# Difference Between SOCKS5 and TCP Protocol Modes in MasterDnsVPN: Complete Technical Guide

> Learn the difference between SOCKS5 and TCP protocol modes in MasterDnsVPN. Understand proxy handshake, destination selection, and traffic forwarding for optimal VPN configuration.

- Repository: [Amin Mahmoudi/MasterDnsVPN](https://github.com/masterking32/MasterDnsVPN)
- Tags: deep-dive
- Published: 2026-05-10

---

**The SOCKS5 protocol mode creates a local proxy supporting dynamic destination selection via SOCKS5 handshake, while TCP mode forwards traffic to a single pre-configured endpoint without SOCKS5 negotiation, utilizing different packet enums (PACKET_SOCKS5_* vs PACKET_STREAM_*) and requiring distinct configuration parameters.**

MasterDnsVPN operates as a DNS-tunneling VPN solution that supports two distinct protocol modes selected via the `PROTOCOL_TYPE` configuration setting. Understanding the architectural differences between SOCKS5 and TCP modes is critical for deploying the client and server components correctly, as each mode handles connection establishment, packet encapsulation, and destination resolution through fundamentally different code paths.

## How Protocol Modes Work in MasterDnsVPN

### SOCKS5 Mode (Dynamic Proxy)

In SOCKS5 mode, the client starts a local SOCKS5 proxy server (defaulting to `127.0.0.1:18000`) defined in [`internal/client/tcp_listener.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/client/tcp_listener.go). When applications connect to this proxy, the client performs the SOCKS5 handshake to determine the target destination address and port. The client then wraps the SOCKS5 request into VPN packets using **PACKET_SOCKS5_*** enums such as `PACKET_SOCKS5_SYN` and `PACKET_SOCKS5_CONNECTED`, which are defined in [`internal/vpnproto/packing.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/vpnproto/packing.go). The server extracts the destination address from these packets and opens a TCP connection to the requested target on behalf of the client.

### TCP Mode (Static Forwarding)

In TCP mode, the client does **not** expose a SOCKS5 proxy. Instead, it forwards raw TCP traffic to a **single, pre-configured remote endpoint** specified by `FORWARD_IP` and `FORWARD_PORT` in the configuration. The client creates streams using generic **PACKET_STREAM_*** enums (e.g., `PACKET_STREAM_SYN`, `PACKET_STREAM_DATA`) implemented in [`internal/client/stream_client.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/client/stream_client.go). The server expects traffic destined for this fixed target and therefore does not parse SOCKS5 handshakes, eliminating the proxy negotiation overhead.

## Server-Side Protocol Validation and Enforcement

The server enforces strict protocol matching between client and server configurations through the `rejectProtocolMismatchedSyn` function in [`internal/udpserver/server_postsession.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/udpserver/server_postsession.go). This validation mechanism ensures architectural integrity by:

- Rejecting `PACKET_SOCKS5_SYN` packets when the server runs in TCP mode
- Rejecting `PACKET_STREAM_SYN` packets when the server runs in SOCKS5 mode

The `ProtocolType` field is parsed and normalized in [`internal/config/client.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/client.go) and [`internal/config/server.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/server.go), accepting only `"SOCKS5"` or `"TCP"` as valid string values. This guarantees that mismatched client-server pairs cannot establish connections, preventing protocol confusion in the DNS tunnel.

## Configuration Examples

### SOCKS5 Mode Setup

To configure the client for SOCKS5 mode (the default setting):

```toml

# client_config.toml

PROTOCOL_TYPE = "SOCKS5"
LISTEN_IP     = "127.0.0.1"
LISTEN_PORT   = 18000

```

```bash
./MasterDnsVPN_Client_Linux_AMD64 -config client_config.toml

```

Applications can now route traffic through `127.0.0.1:18000`. The client negotiates SOCKS5 handshakes, encapsulates requests using SOCKS5-specific packet types, and the server connects to dynamically requested destinations.

### TCP Mode Setup

For static forwarding to a single endpoint:

```toml

# client_config.toml

PROTOCOL_TYPE = "TCP"
FORWARD_IP    = "203.0.113.10"
FORWARD_PORT  = 443

```

```bash
./MasterDnsVPN_Client_Linux_AMD64 -config client_config.toml

```

All traffic is forwarded **unchanged** to `203.0.113.10:443` without SOCKS5 negotiation. The `handleConnection` logic bypasses SOCKS5 processing entirely in this mode.

### Server Configuration Matching

Both endpoints must use identical protocol settings:

```toml

# server_config.toml

PROTOCOL_TYPE = "SOCKS5"   # or "TCP" to match the client

```

## Use Cases: Selecting the Appropriate Mode

**Choose SOCKS5 mode** when:

- Applications require access to multiple dynamic target hosts (browsers, P2P clients)
- You need a local proxy interface for SOCKS5-compatible applications
- Chaining through an upstream SOCKS5 proxy using `USE_EXTERNAL_SOCKS5 = true` in the server configuration

**Choose TCP mode** when:

- Forwarding traffic to a single specific service or backend
- Creating a static tunnel to one pre-defined endpoint minimizes configuration complexity
- Eliminating SOCKS5 handshake overhead is preferred for single-destination scenarios

## Summary

- **SOCKS5 mode** implements a local proxy using `PACKET_SOCKS5_*` enums (e.g., `PACKET_SOCKS5_SYN`, `PACKET_SOCKS5_CONNECTED_ACK`) to support dynamic destination selection, while **TCP mode** uses `PACKET_STREAM_*` enums for raw forwarding to fixed endpoints.
- The server validates protocol compatibility through `rejectProtocolMismatchedSyn` in [`internal/udpserver/server_postsession.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/udpserver/server_postsession.go), rejecting mismatched packet types to prevent cross-mode connections.
- Configuration requires matching `PROTOCOL_TYPE` values in both [`internal/config/client.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/client.go) and [`internal/config/server.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/server.go), with default behavior favoring SOCKS5.
- SOCKS5 suits multi-destination proxy requirements and upstream chaining, whereas TCP mode is optimized for single-endpoint static tunnels.

## Frequently Asked Questions

### What happens if the client and server use different protocol modes?

The server will terminate the connection attempt. The `rejectProtocolMismatchedSyn` function in [`internal/udpserver/server_postsession.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/udpserver/server_postsession.go) specifically inspects incoming SYN packets and rejects `PACKET_SOCKS5_SYN` when running in TCP mode, and rejects `PACKET_STREAM_SYN` when running in SOCKS5 mode, ensuring protocol consistency across the tunnel.

### Can I switch between SOCKS5 and TCP modes without restarting the service?

No, the `PROTOCOL_TYPE` setting is parsed at startup in both [`internal/config/client.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/client.go) and [`internal/config/server.go`](https://github.com/masterking32/MasterDnsVPN/blob/main/internal/config/server.go). Changing between modes requires restarting both the client and server processes with updated configuration files for the changes to take effect.

### Which protocol mode provides better performance?

TCP mode may exhibit marginally lower latency due to the absence of SOCKS5 handshake overhead, though both modes operate over the same DNS tunnel transport. The performance difference is typically negligible compared to the inherent latency of DNS encapsulation itself.

### Can I use TCP mode to chain through another SOCKS5 proxy?

No, TCP mode forwards raw TCP traffic directly to the configured `FORWARD_IP` and `FORWARD_PORT`. To chain through an upstream SOCKS5 proxy, you must use SOCKS5 mode with `USE_EXTERNAL_SOCKS5 = true` configured in the server settings, which routes outbound connections through the specified upstream proxy rather than connecting directly to destinations.