Difference Between SOCKS5 and TCP Protocol Modes in MasterDnsVPN: Complete Technical Guide

The SOCKS5 protocol mode creates a local proxy supporting dynamic destination selection via SOCKS5 handshake, while TCP mode forwards traffic to a single pre-configured endpoint without SOCKS5 negotiation, utilizing different packet enums (PACKET_SOCKS5_ vs PACKET_STREAM_) and requiring distinct configuration parameters.**

MasterDnsVPN operates as a DNS-tunneling VPN solution that supports two distinct protocol modes selected via the PROTOCOL_TYPE configuration setting. Understanding the architectural differences between SOCKS5 and TCP modes is critical for deploying the client and server components correctly, as each mode handles connection establishment, packet encapsulation, and destination resolution through fundamentally different code paths.

How Protocol Modes Work in MasterDnsVPN

SOCKS5 Mode (Dynamic Proxy)

In SOCKS5 mode, the client starts a local SOCKS5 proxy server (defaulting to 127.0.0.1:18000) defined in internal/client/tcp_listener.go. When applications connect to this proxy, the client performs the SOCKS5 handshake to determine the target destination address and port. The client then wraps the SOCKS5 request into VPN packets using PACKET_SOCKS5_* enums such as PACKET_SOCKS5_SYN and PACKET_SOCKS5_CONNECTED, which are defined in internal/vpnproto/packing.go. The server extracts the destination address from these packets and opens a TCP connection to the requested target on behalf of the client.

TCP Mode (Static Forwarding)

In TCP mode, the client does not expose a SOCKS5 proxy. Instead, it forwards raw TCP traffic to a single, pre-configured remote endpoint specified by FORWARD_IP and FORWARD_PORT in the configuration. The client creates streams using generic PACKET_STREAM_* enums (e.g., PACKET_STREAM_SYN, PACKET_STREAM_DATA) implemented in internal/client/stream_client.go. The server expects traffic destined for this fixed target and therefore does not parse SOCKS5 handshakes, eliminating the proxy negotiation overhead.

Server-Side Protocol Validation and Enforcement

The server enforces strict protocol matching between client and server configurations through the rejectProtocolMismatchedSyn function in internal/udpserver/server_postsession.go. This validation mechanism ensures architectural integrity by:

• Rejecting PACKET_SOCKS5_SYN packets when the server runs in TCP mode
• Rejecting PACKET_STREAM_SYN packets when the server runs in SOCKS5 mode

The ProtocolType field is parsed and normalized in internal/config/client.go and internal/config/server.go, accepting only "SOCKS5" or "TCP" as valid string values. This guarantees that mismatched client-server pairs cannot establish connections, preventing protocol confusion in the DNS tunnel.

Configuration Examples

SOCKS5 Mode Setup

To configure the client for SOCKS5 mode (the default setting):

# client_config.toml

PROTOCOL_TYPE = "SOCKS5"
LISTEN_IP     = "127.0.0.1"
LISTEN_PORT   = 18000

./MasterDnsVPN_Client_Linux_AMD64 -config client_config.toml

Applications can now route traffic through 127.0.0.1:18000. The client negotiates SOCKS5 handshakes, encapsulates requests using SOCKS5-specific packet types, and the server connects to dynamically requested destinations.

TCP Mode Setup

For static forwarding to a single endpoint:

# client_config.toml

PROTOCOL_TYPE = "TCP"
FORWARD_IP    = "203.0.113.10"
FORWARD_PORT  = 443

./MasterDnsVPN_Client_Linux_AMD64 -config client_config.toml

All traffic is forwarded unchanged to 203.0.113.10:443 without SOCKS5 negotiation. The handleConnection logic bypasses SOCKS5 processing entirely in this mode.

Server Configuration Matching

Both endpoints must use identical protocol settings:

# server_config.toml

PROTOCOL_TYPE = "SOCKS5"   # or "TCP" to match the client

Use Cases: Selecting the Appropriate Mode

Choose SOCKS5 mode when:

• Applications require access to multiple dynamic target hosts (browsers, P2P clients)
• You need a local proxy interface for SOCKS5-compatible applications
• Chaining through an upstream SOCKS5 proxy using USE_EXTERNAL_SOCKS5 = true in the server configuration

Choose TCP mode when:

• Forwarding traffic to a single specific service or backend
• Creating a static tunnel to one pre-defined endpoint minimizes configuration complexity
• Eliminating SOCKS5 handshake overhead is preferred for single-destination scenarios

Summary

• SOCKS5 mode implements a local proxy using PACKET_SOCKS5_* enums (e.g., PACKET_SOCKS5_SYN, PACKET_SOCKS5_CONNECTED_ACK) to support dynamic destination selection, while TCP mode uses PACKET_STREAM_* enums for raw forwarding to fixed endpoints.
• The server validates protocol compatibility through rejectProtocolMismatchedSyn in internal/udpserver/server_postsession.go, rejecting mismatched packet types to prevent cross-mode connections.
• Configuration requires matching PROTOCOL_TYPE values in both internal/config/client.go and internal/config/server.go, with default behavior favoring SOCKS5.
• SOCKS5 suits multi-destination proxy requirements and upstream chaining, whereas TCP mode is optimized for single-endpoint static tunnels.

Frequently Asked Questions

What happens if the client and server use different protocol modes?

The server will terminate the connection attempt. The rejectProtocolMismatchedSyn function in internal/udpserver/server_postsession.go specifically inspects incoming SYN packets and rejects PACKET_SOCKS5_SYN when running in TCP mode, and rejects PACKET_STREAM_SYN when running in SOCKS5 mode, ensuring protocol consistency across the tunnel.

Can I switch between SOCKS5 and TCP modes without restarting the service?

No, the PROTOCOL_TYPE setting is parsed at startup in both internal/config/client.go and internal/config/server.go. Changing between modes requires restarting both the client and server processes with updated configuration files for the changes to take effect.

Which protocol mode provides better performance?

TCP mode may exhibit marginally lower latency due to the absence of SOCKS5 handshake overhead, though both modes operate over the same DNS tunnel transport. The performance difference is typically negligible compared to the inherent latency of DNS encapsulation itself.

Can I use TCP mode to chain through another SOCKS5 proxy?

No, TCP mode forwards raw TCP traffic directly to the configured FORWARD_IP and FORWARD_PORT. To chain through an upstream SOCKS5 proxy, you must use SOCKS5 mode with USE_EXTERNAL_SOCKS5 = true configured in the server settings, which routes outbound connections through the specified upstream proxy rather than connecting directly to destinations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}