# HTTP, HTTPS and SOCKS5, and exactly what the gateway does with each.

Standard protocols, no custom client. This page is the precise behaviour for people who need to know what happens on the wire.


## Cheat sheet

| Target | Proxy URL in your client | Port |
| --- | --- | --- |
| `http://` and `https://` URLs | http://USER:PASS@res.hodlproxy.com:9000 | 9000 |
| Anything over TCP, hostname resolved at the exit | socks5h://USER:PASS@res.hodlproxy.com:9001 | 9001 |
| Same, hostname resolved by your machine | socks5://USER:PASS@res.hodlproxy.com:9001 | 9001 |
| Dedicated address, HTTP(S) | http://USER:PASS@203.0.113.42:8000 | 8000 |
| Dedicated address, SOCKS5 | socks5h://USER:PASS@203.0.113.42:8001 | 8001 |


## HTTP

For a plain `http://` target your client sends the request with an absolute URI and a `Proxy-Authorization` header to port 9000. The gateway strips that header, relays the request through the exit and streams the response back. HTTP/1.1 with keep-alive is supported; a kept-alive connection keeps its exit (see [rotation](https://hodlproxy.com/docs/username-parameters#rotation-and-sessions)).


## HTTPS

For an `https://` target the client sends `CONNECT host:443` and the gateway opens a raw tunnel from the exit. The TLS handshake happens between your client and the target through that tunnel: the gateway never decrypts, inspects or re-signs anything, and the certificate you verify is the target's own. HTTP/2 and HTTP/3-over-TCP fallbacks negotiated inside the tunnel work as they would directly.


## SOCKS5

- RFC 1928 with username/password authentication (RFC 1929) or no authentication from a whitelisted address.
- `CONNECT` to any TCP port except 25. `BIND` and `UDP ASSOCIATE` are not supported: no UDP, no inbound connections.
- Send the hostname (address type 0x03) so the exit resolves it: that is what `socks5h://` means in curl, Python and Node. If your client resolves locally and sends an IP, the request still works but the DNS lookup happened on your side.
- Choose SOCKS5 for non-HTTP TCP protocols and for clients that only speak SOCKS; for web traffic the HTTP port is equivalent.


## Headers

The gateway removes `Proxy-Authorization` and `Proxy-Connection` and adds nothing: no `Via`, no `X-Forwarded-For`, no `X-Real-IP`. What the target receives is your request as the exit device would send it, which is the point of the network. Set `User-Agent`, `Accept-Language` and the rest to match the exit's country yourself.


## Not supported

- UDP in any form (QUIC falls back to TCP in every browser when a proxy is configured).
- IPv6 targets: exits are IPv4.
- TLS to the proxy port itself (`https://` as the **proxy** scheme). The hop to the gateway is plain; see [Endpoints](https://hodlproxy.com/docs/endpoints#https-targets).
- FTP, SMTP on port 25, and protocols that require the proxy to open a connection back to you.


Source: https://hodlproxy.com/docs/protocols