proxychains-ng SOCKS5 Proxy Setup and Troubleshooting

proxychains-ng ships a launcher, proxychains4, and a library it preloads into the program you name. Per the project README, it hooks network-related libc functions in dynamically linked programs through LD_PRELOAD and redirects their TCP connections through SOCKS4a, SOCKS5 or HTTP proxies. Each connect() call becomes a tunnel, so the program needs no proxy setting.

For Databay the list holds one entry: gw.databay.co on port 8888, a single endpoint for HTTP proxying, HTTPS CONNECT tunnelling and SOCKS5, with the username and password issued in the Databay dashboard. Product, country and session choices live in that username. Use the socks5 type: it carries RFC 1929 username and password authentication and can pass destination hostnames to the gateway.

Route traffic only to destinations you own or are permitted to access, and follow each destination's terms. The README says to confirm proxychains works as expected before relying on it.

The README and the Debian proxychains4(1) manual page give the lookup order; the first readable file wins:

1. A file named in the PROXYCHAINS_CONF_FILE environment variable or passed with -f.
2. ./proxychains.conf in the current directory.
3. $HOME/.proxychains/proxychains.conf.
4. $(sysconfdir)/proxychains.conf, usually /etc/proxychains.conf. Debian then also checks /etc/proxychains4.conf, the file its package installs.

Always pass -f for Databay work, so a stray ./proxychains.conf cannot take over. Unless -q is set, the launcher's first line, [proxychains] config file found: PATH, names the file in use. Check it on new hosts: in the 4.17 source, an unreadable -f path is skipped and the search continues, so a typo can load the shipped sample instead.

The sample proxychains.conf documents four chain modes. Leave exactly one uncommented; otherwise the last one wins.

One strict hop keeps evidence attributable: each chain line names one gateway address and one destination, so an observed exit maps to one username.

The sample defines each entry as type ip port [user pass], separated by spaces or tabs, and states that only numeric IPv4 addresses are valid. The 4.17 parser accepts a hostname only for a proxy that is not first in a strict chain with proxy_dns on, so a one-line chain naming gw.databay.co stops with proxy gw.databay.co has invalid value or is not numeric. Resolve the hostname when you generate the file:

strict_chain
proxy_dns
remote_dns_subnet 224
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5  GATEWAY_IP  8888  USER-zone-residential-countryCode-us  PASS

If you edit a copy of the shipped sample, delete its default socks4 127.0.0.1 9050 Tor entry, or strict mode chains through it. The http type can reach HTTPS destinations through a Basic-authenticated CONNECT, but it reports every non-200 answer, 407 included, as denied, while socks5 reserves denied for authentication. Avoid the socks5://user:pass@ip:port form added in 4.14; it puts the password in a URL-shaped string.

RFC 1928 lets a SOCKS5 request name the destination by address or by domain. With proxy_dns, a lookup for api.ipify.org returns a placeholder from the remote_dns_subnet range, 224.x.x.x by default; when the program connects to it, proxychains-ng sends the saved name and the gateway resolves it. A 224.x.x.x address in curl -v output is that placeholder.

Without it, your local resolver answers outside the proxy path, and the gateway sees only the address your network picked. The sample's "no leak for DNS data" label covers lookups through the hooked libc functions, not a program's own UDP resolver.

Of the alternatives, proxy_dns_old needs proxyresolv and a dynamically linked dig in $PATH, and proxy_dns_daemon hangs the program unless proxychains4-daemon is running. Enable one method. localnet exclusions, such as 127.0.0.0/255.0.0.0 for a program that also uses a local service, match only numeric addresses, /etc/hosts names, or setups with proxy_dns off or proxy_dns_old.

The file stores the password in clear text. Keep it out of /etc/proxychains4.conf and other system files local accounts can usually read, and never commit it. Inject the credential from a secret store and let the job write, use and delete a private file:

#!/bin/sh
set -eu
umask 077
# SOCKS5 fields are whitespace-delimited and limited to 255 bytes.
LC_ALL=C
export LC_ALL
: "${DATABAY_PROXY_USER:?DATABAY_PROXY_USER is missing}"
: "${DATABAY_PROXY_PASS:?DATABAY_PROXY_PASS is missing}"
case "$DATABAY_PROXY_USER$DATABAY_PROXY_PASS" in
  *[[:space:]]*) echo 'proxychains credentials cannot contain whitespace; use native proxy support' >&2; exit 1 ;;
esac
if [ "${#DATABAY_PROXY_USER}" -gt 255 ] || [ "${#DATABAY_PROXY_PASS}" -gt 255 ]; then
  echo 'SOCKS5 credentials exceed 255 bytes; use a supported credential' >&2
  exit 1
fi
# Linux (glibc). macOS: dig +short A gw.databay.co | grep -E '^[0-9.]+$' | head -n 1
GW_IP="$(getent ahostsv4 gw.databay.co | awk 'NR==1 {print $1}')"
[ -n "$GW_IP" ] || { echo 'gateway lookup failed' >&2; exit 1; }

