked programs, Go binaries, or setuid executables. Check with:

ldd $(which YOUR_APP)

If the output says "not a dynamic executable", use redsocks instead — or route the machine through a WireGuard tunnel, which operates below the application layer.

Your IP still looks unchanged

• Confirm you are using socks5h:// or have proxy_dns enabled; a plain socks5:// URL resolves names locally.
• Check whether the provider expects authentication and whether your credentials are correct.
• Re-test with curl first. If curl shows the proxy IP but the app does not, the app is bypassing the preload.

Connections time out or hang

• Increase tcp_connect_time_out in /etc/proxychains4.conf.
• Confirm the proxy host is reachable on that port from your network (outbound firewalls often block non-standard ports).
• Reduce the number of hops in the chain — long strict chains multiply latency.

redsocks loops or drops everything

Your RETURN rule for the proxy's own IP must come first in the REDSOCKS chain. Flush and rebuild if you edited rules out of order:

sudo iptables -t nat -F REDSOCKS

Summary

Linux replaces the graphical SOCKS5 configurator with proxychains4 for per-command routing and redsocks for transparent TCP redirection. Verify the endpoint with curl, keep proxy_dns enabled to avoid DNS leaks, and remember that neither tool covers UDP or statically linked binaries. When you need every application and protocol on the device to use one stable, dedicated egress IP — especially for a team — a WireGuard tunnel, such as a dedicated gateway from NordLayer, is the simpler and more reliable choice.