"UDP ASSOCIATE command not supported" means your SOCKS5 proxy refused to relay UDP. The proxy answered your UDP ASSOCIATE request with reply code 0x07, "Command not supported". Your client is fine. The proxy has no UDP relay, or it is turned off.
The fix is usually a proxy that does support UDP. If the server is yours, it can be a config change.
Key takeaways
- The message comes from the SOCKS5 reply code 0x07 in RFC 1928.
- It means the server will not do UDP ASSOCIATE. TCP (CONNECT) may still work fine.
- Common causes are a server without UDP, UDP turned off in the config, or a proxy that is not SOCKS5.
- To confirm, try CONNECT and UDP ASSOCIATE separately. Only the second fails.
- Reply 0x01 and "accepted but silent" are different problems.
Where the message comes from
SOCKS5 replies to each request with a one-byte code. RFC 1928 lists them.
X'00'succeededX'01'general SOCKS server failureX'02'connection not allowed by rulesetX'03'network unreachableX'04'host unreachableX'05'connection refusedX'06'TTL expiredX'07'command not supportedX'08'address type not supported
The client turns the code into text. In tun2socks, the SOCKS5 package names the command and the reply, so a refused UDP request reads UDP ASSOCIATE: command not supported. Other tools word it their own way, but the cause is the same code.
The RFC says a server that sends a failure reply must close the TCP connection soon after, within 10 seconds. So you see the error and then the connection ends.
A real case is Tor. It does not implement UDP ASSOCIATE. Its bug 12971 was about answering such a request with a broken reply, and the fix was to return the proper "command not supported" reply. Many other servers behave the same way.
The usual causes
1. The server has no UDP relay
SOCKS5 does not force a server to implement every command. The RFC only makes authentication mandatory. Some servers do CONNECT only. microsocks, for example, lists "TCP (no UDP at this time)" in its README.
2. UDP is disabled in the config
Some servers can do UDP but ship with it off. gost needs udp=true on the server side. Dante needs a rule that allows the command.
3. It is not a SOCKS5 proxy
A SOCKS4 proxy has no UDP command. An HTTP proxy does not speak SOCKS at all. If you picked the wrong type in your tool, you get a failure of some kind, though not always this exact message.
4. The provider's proxy has no UDP
Many providers sell SOCKS5 proxies that carry TCP only. The product page may still say "supports TCP and UDP", meaning the protocol. See does SOCKS5 support UDP.
5. The upstream hop refuses it
If your proxy is chained to another proxy, the last one decides. Your first proxy may support UDP while the next one does not.
How to confirm
- Test TCP first. Open any site through the proxy with a TCP-only client. If that works, login and routing are fine.
- Then try UDP ASSOCIATE with a tool that supports it. If the error appears only here, the proxy is the problem.
- Compare with another proxy that is known to support UDP. If the same client works there, your first proxy lacks it.
- If you run the server, read its log. Dante logs the request and the rule that matched.
The full test steps are in how to test SOCKS5 UDP.
Fixes
Use a UDP-capable proxy
This is the main fix when the proxy is bought. On Elusive, every proxy is SOCKS5 with a username and password, and some support UDP through UDP ASSOCIATE. The catalog marks them, and you can filter for them. On Static ISP, UDP is offered in the US, Canada, Germany, the UK and the Netherlands. Browse the catalog.
Turn it on in your own server
Check your server's docs for your version. These are the settings we could verify.
Dante. A socks pass rule must allow the command. From the Dante docs:
socks pass {
from: 0.0.0.0/0 to: 0.0.0.0/0
command: bind connect udpassociate
}Replies from outside need command: bindreply udpreply in a rule too.
gost. Start the server with UDP on.
gost -L "socks5://:1080?udp=true&udpBufferSize=4096"microsocks. No UDP. Use another server.
3proxy. Its man page says its SOCKSv5 works with UDP clients, but we found no setting to name. Read the socks section of its docs for your version.
Open the UDP ports on your firewall too, or the relay will accept and then stay silent.
Skip UDP in the client
If the app only uses UDP for something small, such as DNS, switch it to TCP or DNS over HTTPS. Some apps also have a "TCP only" or "disable QUIC" option, so they fall back to TCP.
Related replies
Reply 0x01, general failure
This is a catch-all. The server failed, but did not say why. For UDP ASSOCIATE it can mean it could not open a UDP socket, hit a limit, or lacked permission. Check the server log, and try again with a different proxy.
"Accepted" but nothing comes back
Here the server sends reply 0x00 and a relay address, and your datagrams vanish. Common reasons are a firewalled UDP port, an internal relay address, a NAT that changes your source IP (the RFC says the relay must drop datagrams from any other source IP), or a TCP control connection that closed. The full list is in does SOCKS5 support UDP.
Common errors
Fixing the login. A 0x07 reply comes after login. Credentials are fine.
Blaming the client. Tools like tun2socks only report what the server said.
Trying UDP in Chrome or Firefox. Neither sends UDP through SOCKS5. See the Chromium docs, and Firefox bugs 1808692 and 1882018.
Expecting socks5h to help. It only changes who resolves DNS. See socks5 vs socks5h.
Assuming all proxies from a seller are alike. Some have UDP and some do not. Check the one you picked.
FAQ
What does "UDP ASSOCIATE command not supported" mean?
The SOCKS5 proxy replied with code 0x07. It will not relay UDP for you.
Is "command not supported" an error in my config?
Usually not. It comes from the proxy, not the client. If you run the proxy, the fix may be in its config.
Does SOCKS5 always support UDP?
No. The protocol defines it, but servers can skip it. Many do.
Will CONNECT still work?
Often yes. The server rejects only the UDP command. TCP traffic through the proxy can keep working.
How do I get a SOCKS5 proxy with UDP?
Pick one marked for UDP. In the Elusive catalog you can filter for it.