SOCKS5 Proxy

[knylbyte]

It would be great if you could implement a SOCKS5 proxy for requests.
For example, if you want to run several gluetun containers behind a Traefik proxy for load balancing.

[euzu]

@knilly You want outgoing requests to the provider to go through the SOCKS5 proxy ?

[knylbyte]

Yes, that would be nice.

[euzu]

Something like this ?

socks5:
   host: proxy.example.com
   port: 1080
   username: optional_user
   password: optional_password

[euzu]

merged to master

• Added proxy configuration for all outgoing requests in config.yml. supported http, https, socks5 proxies.

proxy:
  url: socks5://192.168.1.6:8123
  username: uname  # <- optional basic auth
  password: secret # <- optional basic auth

[knylbyte]

The end goal would be to load balance all your traffic with different gluetun containers and traefik in front of all your gluetun containers. Gluetun has the abillity to provide different proxy servers (HTTP, HTTPS, SOCKS5) to connect. If it works i can share my config if you like.
But to test all these settings, I need to check if the public IP changes to the public IP addresses of the different VPN servers. I currently intend to use the Round Robin method for load balancing.

I can join your discord server later.

[euzu]

But to test all these settings, I need to check if the public IP changes to the public IP addresses of the different VPN servers

How would you test this ?

[aniel300]

yes please join the discord. am very interested on your findings and use case of this.

[knylbyte]

The test case would be to use different vpn server with different public ips and connect them with you gluetun containers. Enable for example the socks5 proxy server at all gluetun containers and use a tcp router from traefik in front of all your gluetun containers. Then you only have one access point for the requests but several exit points to better utilize the bandwidth of the VPN connections. Configure traefik so that round robin is used for load balancing. But to see that everything works as intended, you should be able to check that the public IP changes like in a ring buffer. To do this, you would have to be able to see the public IP of outgoing requests via a path (e.g. /api/ip) in your API and send several requests to this path.

I'll get in touch with discord later. Then we can discuss more details. At the moment it's just an idea.

[aniel300]

i like this idea very much and is something i could use in the future for scaling up purposes

[aniel300]

It would be great if you could implement a SOCKS5 proxy for requests. For example, if you want to run several gluetun containers behind a Traefik proxy for load balancing.

i use both of those projects. how would u do something like this and what would be the end goal?

[knylbyte]

The end goal would be to load balance all your outgoing traffic with different gluetun containers and traefik proxy container in front of all your gluetun containers. Gluetun has the abillity to provide different proxy servers (HTTP, HTTPS, SOCKS5) to connect. If it works i can share my config if you like.

[aniel300]

i would love to have it. but to make sure we are in the same page. are u trying to use multiple vpn providers or accounts on a load balancing manner?

[knylbyte]

I'm using Mullvad and there you got 5 different devices / connections to connect to theire servers.

[aniel300]

ok i see what u are trying to do...i think. but yes join the server and we can talk via DM in case u don't feel comfortable talking about this in project server.

[euzu]

Added ipcheck

[euzu]

@knylbyte would be nice to get feedback on the feature.

[knylbyte]

1. HTTPS REQUEST

curl -v --proxy https://proxy-user:PaSsw0rD@proxy.your-domain.io:9443 https://ipinfo.io/ip

• Host proxy.your-domain.io:9443 was resolved.
• IPv6: (none)
• IPv4: 192.168.50.2
• Trying 192.168.50.2:9443...
• Connected to proxy.your-domain.io (192.168.50.2) port 9443
• ALPN: curl offers http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/ssl/cert.pem
• CApath: none
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted http/1.1
• Proxy certificate:
• subject: CN=your-domain.io
• start date: May 12 08:30:00 2025 GMT
• expire date: Aug 10 08:29:59 2025 GMT
• subjectAltName: host "proxy.your-domain.io" matched cert's "*.your-domain.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• CONNECT tunnel: HTTP/1.1 negotiated
• allocate connect buffer
• Proxy auth using Basic with user 'proxy-user'
• Establish HTTP proxy tunnel to ipinfo.io:443

CONNECT ipinfo.io:443 HTTP/1.1
Host: ipinfo.io:443
Proxy-Authorization: Basic cHJveHktdXNlcjpQYVNzdzByRA==
User-Agent: curl/8.7.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 OK
< Date: Tue, 20 May 2025 14:43:23 GMT
< Transfer-Encoding: chunked

• Ignoring Transfer-Encoding in CONNECT 200 response
  <
• CONNECT phase completed
• CONNECT tunnel established, response 200
• ALPN: curl offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted h2
• Server certificate:
• subject: CN=ipinfo.io
• start date: May 5 05:43:10 2025 GMT
• expire date: Aug 3 05:43:09 2025 GMT
• subjectAltName: host "ipinfo.io" matched cert's "ipinfo.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://ipinfo.io/ip
• [HTTP/2] [1] [:method: GET]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: ipinfo.io]
• [HTTP/2] [1] [:path: /ip]
• [HTTP/2] [1] [user-agent: curl/8.7.1]
• [HTTP/2] [1] [accept: /]

