Elusive
Sign In
Blog

QUIC Over SOCKS5: Does HTTP/3 Work Through a Proxy?

QUIC over SOCKS5 needs UDP ASSOCIATE. See which clients support it, what browsers do instead and when you actually need HTTP/3 through a proxy.

5 min read

QUIC runs on UDP, so HTTP/3 over a SOCKS5 proxy needs the proxy to support UDP ASSOCIATE, and the client to use it. Most HTTP clients don't. curl, Chrome and Firefox all fall back or refuse.

For most work this is fine, because the browser quietly uses HTTP/2 over TCP through the proxy. You only need real QUIC through a proxy in a few cases, covered below.

Key takeaways

  • HTTP/3 is HTTP on top of QUIC, and QUIC is UDP. SOCKS5 carries UDP only through the UDP ASSOCIATE command.
  • curl, Chrome and Firefox do not send HTTP/3 through a SOCKS5 proxy. Browsers load the page over HTTP/2 instead.
  • Libraries that let you plug in your own UDP socket can do it, if you write the SOCKS5 UDP part.
  • You need two things: a proxy with UDP, and a client that sends UDP ASSOCIATE.
  • Check the proxy first with the SOCKS5 UDP test.

Why QUIC needs UDP ASSOCIATE

SOCKS5 has three commands in RFC 1928. CONNECT opens a TCP tunnel. BIND is for incoming TCP. UDP ASSOCIATE sets up a relay for UDP packets.

Normal web traffic through a proxy uses CONNECT. QUIC (RFC 9000) can't use it, because a TCP tunnel can't carry QUIC's UDP packets. A client has to open the UDP relay, wrap each QUIC packet in the SOCKS UDP header and send it to the relay address.

That is extra work in the client, and few clients do it. The proxy side matters too. Many SOCKS5 servers only handle CONNECT. See does SOCKS5 support UDP for the server side.

What each client does

This list comes from public docs and bug trackers. Versions change, so check the current state before you build on it.

  • curl: does not support it. Asked for HTTP/3 with a SOCKS5 proxy, it fails with "HTTP/3 is not supported over a SOCKS proxy". The maintainer said in curl issue 7533 that nobody had implemented it.
  • Chrome: Chromium's proxy docs say SOCKSv5 is only used for TCP-based requests and cannot relay UDP. In practice pages load over HTTP/2 or HTTP/1.1. We found no Chromium doc that spells out exactly how QUIC is skipped, so test your version.
  • Firefox: its SOCKS layer has no UDP. A developer wrote in Mozilla bug 1882018 that "our SOCKS proxy layer does not support UDP traffic". The report shows a site loading over HTTP/2 instead of HTTP/3 with SOCKS5 on. The bug was closed as a duplicate of bug 1808692, "SOCKS implementation does not support UDP".
  • quic-go (Go): its quic.Transport takes any net.PacketConn as its connection, and the HTTP/3 transport can be given a custom dial function that uses it. So a SOCKS5 UDP wrapper that acts like a net.PacketConn could carry QUIC. quic-go does not ship that wrapper and its docs don't mention SOCKS. You write or find the UDP part yourself.
  • httpcloak: a Go HTTP client that imitates browser fingerprints. Its README says HTTP/3 works through SOCKS5 UDP ASSOCIATE or MASQUE. We read that claim in the README but did not run it, so test it with your own proxy.

For more on using SOCKS5 from code, see SOCKS5 in Python, Node and Go.

What happens in practice

Set a SOCKS5 proxy in Chrome or Firefox and open an HTTP/3 site. The page loads. The browser uses HTTP/2 over TCP through the proxy, because that is the only path SOCKS5 gives it.

You won't see an error. You also won't see HTTP/3 in the network tab. For browsing, scraping and account work, HTTP/2 is fine and the site works the same.

One detail to know: the fingerprint of that connection is HTTP/2, not HTTP/3. A browser that normally upgrades to HTTP/3 will not do so through the proxy. That's normal for any browser on a SOCKS5 proxy.

When you actually need QUIC through a proxy

  • Testing HTTP/3 from another location. You want to see how your site or CDN behaves over QUIC for a user in a given country.
  • Apps that only speak QUIC. Some clients and services have no TCP fallback.
  • Matching real browser behavior in a tool you control, when a library lets you choose HTTP/3.
  • Measuring. Comparing HTTP/2 and HTTP/3 timing from the same exit.

If your job is none of these, skip it.

What you need

  1. A proxy that supports UDP. Not every Elusive proxy does. Some support UDP through SOCKS5 UDP ASSOCIATE, the catalog marks them and you can filter for them. On Static ISP, UDP is offered in the US, Canada, Germany, the UK and the Netherlands. See the catalog.
  2. A client that sends UDP ASSOCIATE. A library with a pluggable UDP socket, or a tool that says it supports it.
  3. A UDP check before you commit. Run the UDP test script. If the proxy returns reply code 0x07, read UDP ASSOCIATE command not supported.

Test right after you buy. A Sticky proxy can be refunded to the balance only in its first hour, and only if it is offline or its IP or location does not match the listing. Static ISP and Rotating have no refunds.

MASQUE: the HTTP way to do it

There is another route that doesn't use SOCKS at all. MASQUE, or CONNECT-UDP (RFC 9298), carries UDP through an HTTP proxy. The client sends an HTTP request that asks the proxy to open a UDP flow, and the packets travel inside HTTP.

It needs a proxy that speaks it and a client that knows it. Elusive proxies are SOCKS5, so for Elusive the route is UDP ASSOCIATE.

Common errors

  • Expecting HTTP/3 in the browser after setting a SOCKS5 proxy. It will use HTTP/2.
  • Forcing --http3 in curl with a SOCKS5 proxy and reading the failure as a bad proxy.
  • Testing with a proxy that has no UDP. Filter the catalog for UDP first.
  • Dropping the TCP control connection. The UDP relay ends with it.
  • Blocked UDP on your own network or firewall.

FAQ

Does HTTP/3 work over a SOCKS5 proxy?

Only if the proxy supports UDP ASSOCIATE and the client uses it. Browsers and curl don't, so they use HTTP/2 or fail.

Does Chrome use QUIC with a SOCKS5 proxy?

Chrome's docs say SOCKSv5 is only used for TCP-based requests. Pages load, but over HTTP/2 or HTTP/1.1. Check chrome://net-export or the network tab to see which protocol you got.

Does curl support HTTP/3 through a proxy?

Not through a SOCKS proxy. curl prints "HTTP/3 is not supported over a SOCKS proxy".

How do I know if my SOCKS5 proxy supports UDP?

Run a UDP ASSOCIATE test. The Python script here takes about a minute.

Is QUIC over a proxy faster?

Not by default. The proxy adds a hop either way, and results depend on the route. Measure it on your own setup.

Get a proxy for your profiles

SOCKS5 with a username and password, ready to paste as HOST:PORT:USER:PASS. Sticky IPs for up to 24 hours, Static ISP for 7 to 90 days, or Rotating by the GB.

Get Started See pricing