Set Up a Dante SOCKS5 Proxy Server on Debian

SOCKS5 proxies are highly practical and secure for network access. This article details how to configure a SOCKS5 proxy server with dante on a Debian system.

1. Install the Dante Server

First, update the package index and upgrade installed software:

apt update
apt upgrade

Then install the dante-server package:

apt install dante-server

On Debian 13, you may get an error saying the package can't be found (Error: Unable to locate package dante-server); you'll need to install it manually:

wget http://ftp.debian.org/debian/pool/main/d/dante/dante-server_1.4.4+dfsg-1+b1_amd64.deb

Then install it manually:

apt install ./dante-server_1.4.4+dfsg-1+b1_*.deb

2. Configure the Dante Service

1. Back up and create a new config file

To avoid misconfiguration making the service unusable, back up the original config file first:

cp /etc/danted.conf /etc/danted.conf_orig
rm /etc/danted.conf

Create the new config file with the nano editor:

nano /etc/danted.conf

2. Config file contents

Enter the following in the opened file, and remember to replace eth0 with your server's actual network interface name:

logoutput: syslog
user.privileged: root
user.unprivileged: nobody

# listening network interface and port
internal: 0.0.0.0 port=1080

# proxy network interface or address
external: eth0

# proxy authentication method
socksmethod: username

# client connection rules
clientmethod: none

client pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
}

socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
}

3. Add an authentication user

Create a dedicated user for the proxy service and set its password:

useradd -r -s /bin/false proxy_user
passwd proxy_user

4. Restrict access to specific IPs (optional)

If you only want to allow specific IPs to connect to the proxy, modify the client pass rule in the config file, replacing xxx.111.xxx.222 with the allowed IP address:

client pass {
    from: xxx.111.xxx.222/0 to: 0.0.0.0/0
}

3. Configure Firewall Rules

1. Using iptables

Allow TCP traffic on port 1080 in both directions:

iptables -I INPUT -p tcp --dport 1080 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 1080 -j ACCEPT

# save the rules
service iptables save

2. Using ufw

ufw allow 1080

4. Restart and Verify the Service

1. Restart the dante service

systemctl restart danted.service

2. Check the service status

systemctl status danted.service

Normally, the service should show as active and running:

● danted.service - SOCKS (v4 and v5) proxy daemon (danted)
     Loaded: loaded (/lib/systemd/system/danted.service; enabled; preset: enabled)
     Active: active (running)

5. Client Connection Test

1. Test with curl

curl -v -x socks5://proxy_user:password@xxx.123.xxx.123:1080 http://google.com

If the connection succeeds, you'll see output similar to:

* Trying xxx.123.xxx.123:1080...
* Connected to xxx.123.xxx.123 (xxx.123.xxx.123) port 1080 (#0)
* SOCKS5 connect to IPv4 64.233.165.106:80 (locally resolved)
* SOCKS5 request granted.

2. Browser configuration

Using Firefox as an example, go to “Settings”->”Network Settings”, choose “Manual proxy configuration”, enter the server IP in “SOCKS Host”, set the port to 1080, select the “SOCKS5” protocol, and check “Use this proxy for all protocols”.

With the steps above, you can successfully configure a dante SOCKS5 proxy server on Debian. In practice, you can further adjust the access rules and security settings as needed.