GET /ip HTTP/2
Host: ipinfo.io
User-Agent: curl/8.7.1
Accept: /

• Request completely sent off
  < HTTP/2 200
  < date: Tue, 20 May 2025 14:43:52 GMT
  < content-type: text/plain; charset=utf-8
  < content-length: 13
  < access-control-allow-origin: *
  < via: 1.1 google
  < strict-transport-security: max-age=2592000; includeSubDomains
  < alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  <
• Connection #0 to host proxy.your-domain.io left intact
  193.138.7.149

[knylbyte]

2. HTTPS REQUEST

curl -v --proxy https://proxy-user:PaSsw0rD@proxy.your-domain.io:9443 https://ipinfo.io/ip

• Host proxy.your-domain.io:9443 was resolved.
• IPv6: (none)
• IPv4: 192.168.50.2
• Trying 192.168.50.2:9443...
• Connected to proxy.your-domain.io (192.168.50.2) port 9443
• ALPN: curl offers http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/ssl/cert.pem
• CApath: none
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted http/1.1
• Proxy certificate:
• subject: CN=your-domain.io
• start date: May 12 08:30:00 2025 GMT
• expire date: Aug 10 08:29:59 2025 GMT
• subjectAltName: host "proxy.your-domain.io" matched cert's "*.your-domain.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• CONNECT tunnel: HTTP/1.1 negotiated
• allocate connect buffer
• Proxy auth using Basic with user 'proxy-user'
• Establish HTTP proxy tunnel to ipinfo.io:443

CONNECT ipinfo.io:443 HTTP/1.1
Host: ipinfo.io:443
Proxy-Authorization: Basic cHJveHktdXNlcjpQYVNzdzByRA==
User-Agent: curl/8.7.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 OK
< Date: Tue, 20 May 2025 14:43:29 GMT
< Transfer-Encoding: chunked

• Ignoring Transfer-Encoding in CONNECT 200 response
  <
• CONNECT phase completed
• CONNECT tunnel established, response 200
• ALPN: curl offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted h2
• Server certificate:
• subject: CN=ipinfo.io
• start date: May 5 05:43:10 2025 GMT
• expire date: Aug 3 05:43:09 2025 GMT
• subjectAltName: host "ipinfo.io" matched cert's "ipinfo.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://ipinfo.io/ip
• [HTTP/2] [1] [:method: GET]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: ipinfo.io]
• [HTTP/2] [1] [:path: /ip]
• [HTTP/2] [1] [user-agent: curl/8.7.1]
• [HTTP/2] [1] [accept: /]

GET /ip HTTP/2
Host: ipinfo.io
User-Agent: curl/8.7.1
Accept: /

• Request completely sent off
  < HTTP/2 200
  < date: Tue, 20 May 2025 14:43:57 GMT
  < content-type: text/plain; charset=utf-8
  < content-length: 15
  < access-control-allow-origin: *
  < via: 1.1 google
  < strict-transport-security: max-age=2592000; includeSubDomains
  < alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  <
• Connection #0 to host proxy.your-domain.io left intact
  176.125.235.101

[knylbyte]

1. HTTP REQUEST

curl -v --proxy http://proxy-user:PaSsw0rD@proxy.your-domain.io:1080 https://ipinfo.io/ip

• Host proxy.your-domain.io:1080 was resolved.
• IPv6: (none)
• IPv4: 192.168.50.2
• Trying 192.168.50.2:1080...
• Connected to proxy.your-domain.io (192.168.50.2) port 1080
• CONNECT tunnel: HTTP/1.1 negotiated
• allocate connect buffer
• Proxy auth using Basic with user 'proxy-user'
• Establish HTTP proxy tunnel to ipinfo.io:443

CONNECT ipinfo.io:443 HTTP/1.1
Host: ipinfo.io:443
Proxy-Authorization: Basic cHJveHktdXNlcjpQYVNzdzByRA==
User-Agent: curl/8.7.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 OK
< Date: Tue, 20 May 2025 14:43:47 GMT
< Transfer-Encoding: chunked

