SOCKS5 Proxies on a Router and Raspberry Pi

Check compatibility

Make sure your router model is supported by OpenWrt and install the firmware following the instructions on the project's official site. This is the most critical step — stock firmware won't work.

Install redsocks

Connect to the router over SSH and install the package:

opkg update
opkg install redsocks iptables-mod-nat-extra

Enter the proxy credentials

Open the redsocks configuration and substitute your host, port, login, and password:

redsocks {
  local_ip = 0.0.0.0;
  local_port = 12345;
  ip   = HOST;
  port = PORT;
  type  = socks5;
  login    = "LOGIN";
  password = "PASSWORD";
}

Route traffic through redsocks

Add an iptables rule that sends outgoing TCP traffic to the local redsocks port:

iptables -t nat -A PREROUTING -p tcp \
  -j REDIRECT --to-ports 12345

Restart and verify

Restart redsocks, then from any device on the network open an IP-check service. It should show the proxy address, not your home one.

Prepare the system

Install a fresh Raspberry Pi OS and update the packages with sudo apt update && sudo apt upgrade.

Install the tools

Install the packages you need depending on the setup you choose:

sudo apt install redsocks proxychains4

Transparent gateway via redsocks

Configure /etc/redsocks.conf with your credentials and forward TCP traffic through iptables — this way all traffic from devices for which the Raspberry Pi is the gateway will go through the proxy:

iptables -t nat -A PREROUTING -i eth0 \
  -p tcp -j REDIRECT --to-ports 12345

Individual commands via proxychains

If you don't need a gateway, add the proxy to /etc/proxychains4.conf and run any commands through it:

# /etc/proxychains4.conf
socks5  HOST  PORT  LOGIN  PASSWORD

# run
proxychains4 curl https://ifconfig.me

Verify the route

Run an IP check. The output should show your static Pure Connect proxy address. DNS requests go through a protected route, so your real address is not revealed.