I am wanting to create a network interface from a SOCKS 5 proxy on localhost. This will eventually be bridged with a wireless interface that I have which will be operating in AdHoc mode. This will allow all the clients on this interface to use the socks proxy even though they don't have support for SOCKS. This will support my iDevices, PSP, etc, when I am on the go. It will be ran off of my laptop. Can anyone provide some useful resources in which will help me get a SOCKS proxy interface setup on my Ubuntu machine? Thanks in advance!

3 Answers 3


You need tun2socks, it is part of BadVPN project (https://github.com/ambrop72/badvpn). There is already an answer here recommending tun2socks, but it lacks examples.

You can either build tun2socks from source or install precompiled package. For example, in Ubuntu:

sudo add-apt-repository ppa:hda-me/badvpn-tun2socks
sudo apt-get update
sudo apt-get install badvpn-tun2socks

ip tuntap add dev tun1 mode tun user nobody
ifconfig tun1 up

# --netif-ipaddr is not a typo.
# It specifies the IP address of the virtual router inside the TUN device,
# and must be different than the IP of the TUN interface itself.
# This command assumes you have tor up and running on
# Of course, you can use any other SOCKS proxy instead.
badvpn-tun2socks --tundev tun1 --netif-ipaddr --netif-netmask --socks-server-addr

Next, you need to decide if you want to route all traffic via proxy, or just traffic to some specific IPs or hosts. If you have such a list (or can create one with reasonable amount of effort), this is the most efficient solution.

# Here list of hosts or IPs to route through proxy is just an example.
# You need to specify your own list.
for IP in $(echo $list_of_IPs_to_route_via_proxy); do
  route add $IP gw; done

If you need to route all traffic via proxy, it will be a bit more complicated. In this case I suggest to carefully read https://github.com/ambrop72/badvpn/wiki/Tun2socks. Official documentation assumes you want to use localhost:1080 as your proxy, and gives instructions how to create local SOCKS server with SSH dynamic forwarding. Most important part of the documentation:

Connect to the SSH server, passing -D localhost:1080 to the ssh command to enable dynamic forwarding. This will make ssh open a local SOCKS server which badvpn-tun2socks will use. If you use Putty, go to Connection->SSH->Tunnels, type 1080 in Source port, choose Dynamic and click Add.

All that remains is to route connections through the TUN device instead of the existing default gateway. This is done as follows:

Add a route to the SSH server through your existing gateway, with a lower metric than the original default route. If your DNS servers are in the Internet (rather than your local network), also add routes for them (like for the SSH server). This is needed because tun2socks does not forward UDP by default (see below). Add default route through the virtual router in the TUN device, with a lower metric than the original default route, but higher than the SSH and DNS routes.

This will make all external connections go through the TUN device, except for the SSH connection (else SSH would go through the TUN device, which would go through... SSH).

For example (assuming there are no existing default routes with metric <=6; otherwise remove them or change their metrics), in Linux:

route add <IP_of_SSH_server> gw <IP_of_original_gateway> metric 5 <same for DNS>
route add default gw metric 6

The documentation also have examples for using tun2socks for UDP forwarding, how to route all traffic through Tor, how to get IPv6 support.


Of course it's possible! Check the following link:


  • 2
    Please quote the essential parts of the answer from the reference link, as the answer can become invalid if the linked page changes or the target site is unreachable/permanently offline.
    – DavidPostill
    Commented Dec 18, 2014 at 14:38

You can't do this, because SOCKS doesn't operate at a low enough layer – it can only proxy TCP connections, not raw IP packets. This would be required to set up routing, with or without NAT; but bridging (as in brctl) requires even more – the ability to send raw Ethernet frames.

You should look into VPNs instead – OpenVPN is fairly simple to set up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .