Target restrictions

Which target addresses and ports are refused, the fixed hostname resolution behaviour, and the practical consequences of no UDP support.

The gateway checks the target address before opening the exit connection. This page lists what's refused, plus behaviours that aren't "restrictions" but will shape your design.

Refused addresses

The explicitly blocked CIDR ranges:

CIDR	Notes
`0.0.0.0/8`	Unspecified / this network
`100.64.0.0/10`	CGNAT shared address space
`127.0.0.0/8`	IPv4 loopback
`169.254.0.0/16`	IPv4 link-local (includes cloud metadata addresses)
`224.0.0.0/4`	IPv4 multicast
`::1/128`	IPv6 loopback
`fc00::/7`	IPv6 unique local addresses
`fe80::/10`	IPv6 link-local

Refused ports

Port	Notes
`25`	SMTP

Hostname resolution is pinned

Practical consequences:

The upside: your local DNS never sees the target domain (when using socks5h://), so you don't reveal what you're visiting.

Things to watch:

What you might expect	What actually happens
The domain resolves in the exit IP's region, giving you a nearby CDN node	Resolution happens at the gateway, not in the exit region
Multiple A records load-balance across IPs	Always the first IP
The target distributing content by resolver origin	Distribution follows the gateway's location, not the exit IP

If you need resolution in the exit region

Resolve client-side and connect by IP:

shell

# Resolve first (if you have a resolver in the exit region)
TARGET_IP=$(dig +short example.com | head -1)

# Connect by IP with the domain in the Host header
curl -x 'http://USER-country-US:PASS@GATEWAY_HOST:58971' \
  -H 'Host: example.com' \
  "http://${TARGET_IP}/"

For HTTPS you also have to handle SNI, which gets awkward. In most cases accepting the current behaviour is fine.

No UDP support

What you'll actually run into

When curl or a browser negotiates HTTP/3: it fails or falls back to HTTP/2. Pinning the version explicitly is more predictable:

shell

curl --http2 -x 'http://USER:PASS@GATEWAY_HOST:58971' https://example.com

Chrome enables QUIC by default: it usually disables QUIC when a proxy is configured, but you can turn it off explicitly:

shell

google-chrome --proxy-server="http://GATEWAY_HOST:58971" --disable-quic

WebRTC leaks your real IP: because UDP can't traverse, WebRTC attempts a direct connection. In anti-detect browsers, WebRTC must be set to "replace with proxy IP" or "disable", never "real". See Browsers and anti-detect browsers.

No inbound TLS

The gateway does not terminate TLS and has no TLS listener.

Extra restrictions in ordinary forward mode

Forward mode (http:// sites without CONNECT) has two additional rules:

Case	Result
An `https://` absolute URL in the request line	`400` — HTTPS must use CONNECT
Userinfo in the request line's URL (`http://u:p@host/`)	`400`

Headers are rewritten (forward mode only)

In ordinary HTTP forward mode these headers are removed:

Proxy-Authorization, Proxy-Connection
Every hop-by-hop extension header listed in Connection
Connection, Keep-Alive, Proxy-Authenticate, TE, Trailer, Transfer-Encoding

Plus: non-Upgrade requests are forced to Connection: close, and Host and Content-Length are rebuilt when necessary.

Once a CONNECT tunnel or SOCKS5 connection is established, the gateway does not parse the tunnel contents and none of the above applies. So fingerprint-sensitive work should use HTTPS/CONNECT or SOCKS5.

IPv6

Item	Status
IPv6 target addresses	Supported (both HTTP and SOCKS5 can parse them)
IPv6 client access	Depends on node and load balancer configuration; not guaranteed
Passwordless-port source binding	IPv4 only
IP whitelist	IPv4 only (public global unicast)

shell

# IPv6 target
curl -x 'http://USER:PASS@GATEWAY_HOST:58971' 'http://[2001:db8::1]/'

Quick triage

Symptom	Which rule on this page
`403` reaching an internal address	Private addresses blocked
`403` reaching `169.254.169.254`	Cloud metadata address blocked
SMTP won't connect	Port 25 blocked
HTTP/3 requests fail	No UDP support
WebRTC exposes the real IP	No UDP support; WebRTC must be disabled browser-side
SOCKS5 reply `0x07`	You're using UDP ASSOCIATE or BIND
CDN node not in the exit region	Hostname resolved at the gateway
An `https://` proxy URL won't connect	No inbound TLS
Can't whitelist an IPv6 address	The whitelist is IPv4 only

Full error codes in the error reference.

More in this section