Detailed Guides: SOCKS5 on Routers and Raspberry Pi

🍸 REVOLUTION BY 404.VODKA

A premium turnkey hardware-software solution for maximum anonymity and lock bypass. Guarantees a significant increase in trust for your projects. This is currently the best anon-box on the market.

🔥 Key Features:

🔗 Additional Materials:

• Official 404.vodka Website
• Introductory Video VODKA + SELEDKA
• More about VODKA+SELEDKA (RUS) | ENG Version
• Official Telegram Channel
• 24/7 Tech Support: @vodka_support

📋 Prerequisites

• Router with KeeneticOS 3.9 or newer (Check: System → Updates)
• Access to web interface (usually 192.168.1.1 or my.keenetic.net)
• Proxy credentials: IP:Port, Username, Password

🔧 Step-by-step Setup

Step 1: Install 'Proxy Client' component

1. Access the router web interface
2. Navigate to Management -> System Settings -> Components
3. Search for proxy
4. ✅ Check Proxy Client
5. (Optional) also check DNS Server and DNS-over-TLS/HTTPS. With Rich Proxy, DNS proxying works out of the box on our servers, so extra DNS protection is not required.
6. Click Install update -> router will reboot (2-3 mins)

Step 2: Create a proxy connection

1. Navigate to Internet -> Other connections -> Proxy Connections
2. Click Add connection
3. Fill out the form:
   • 🔸 Name: Any (e.g. MySOCKS5)
   • 🔸 Protocol: SOCKS v5
   • 🔸 Server Address: IP address or domain (e.g. 1.2.3.4)
   • 🔸 Port: Proxy port (e.g. 1080)
   • 🔸 Authentication: Password
   • 🔸 Username: Your username
   • 🔸 Password: Your password
   • 🔸 Use for Internet access: ✅ Enabled
4. Click Save

Step 3: Setup DNS via proxy (Optional)

📋 Prerequisites

• GL.iNet Router (Flint, Beryl, Slate, Mango)
• Access to the web interface (192.168.8.1)
• SSH access enabled (enabled by default)

Method A: Via Web Interface (Plugin)

Step 1: Install Plugin (if available)

1. Go to the web interface
2. Navigate to: Plugins → find Shadowsocks, V2Ray or RedSocks
3. Click Install
4. After installation, navigate to the plugin settings

Step 2: SOCKS5 Setup

1. In the plugin, create a new server:
   Type: SOCKS5
Server: 1.2.3.4
Port: 1080
Auth: Username/Password
Username: your_login
Password: your_password
2. Enable Global Proxy or configure proper routing rules
3. Save and activate

⚠️ Not all plugins support SOCKS5 with authentication. If your plugin lacks it, use Method B.

Method B: Via Console + redsocks2 (Universal)

Step 1: SSH Connection

ssh [email protected]
# Default password: same as your web-interface

Step 2: Install Packages

opkg update
opkg install redsocks2 iptables-mod-tproxy kmod-ipt-tproxy

Step 3: Setup redsocks2

Open the config: vi /etc/redsocks2.conf
Replace its contents with:

base {
    log_debug = off;
    log_info = off;
    log = stderr;
    daemon = on;
    redirector = iptables;
}

redsocks {
    bind = "192.168.8.1:12345";
    relay = "1.2.3.4:1080";
    type = socks5;
    login = "your_login";
    password = "your_password";
    autoproxy = 0;
    timeout = 10;
}

Save it: :wq in vi.

Step 4: Setup iptables

# Create a new chain
iptables -t nat -N REDSOCKS

# Exclude local networks
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN

# Redirect traffic to redsocks
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345

# Apply routing rules to LAN traffic (interface is usually br-lan)
iptables -t nat -A PREROUTING -i br-lan -p tcp -j REDSOCKS

Step 5: Start & Enable on boot

# Run redsocks2
/etc/init.d/redsocks2 start

# Enable on boot
/etc/init.d/redsocks2 enable

# Check status
/etc/init.d/redsocks2 status

Step 6: Setup DNS (Optional with Rich Proxy)

# With Rich Proxy, all DNS queries are reliably and safely resolved inside the tunnel.
# Feel free to skip this step!

# When using third-party proxies, it is advised to install dnscrypt-proxy:
opkg install dnscrypt-proxy

# And configure /etc/config/dnscrypt-proxy

Step 7: Verification

# From any device on the network:
curl https://api.ipify.org  # should show the Proxy IP-address
nslookup google.com         # should resolve through the proxy

🔄 Saving iptables rules across reboots

GL.iNet running on OpenWRT can drop iptables rules during a reboot. Create the script /etc/firewall.user:

#!/bin/sh
# This file is executed after the firewall rules are loaded

# Re-applying rules for redsocks
iptables -t nat -N REDSOCKS 2>/dev/null || true
iptables -t nat -F REDSOCKS
# ... (all rules from Step 4) ...