• Ignoring Transfer-Encoding in CONNECT 200 response
  <
• CONNECT phase completed
• CONNECT tunnel established, response 200
• ALPN: curl offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/ssl/cert.pem
• CApath: none
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted h2
• Server certificate:
• subject: CN=ipinfo.io
• start date: May 5 05:43:10 2025 GMT
• expire date: Aug 3 05:43:09 2025 GMT
• subjectAltName: host "ipinfo.io" matched cert's "ipinfo.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://ipinfo.io/ip
• [HTTP/2] [1] [:method: GET]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: ipinfo.io]
• [HTTP/2] [1] [:path: /ip]
• [HTTP/2] [1] [user-agent: curl/8.7.1]
• [HTTP/2] [1] [accept: /]

GET /ip HTTP/2
Host: ipinfo.io
User-Agent: curl/8.7.1
Accept: /

• Request completely sent off
  < HTTP/2 200
  < date: Tue, 20 May 2025 14:44:16 GMT
  < content-type: text/plain; charset=utf-8
  < content-length: 13
  < access-control-allow-origin: *
  < via: 1.1 google
  < strict-transport-security: max-age=2592000; includeSubDomains
  < alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  <
• Connection #0 to host proxy.your-domain.io left intact
  193.138.7.149

[knylbyte]

2. HTTP REQUEST

curl -v --proxy http://proxy-user:PaSsw0rD@proxy.your-domain.io:1080 https://ipinfo.io/ip

• Host proxy.your-domain.io:1080 was resolved.
• IPv6: (none)
• IPv4: 192.168.50.2
• Trying 192.168.50.2:1080...
• Connected to proxy.your-domain.io (192.168.50.2) port 1080
• CONNECT tunnel: HTTP/1.1 negotiated
• allocate connect buffer
• Proxy auth using Basic with user 'proxy-user'
• Establish HTTP proxy tunnel to ipinfo.io:443

CONNECT ipinfo.io:443 HTTP/1.1
Host: ipinfo.io:443
Proxy-Authorization: Basic cHJveHktdXNlcjpQYVNzdzByRA==
User-Agent: curl/8.7.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 OK
< Date: Tue, 20 May 2025 14:43:50 GMT
< Transfer-Encoding: chunked

• Ignoring Transfer-Encoding in CONNECT 200 response
  <
• CONNECT phase completed
• CONNECT tunnel established, response 200
• ALPN: curl offers h2,http/1.1
• (304) (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/ssl/cert.pem
• CApath: none
• (304) (IN), TLS handshake, Server hello (2):
• (304) (IN), TLS handshake, Unknown (8):
• (304) (IN), TLS handshake, Certificate (11):
• (304) (IN), TLS handshake, CERT verify (15):
• (304) (IN), TLS handshake, Finished (20):
• (304) (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
• ALPN: server accepted h2
• Server certificate:
• subject: CN=ipinfo.io
• start date: May 5 05:43:10 2025 GMT
• expire date: Aug 3 05:43:09 2025 GMT
• subjectAltName: host "ipinfo.io" matched cert's "ipinfo.io"
• issuer: C=US; O=Let's Encrypt; CN=R11
• SSL certificate verify ok.
• using HTTP/2
• [HTTP/2] [1] OPENED stream for https://ipinfo.io/ip
• [HTTP/2] [1] [:method: GET]
• [HTTP/2] [1] [:scheme: https]
• [HTTP/2] [1] [:authority: ipinfo.io]
• [HTTP/2] [1] [:path: /ip]
• [HTTP/2] [1] [user-agent: curl/8.7.1]
• [HTTP/2] [1] [accept: /]

GET /ip HTTP/2
Host: ipinfo.io
User-Agent: curl/8.7.1
Accept: /

• Request completely sent off
  < HTTP/2 200
  < date: Tue, 20 May 2025 14:44:18 GMT
  < content-type: text/plain; charset=utf-8
  < content-length: 15
  < access-control-allow-origin: *
  < via: 1.1 google
  < strict-transport-security: max-age=2592000; includeSubDomains
  < alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  <
• Connection #0 to host proxy.your-domain.io left intact
  176.125.235.101

[knylbyte]

I was able to fix the problem with the http-router in traefik. The healthcheck returns unhealthy, which is why traefik does not create an http-router. For now I have to disable the healthcheck.

[euzu]

@knylbyte the ip address is updated once at page load. İ did not expect that it needs to run multiple times. İ could add a refreh butron to ip settings. The stats are updated every x seconds.

I am little bit lost with all this logs you send me.
Can you give me a short overview what you expect now? I am not sure what is not working.

[knylbyte]

A refresh button would be nice.

The logs only show the changing public IP of my gluetun vpn container.
However, the requests are routed through the traefik tcp proxy. That's all I wanted to show.
Currently I cannot retrieve the public IP in the web Ui with the same settings as with curl. Only question marks are displayed and no errors or similar appear in the tuliprox log.

I hope the drawing makes it a bit clearer why it would be nice to verify the public IP for outgoing requests.

