# How to Set Up a SOCKS5 Proxy Server With Dante on Debian
A SOCKS5 proxy gives you a flexible, protocol-agnostic way to route traffic through a remote server. Unlike an HTTP proxy, SOCKS5 handles any TCP-based traffic, making it useful for web browsing, API access, SSH tunneling, and application-level routing. Among the available open-source implementations, **Dante** is one of the most established and reliable choices for Linux.
This guide walks through installing and configuring a Dante SOCKS5 proxy server on a Debian system, from package installation through authentication, firewall configuration, and end-to-end client testing.
## Why Choose Dante for a SOCKS5 Proxy
Dante is a mature, production-grade SOCKS server that supports both SOCKS4 and SOCKS5 protocols. It offers username and password authentication, flexible access control rules based on source and destination addresses, and logging via syslog. Because it runs as a standard systemd service, it integrates cleanly with Debian’s service management and boots automatically when configured.
For anyone who needs a self-hosted proxy — whether for privacy, geographic access, or routing application traffic through a specific IP — Dante provides a lightweight solution that uses minimal system resources.
## Prerequisites
Before starting, you will need:
– A Debian-based server (Debian 12 or 13) with root or sudo access
– A public IP address on the server’s network interface
– Basic familiarity with the command line
## Step 1: Install the Dante Server
First, update the system package index and upgrade any existing packages to their latest versions:
“`bash
apt update
apt upgrade
“`
Then install the `dante-server` package:
“`bash
apt install dante-server
“`
### Handling the Debian 13 Package Issue
On Debian 13, the standard `apt install dante-server` command may fail with an error:
“`
Error: Unable to locate package dante-server
“`
When this happens, you can download the package directly from the Debian FTP mirror and install it manually. Fetch the `.deb` file with `wget`:
“`bash
wget http://ftp.debian.org/debian/pool/main/d/dante/dante-server_1.4.4+dfsg-1+b1_amd64.deb
“`
Then install the downloaded package locally:
“`bash
apt install ./dante-server_1.4.4+dfsg-1+b1_*.deb
“`
This pulls the binary directly from Debian’s package pool and installs it using `apt`, which automatically resolves any dependencies.
## Step 2: Back Up and Create the Configuration File
Dante’s main configuration lives in `/etc/danted.conf`. Before making changes, back up the original file so you can restore it if something goes wrong:
“`bash
cp /etc/danted.conf /etc/danted.conf_orig
rm /etc/danted.conf
“`
Now create a fresh configuration file using `nano` (or your preferred editor):
“`bash
nano /etc/danted.conf
“`
### Configuration File Contents
Paste the following into the file. **Important:** replace `eth0` with the actual network interface name on your server — you can find it by running `ip a` or `ifconfig`.
“`
logoutput: syslog
user.privileged: root
user.unprivileged: nobody
# Listen interface and port
internal: 0.0.0.0 port=1080
# Outgoing network interface
external: eth0
# Authentication method
socksmethod: username
# Client connection rules
clientmethod: none
client pass {
from: 0.0.0.0/0 to: 0.0.0.0/0
}
socks pass {
from: 0.0.0.0/0 to: 0.0.0.0/0
}
“`
Here is what each section does:
– **`internal: 0.0.0.0 port=1080`** — Tells Dante to listen on all interfaces on port 1080. This is the port clients will connect to.
– **`external: eth0`** — Specifies the network interface Dante uses to forward traffic out to the internet.
– **`socksmethod: username`** — Requires username and password authentication for SOCKS connections.
– **`client pass` / `socks pass`** — Access rules that allow connections from and to any IP address. You can tighten these for better security (see below).
## Step 3: Create a Proxy Authentication User
Since the configuration requires username-based authentication, create a dedicated system user for the proxy service. This user will have no shell access, making it safe for proxy authentication purposes:
“`bash
useradd -r -s /bin/false proxy_user
passwd proxy_user
“`
The `-r` flag creates a system account, and `-s /bin/false` prevents shell login. When clients connect to the proxy, they will authenticate using the username `proxy_user` and the password you set.