Make it executable: chmod +x /etc/firewall.user

📋 Prerequisites

• OpenWRT installed (verify version: 21.02 or newer)
• SSH access
• Basic Linux knowledge

🔧 Step-by-step Setup

Step 1: Install Packages

ssh [email protected]

opkg update
opkg install redsocks2 iptables iptables-mod-tproxy kmod-ipt-tproxy

Step 2: Setup redsocks2

Open: vi /etc/redsocks2.conf

base {
    log_debug = off;
    log_info = off;
    log = syslog;
    daemon = on;
    redirector = iptables;
}

redsocks {
    bind = "192.168.1.1:12345";
    relay = "1.2.3.4:1080";
    type = socks5;
    login = "your_login";
    password = "your_password";
    autoproxy = 0;
    timeout = 10;
}

Step 3: Setup iptables

# Create a new chain
iptables -t nat -N REDSOCKS

# Exclude local addresses (mandatory!)
for net in 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4; do
    iptables -t nat -A REDSOCKS -d $net -j RETURN
done

# Redirect the remaining TCP-traffic
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345

# Apply to outbound traffic (replace br-lan with your interface name)
iptables -t nat -A PREROUTING -i br-lan -p tcp -j REDSOCKS

💡 Find interface name: ip link show or ifconfig

Step 4: Verify redsocks2

# Run manually to test
redsocks2 -c /etc/redsocks2.conf

# In another terminal, verify:
curl --socks5 192.168.1.1:12345 https://api.ipify.org

Step 5: Enable Autostart

Create /etc/init.d/redsocks2:

#!/bin/sh /etc/rc.common
START=99
STOP=01

start() {
    /usr/sbin/redsocks2 -c /etc/redsocks2.conf
}

stop() {
    killall redsocks2 2>/dev/null
    iptables -t nat -F REDSOCKS 2>/dev/null
    iptables -t nat -X REDSOCKS 2>/dev/null
}

chmod +x /etc/init.d/redsocks2
/etc/init.d/redsocks2 enable
/etc/init.d/redsocks2 start

Step 6: Saving iptables rules

OpenWRT does not retain iptables rules upon reboot by default.

Option A: Via iptables-persistent

opkg install iptables-persistent
/etc/init.d/iptables-persistent save

Option B: Via /etc/firewall.user

vi /etc/firewall.user
Append to the end of the file:

# Rules for redsocks
iptables -t nat -N REDSOCKS 2>/dev/null || true
iptables -t nat -F REDSOCKS
# ... all rules from Step 3 ...

Step 7: Setup DNS (Optional with Rich Proxy)

When using Rich Proxy, this step can be ignored since the DNS automatically resolves securely on the proxy server's side. For third-party untrusted proxies:

# Install dnscrypt-proxy
opkg install dnscrypt-proxy

# Configure /etc/config/dnscrypt-proxy
vi /etc/config/dnscrypt-proxy

Minimal configuration example:

config dnscrypt-proxy
    option address '127.0.0.1:5353'
    option port '5353'
    option resolv_conf '/tmp/resolv.conf.auto'

Then in /etc/config/dhcp:

config dnsmasq
    option noresolv '1'
    option server '127.0.0.1#5353'

Restart the services:

/etc/init.d/dnsmasq restart
/etc/init.d/dnscrypt-proxy restart

Step 8: Final Checks

# Test external IP-address
curl https://api.ipify.org

# Test DNS
nslookup google.com

# Online checker: open from a device on the network
# - https://ipleak.net
# - https://dnsleaktest.com

📋 Prerequisites

• ASUS Merlin firmware installed
• SSH access enabled (Administration → System → Enable SSH)
• Entware installed (via amtm)

🔧 Step-by-step Setup

Step 1: Install Entware (if not done yet)

# Connect via SSH
ssh [email protected]

# Install amtm (manager for Merlin)
curl -sL https://raw.githubusercontent.com/SomeWhereOverTheRainBow/asuswrt-merlin.entware/master/amtm.sh | sh

# Within the amtm menu, select Entware installation

Step 2: Install redsocks or proxychains

# Update package list
opkg update

# Install redsocks
opkg install redsocks

# Or proxychains-ng for single commands
opkg install proxychains-ng

Step 3: Setup redsocks

vi /opt/etc/redsocks.conf

base {
    log_debug = off;
    log_info = off;
    log = "syslog:daemon";
    daemon = on;
    redirector = iptables;
}

redsocks {
    bind = "192.168.1.1:12345";
    relay = "1.2.3.4:1080";
    type = socks5;
    login = "your_login";
    password = "your_password";
    autoproxy = 0;
    timeout = 10;
}