DIR="$(mktemp -d)"
trap 'rm -rf "$DIR"' EXIT
CONF="$DIR/proxychains.conf"
printf '%s\n' strict_chain proxy_dns 'remote_dns_subnet 224' \
  'tcp_read_time_out 15000' 'tcp_connect_time_out 8000' '[ProxyList]' > "$CONF"
printf 'socks5 %s 8888 %s %s\n' "$GW_IP" \
  "$DATABAY_PROXY_USER" "$DATABAY_PROXY_PASS" >> "$CONF"
unset DATABAY_PROXY_USER DATABAY_PROXY_PASS

proxychains4 -f "$CONF" curl --disable --noproxy '*' -sS --max-time 20 'https://api.ipify.org?format=json'

The space-separated config format cannot quote or escape whitespace inside a credential. Reject it before writing the file: otherwise the parser can truncate a value, read a new line as another proxy, or echo a malformed line with its password. The script also checks the SOCKS5 255-byte limit and prints only a generic error; do not trim or percent-encode a password to make it fit. Use a client with native proxy support if the issued credential does not fit this format.

Both timeouts are milliseconds and cover only proxychains-ng's work: tcp_connect_time_out bounds the TCP connection to the gateway, and tcp_read_time_out bounds each wait for a gateway reply, including the reply sent after the gateway reaches the destination. After the chain reports OK, the program's own limits, such as curl's --max-time, apply.

quiet_mode silences the library; -q also hides the launcher's lines. Keep both off until verification passes: the chain lines on standard error are your evidence and carry no credentials, unlike the startup error for a malformed [ProxyList] line, which echoes it in full. Keep the file, environment and set -x traces out of screenshots and shared logs.

The script ends with one request to a neutral IP echo endpoint. Quote the URL, since zsh, the default macOS shell, treats an unquoted ? as a glob. Expected output on Debian amd64 has this shape; this is an illustrative template, not a recorded live run:

[proxychains] config file found: /tmp/tmp.Q2mXk1/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  GATEWAY_IP:8888  ...  api.ipify.org:443  ...  OK
{"ip":"OBSERVED_EXIT_IP"}

• config file found must name your generated file.
• DLL init means the library loaded; without it (quiet mode off), curl ran unhooked and went direct.
• Strict chain ... OK shows one gateway hop, then the destination by name; a numeric destination means local resolution.
• The JSON body is the observed exit, which must differ from a run without proxychains4.

On macOS, System Integrity Protection prevents hooking system binaries such as /usr/bin/curl; use a curl you installed rather than weakening SIP. Make sure curl has no proxy of its own in the environment or .curlrc. A second observer is https://databay.com/what-is-my-ip/json or the What Is My IP page. Record the time, username and exit; it is one connection's observed exit, not proof of anonymity, as the proxy anonymity levels guide explains.

Each TCP connection the program opens becomes a new gateway connection, which may select a different available exit. For continuity, use a session username such as USER-zone-residential-countryCode-us-sessionId-abc123, and request up to 1440 minutes on Premium Residential or Residential Flex where available. Datacenter and Mobile accept up to 120 minutes. The IP can change earlier, so re-check the exit at checkpoints. Premium Residential targets one of country, state, city, ZIP, coordinate or ASN at a time; Residential Flex, Datacenter and Mobile target country or continent. Pools are shared, so copy the complete username the dashboard shows.

The README and the Debian page document where preloading fails:

• Statically linked binaries never load the library.
• UDP and ICMP are not redirected, so QUIC, a program's own UDP DNS queries and ping take the normal path; the Databay gateway carries no UDP either.
• Nonstandard networking: support assumes standard libc functionality, and pcap-based scanning does not work.
• Scripts and modules: scripts, programs that spawn background daemons, and C modules loaded with dlopen() may not work; a glibc dynamic-linker behavior mainly affects Perl and Python (musl libc is unaffected).
• setuid and setgid programs need root, per the Debian page.
• macOS system binaries are protected by SIP.

For these, use native proxy support: cURL takes --proxy socks5h://gw.databay.co:8888 directly (see the cURL proxy setup guide), and Python work fits the Requests or Scrapy integration. The README calls an iptables-based setup more robust for programs that resist preloading.

The program's own error is a weak guide: in the 4.17 source, the connect hook reports every failed chain as a refused connection. Read the core.c chain messages and fix the first line that differs from a passing run.

A DNS timeout can sit on either side: with proxy_dns off, a blocked local resolver fails before any chain line; with it on, a failed gateway-side lookup appears as <--socket error or timeout!. The HTTP versus SOCKS5 guide explains who resolves names.