Originally published on proxymint.
Run curl through a proxy with -x: credentials and encoding, socks5 vs socks5h, env vars, --noproxy, timing with -w, and what exit codes 5, 7 and 97 mean.
TL;DR
- curl takes a proxy with -x. The form is -x scheme://host:port; no scheme means an HTTP proxy, and socks4, socks4a, socks5 and socks5h pick a SOCKS version.
- Write the port every time. The manual says a proxy without a port is on 1080, but curl 8.21.0 dialled port 80 for an http:// proxy with no port in a local test.
- HTTPS sites go through a CONNECT tunnel. The proxy URL stays http://, curl sends CONNECT host:443, and TLS runs end to end with the site inside the tunnel.
- socks5h resolves at the proxy, socks5 does not. With socks5:// the DNS lookup leaves from your own machine; with socks5h:// the proxy resolves the hostname.
- %{remote_ip} is the proxy, not the exit. Confirm the exit with an IP echo endpoint through the proxy, and compare the country, not just the address.
Key takeaways
- Run the five-command test before writing code. Reach, authenticate, tunnel, check the exit, time it, and stop at the first step that fails.
- Keep credentials in -U or percent-encode them. Encode @ as %40 and : as %3A in URL form, and strip the Proxy-Authorization line from any verbose log you share.
- Test rotation with separate curl calls. One command reuses its connection, so only separate invocations show whether the exit changes.
- Add -f to scripts. A 407 on a plain HTTP target exits 0 without it, so a script that checks only the exit code carries on through a failed login.
- Compare medians of 20 runs. Time the proxy and the direct path the same way with -w and read the median, never a single run.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)