Step 4: Run redsocks

# Run manually
/opt/etc/init.d/S99redsocks start

# Check status
ps | grep redsocks

Step 5: Setup iptables

# Uses the same rules as OpenWRT
iptables -t nat -N REDSOCKS
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
# ... remaining exclusions ...
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345
iptables -t nat -A PREROUTING -i br0 -p tcp -j REDSOCKS

💡 On ASUS Merlin, the primary interface is typically br0, and not br-lan

Step 6: Autostart

Create the script /jffs/scripts/services-start:

#!/bin/sh
# This script executes after system boot

# Waiting for network to initialize
sleep 30

# Run redsocks
/opt/etc/init.d/S99redsocks start

# Apply iptables rules
iptables -t nat -N REDSOCKS 2>/dev/null || true
# ... your rules ...

chmod +x /jffs/scripts/services-start

Step 7: Verification

Similar to previous setups:

curl https://api.ipify.org
nslookup google.com

📋 Prerequisites

• RouterOS 7.x (Socksify function is available from version 7.1)
• Access via WinBox or SSH
• Basic understanding of MikroTik firewall rules

Method A: Native Socksify Function

Step 1: Creating socksify service

# Using the terminal (WinBox: New Terminal)
/ip socksify
add name=MyProxy     socks5-server=1.2.3.4     socks5-port=1080     socks5-user=your_login     socks5-password=your_password     connection-timeout=30     disabled=no

Step 2: Permit incoming connections to the service

/ip firewall filter
add action=accept chain=input dst-port=952 protocol=tcp src-address=192.168.88.0/24 comment="Allow SOCKSIFY from LAN"

Port 952 is standard for the socksify service

Step 3: Redirect traffic via socksify

# Proxy all web-traffic (port 80, 443) from the local network
/ip firewall nat
add action=socksify     chain=dstnat     dst-port=80,443     protocol=tcp     socksify-service=MyProxy     src-address=192.168.88.0/24     comment="Proxy web traffic"

Step 4: Verification

# Upon a device on the network:
curl https://api.ipify.org

Method B: Container running redsocks (RouterOS 7.12+)

If you have RouterOS 7.12+ which supports containers:

Step 1: Fetching the image

# Download or build a redsocks image
# Example: Create a Dockerfile natively on your PC

FROM alpine:latest
RUN apk add --no-cache redsocks iptables
COPY redsocks.conf /etc/redsocks.conf
ENTRYPOINT ["/usr/sbin/redsocks", "-c", "/etc/redsocks.conf"]

Step 2: Upload image payload to router

# Via SCP or standard file-system drop

Step 3: Run the container

/container
add interface=bridge-local root-dir=redsocks logging=yes
start [find]

Step 4: Configure traffic redirecting

# Redirect your traffic directly to the container
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=80,443 protocol=tcp     to-addresses=172.17.0.2 to-ports=12345     comment="Redirect to redsocks container"

1. DNS Leak Shielding (Solved dynamically in Rich Proxy)

Whenever you employ ordinary proxies, always regulate DNS queries to circumvent ISP surveillance. However, coupled with Rich Proxy infrastructures, all DNS traffic gets securely proxied inside the transparent tunnel — so no extraneous DoT/DoH setup is required!

Consequently, if deploying third-party proxies, remember:

• Keenetic: Fasten DNS-over-TLS to your proxy connection interface.
• OpenWRT/GL.iNet: Boot dnscrypt-proxy or embed DoH into redsocks.
• MikroTik: Construct /ip dns set use-doh-server=... enforcing the proxy rule.

2. Exclusion of Local Subnets

Never proxy your entire LAN indiscriminately. Disregarding this will sever connectivity to identical network nodes, printers, smart home gateways:

iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN

3. Emergency Access Check

Prior to establishing universal transparency proxy mechanisms:

• Safeguard and save your active stable router configuration locally.
• Verify availability of secondary console connections (not localized purely to network-bridge interfaces).
• Execute operations iteratively under a Virtual Machine wrapper if competent.

4. Post-Setup Audit Verification

# Mandatory Action Routine Checklist:
# 1. Examine External IP:
curl https://api.ipify.org

# 2. Check for DNS Leaks:
nslookup google.com
# or verify online via dnsleaktest.com

# 3. WebRTC-Leak audit (targeting Web Browsers):
# Navigate towards https://browserleaks.com/webrtc

5. Maintenance and Logging

# OpenWRT/GL.iNet:
logread | grep redsocks

# Keenetic:
# Administrative Dashboard → System Information → Logs

# MikroTik:
/log print