[donflix-tv]

Hi @knylbyte , does the proxy feature currently work as expected for you? If so, what type of proxy do you use? Based on my findings currently the socks5 proxy doesn't work at all and the http proxy does seem to work partly:

• Tuliprox is able to stream streams via the proxy
• Tuliprox is able to show the IPv4 address in Webui
• I'm unable to download/refresh playlists

[knylbyte]

Hi @knylbyte , does the proxy feature currently work as expected for you? If so, what type of proxy do you use? Based on my findings currently the socks5 proxy doesn't work at all and the http proxy does seem to work partly:

• Tuliprox is able to stream streams via the proxy
• Tuliprox is able to show the IPv4 address in Webui
• I'm unable to download/refresh playlists

Hi @donflix-tv, first I need to understand the configuration of this tool. Right now I am not able to do any further testing because I can't get my configuration to work. It is quite hard to understand all the configuration options and how they are related. But I can currently only test the http(s) proxy, because gluetun uses shaddowsocks and not socks5. But so far it works for me. I will report back when I have tested more.

[knylbyte]

Ok @donflix-tv , so I was able to test it a bit more intensively today and can confirm that I cannot retrieve more than the public IP address via the HTTP proxy. How did you manage to stream anyway? I can neither stream nor retrieve the background data/playlists. I can see from the logs from gluetun that there are no request other than the ipinfo.io.

[donflix-tv]

Last time I checked the SOCKS proxy didn't work (but that could also be caused by my SOCKS configuration (I haven't tested it much)), but the HTTP proxy does work correctly. The issue I initially had with it was caused by something else (in source.yml I configured an IPTV provider with HTTP URL instead of HTTPS).

Currently I don't use tuliprox's proxy functionality anymore, because the same can be done with Docker environment variables (e.g.):

    environment:
      - http_proxy=http://vpn-loadbalancer-1:8080
      - HTTP_PROXY=http://vpn-loadbalancer-1:8080  # optional, for tools that also check uppercase

The added advantage is that with configuring the proxy at Docker level you can also add some exclusions for the internal Docker network so certain traffic doesn't get routed through proxy. You can do that with no_proxy environment variable like so:

    environment:
      - no_proxy=localhost,127.0.0.1,other_docker_app

Hope this helps

[knylbyte]

@donflix-tv the socks5 proxy should be fixed. There was an missconfigured authentication method if your endpoint is an socks5 proxy.

@aniel300 the loadbalancing feature doesn't work for now. The frequently changed IP address results in a temporary ban. The solution would be to stick the requested user from your source list to the same upstream proxy for each request. But therefore we have to define a forward proxy pool directly into tuliprox und not at traefik level. Since today there are docker container templates and a guidline to deploy this setup.
What are sticky sessions?

@euzu could you image to implement this feature? and for real high availability the option to store all data into a real db like postgresql to support cluster setup? I'm aware it's a huge feature request just to be fair.

Planned Feature Details

• Proxy Pool Configuration
  • Single shared pool for HTTP/HTTPS and SOCKS5/SOCKS5H proxies defined in config.yml
  • Existing authentication handling in request.rs retained
  • Optional integer weight per proxy (1–10, default 10) for load distribution
• Health Checks
  • Reuse current IP checker to verify proxy health every 5 seconds (optional: interval configurable)
  • First failed check marks proxy offline; proxy remains offline until a successful check
  • Offline proxies are excluded from assignment but continue to be rechecked
• Sticky Sessions
  • Sessions keyed by unique user names from source.yml to the upstream proxy
    • we need an automatism to bind the requested user to the same proxy no matter which cluster node is requested -> docker overlay network
  • Persist assignments in a reboot‑proof B‑Tree database at /app/data/session.db or better we use a redis db
  • Assignment released if no request from the user for 24 hours
  • Uses weighted round‑robin among online uptream proxies; no fallback to direct connection if all proxies are offline
  • Reverse proxy in front of tuliprox has to use sticky sessions to tuliprox
• Round-Robin & Assignment Behavior
  • Only proxies marked online participate in selection
  • Offline proxies rejoin automatically once health checks succeed
  • Both HTTP/HTTPS and SOCKS5/SOCKS5H proxies are treated uniformly in the pool
• GUI Enhancements
  • New “Upstream Proxy” tab under Settings
  • Sections for HTTP, HTTPS, SOCKS5, and SOCKS5H proxies
  • Columns: scheme, user, password, host, port, status
  • “Add Proxy” button (top-right) and red “Delete” button per proxy
  • Overview shows real-time online/offline status; no extra logging
• Fallback Behavior
  • If all proxies are offline, outgoing requests fail rather than using a direct connection

[aniel300]

this post was in regards to load balancing/ clustering using 2 or more gluten instances?

[knylbyte]

gluten

This was the point where we have started.