## Step 4: Restrict Access to Specific IPs (Optional)
For better security, you can limit which IP addresses are allowed to connect to your proxy. Modify the `client pass` rule in `/etc/danted.conf` to replace `0.0.0.0/0` with a specific allowed IP address (substitute your own IP for `xxx.111.xxx.222`):
“`
client pass {
from: xxx.111.xxx.222/0 to: 0.0.0.0/0
}
“`
This ensures that only connections originating from the specified IP can reach the proxy, blocking all other inbound attempts.
## Step 5: Configure Firewall Rules
Dante listens on port 1080, so your firewall must allow TCP traffic on that port. The method depends on which firewall tool you use.
### Using iptables
Allow incoming and outgoing TCP traffic on port 1080:
“`bash
iptables -I INPUT -p tcp –dport 1080 -j ACCEPT
iptables -I OUTPUT -p tcp –sport 1080 -j ACCEPT
# Save the rules so they persist across reboots
service iptables save
“`
### Using UFW
If you use Uncomplicated Firewall (UFW), the command is simpler:
“`bash
ufw allow 1080
“`
Without an open port rule, client connections to the proxy will time out or be refused regardless of whether Dante is running.
## Step 6: Restart and Verify the Service
After saving your configuration file, restart the Dante service to apply the changes:
“`bash
systemctl restart danted.service
“`
Then check the service status:
“`bash
systemctl status danted.service
“`
If everything is configured correctly, you should see output indicating the service is active and running:
“`
● danted.service – SOCKS (v4 and v5) proxy daemon (danted)
Loaded: loaded (/lib/systemd/system/danted.service; enabled; preset: enabled)
Active: active (running)
“`
If the status shows a failure, check the configuration file for syntax errors and review the logs with `journalctl -u danted.service`.
## Step 7: Test the Proxy From a Client
### Testing With curl
The fastest way to verify your proxy works is with `curl`. Run the following command from any machine, replacing `proxy_user`, `password`, and the server IP with your actual credentials and server address:
“`bash
curl -v -x socks5://proxy_user:password@xxx.123.xxx.123:1080 http://google.com
“`
A successful connection produces output similar to:
“`
* Trying xxx.123.xxx.123:1080…
* Connected to xxx.123.xxx.123 (xxx.123.xxx.123) port 1080 (#0)
* SOCKS5 connect to IPv4 64.233.165.106:80 (locally resolved)
* SOCKS5 request granted.
“`
If you see “SOCKS5 request granted,” the proxy is functioning correctly and forwarding traffic as expected.
### Configuring a Browser (Firefox Example)
To route your web browsing through the proxy, configure your browser. In Firefox:
1. Open **Settings** → **Network Settings**.
2. Select **Manual proxy configuration**.
3. In the **SOCKS Host** field, enter your server’s IP address.
4. Set the **Port** to `1080`.
5. Select **SOCKS5** as the protocol.
6. Check **Proxy DNS when using SOCKS v5** for privacy.
7. Click **OK** to save.
Your browser traffic will now route through the Dante proxy server.
## Security Best Practices
Running an open proxy carries real risks. A misconfigured or unauthenticated proxy can be abused by third parties to relay spam, hide malicious activity, or consume your bandwidth. To keep your setup secure:
– **Always enable authentication.** The `socksmethod: username` setting ensures only authorized users can connect.
– **Restrict access by IP when possible.** If you connect from a fixed IP, use the `client pass` rule to whitelist only that address.
– **Use a strong password** for the proxy user account. Avoid dictionary words and common patterns.
– **Monitor your logs.** Dante logs to syslog, so check `/var/log/syslog` or use `journalctl` to watch for unusual connection attempts.
– **Keep the system updated.** Run `apt update && apt upgrade` regularly to apply security patches to Dante and the underlying system.
## Risk and Recency Note
This guide reflects Dante server setup instructions on Debian as of mid-2025. Package availability, version numbers, and configuration syntax may change with future Debian releases. If `apt install dante-server` fails, verify the current package name and version in the Debian package repository before downloading any `.deb` file manually. Always test your proxy configuration in a controlled environment before deploying it for production use.
## Summary
Setting up a SOCKS5 proxy with Dante on Debian is a straightforward process: install the package (handling the Debian 13 manual install case if needed), write a clean `danted.conf` configuration with authentication, create a dedicated proxy user, open port 1080 in your firewall, and verify the service with `curl` or a browser. With proper access controls and monitoring, a self-hosted Dante proxy gives you a reliable, controllable way to route network traffic through your own server.
