Dante 1.4 Server Chaining Supports TCP CONNECT Only

Dante server chaining supports TCP CONNECT with specific credential and load constraints. Check that contract before treating it as a complete SOCKS5 path.

Dante 1.4 server chaining does not preserve the whole SOCKS5 command set. Its manual supports upstream selection through route blocks, using the client configuration's routing syntax, with three constraints worth settling first:

  • Command: chaining supports TCP CONNECT. A successful browser request does not establish UDP ASSOCIATE or BIND, even if another operation in the same application needs them.
  • Identity: when the upstream route offers username/password authentication, Dante forwards the credentials received from its own client. That differs from assigning a separate upstream service account.
  • Load: the manual documents limited scalability and recommends this facility only for small client loads.

Accept the identity flow explicitly. Trust in the incoming client connection does not establish encrypted transport for credentials sent to the next proxy.

Define the permitted clients, TCP destinations and intended load as the chain's actual contract. If the application requires UDP, check UDP association and datagram delivery across a complete path rather than assuming the standalone server's SOCKS5 label covers the chained route.

Related articles