- Jan 22, 2008
- 5,791
- 8,181
The tutorial is fixed by AI grammarly because I am not native
For claude code or codex guys:
1. Tell your AI to fetch this tutorial
2. Tell it to execute via SSH
3. In 5 minutes you have router for proxy usage
-------------------
Router to use: Cudy WR3000
Goal: use proxy on your phones without telling apps you are using the proxy
Up to 16 wifi networks
Currently I have 4 phones with independent proxies
Each network can have own independent VPN or proxy
Turn a $30 Router Into a Privacy Gateway (SOCKS5 Proxy & WireGuard VPN)
A step-by-step guide to setting up a Cudy WR3000 (or any OpenWrt-compatible router) so that every device on your network — phones, laptops, smart TVs — automatically routes through either a SOCKS5 proxy or a WireGuard VPN. No per-device configuration needed.
What You'll Build
Your phone / laptop / TV
|
WiFi or LAN cable
|
┌──────────────────────┐
│ Cudy WR3000 │
│ (OpenWrt) │
│ │
│ Option A: SOCKS5 │ ← transparent proxy, change exit IP in seconds
│ Option B: WireGuard │ ← encrypted VPN tunnel (e.g. Surfshark)
└──────────────────────┘
|
Your ISP / Internet
Option A (SOCKS5) is great when you have residential or mobile proxies and need to swap IPs frequently — one command changes the exit IP for your entire network.
Option B (WireGuard VPN) is better for always-on privacy with a commercial VPN provider like Surfshark, Mullvad, or IVPN.
You can set up both and switch between them.
Prerequisites
Part 1: Install OpenWrt
1.1 Download the firmware
Go to openwrt.org and find the sysupgrade image for your router model.
For Cudy WR3000 v1: search "Cudy WR3000" on the OpenWrt Table of Hardware.
1.2 Flash it
1.3 First login
No password is set by default. Set one now:
1.4 Connect the router to the internet
Plug an ethernet cable from your main router/modem into the WAN port of the Cudy. The Cudy gets internet via DHCP automatically.
Verify:
1.5 Update package lists
You now have a working OpenWrt router. Pick your path below.
Part 2 (Option A): Transparent SOCKS5 Proxy
This setup makes every device on your network use a SOCKS5 proxy — without any device knowing about it. The router intercepts all TCP traffic and tunnels it through the proxy.
How it works
DNS is also routed through the proxy (via
2.1 Install redsocks
2.2 Configure redsocks
Create
2.3 Create the init script for redsocks
2.4 Create the firewall rules
This is the magic. These nftables rules intercept all traffic from your LAN and redirect it through redsocks.
What each rule does:
2.5 Create the redirect init script
2.6 Create the one-command proxy switcher
This is the killer feature — change your exit IP from your laptop in one command:
2.7 Add a watchdog (auto-restart if redsocks crashes)
2.8 Enable and start everything
2.9 Test it
On any device connected to the router's WiFi, open:
2.10 Switching proxies
From your computer (Mac/Linux), swap the entire network's exit IP in one command:
The change is instant — no router reboot needed.
Part 3 (Option B): WireGuard VPN
WireGuard is a modern, fast VPN protocol. This setup routes all traffic through a commercial VPN provider.
3.1 Install WireGuard
3.2 Get your config from your VPN provider
Most providers (Surfshark, Mullvad, IVPN, etc.) let you download a
You'll need three values from this file:
3.3 Configure the WireGuard interface
3.4 Add WireGuard to the firewall
WireGuard needs to be in the
3.5 Set DNS to your VPN provider's servers
Using your VPN provider's DNS prevents your ISP from seeing your DNS queries:
3.6 Disable IPv6 (prevents leaks)
Most VPN tunnels are IPv4-only. Without disabling IPv6, some traffic could bypass the VPN:
3.7 Restart networking
3.8 Verify the VPN is working
The IP should match your VPN provider's server, not your ISP.
On any device connected to the router, visit whatismyipaddress.com to confirm.
3.9 Switching VPN servers
To change to a different server (e.g. from US to UK):
Bonus: Randomize Your WiFi MAC Address
Every WiFi access point broadcasts a unique MAC address (BSSID). This can be used to track your router's physical location (e.g. by Google's location services). Randomizing it on every boot adds a layer of privacy.
Troubleshooting
SOCKS5 issues
VPN issues
Security Notes
Quick Reference
Built and tested on a Cudy WR3000 v1 running OpenWrt 24.10.5. Total cost: ~$30 for the router + your proxy/VPN subscription.
For claude code or codex guys:
1. Tell your AI to fetch this tutorial
2. Tell it to execute via SSH
3. In 5 minutes you have router for proxy usage
-------------------
Router to use: Cudy WR3000
Goal: use proxy on your phones without telling apps you are using the proxy
Up to 16 wifi networks
Currently I have 4 phones with independent proxies
Each network can have own independent VPN or proxy
Turn a $30 Router Into a Privacy Gateway (SOCKS5 Proxy & WireGuard VPN)
A step-by-step guide to setting up a Cudy WR3000 (or any OpenWrt-compatible router) so that every device on your network — phones, laptops, smart TVs — automatically routes through either a SOCKS5 proxy or a WireGuard VPN. No per-device configuration needed.
What You'll Build
Your phone / laptop / TV
|
WiFi or LAN cable
|
┌──────────────────────┐
│ Cudy WR3000 │
│ (OpenWrt) │
│ │
│ Option A: SOCKS5 │ ← transparent proxy, change exit IP in seconds
│ Option B: WireGuard │ ← encrypted VPN tunnel (e.g. Surfshark)
└──────────────────────┘
|
Your ISP / Internet
Option A (SOCKS5) is great when you have residential or mobile proxies and need to swap IPs frequently — one command changes the exit IP for your entire network.
Option B (WireGuard VPN) is better for always-on privacy with a commercial VPN provider like Surfshark, Mullvad, or IVPN.
You can set up both and switch between them.
Prerequisites
| What | Why |
|---|---|
| Cudy WR3000 v1 (~$30) | Cheap, powerful (256 MB RAM, Wi-Fi 6), well-supported by OpenWrt. Any OpenWrt router works — just find the right firmware image. |
| Ethernet cable | To connect the router to your main router/modem (WAN) and optionally to your computer during setup. |
| A computer with SSH | Mac/Linux have it built-in. Windows: use PowerShell or PuTTY. |
| SOCKS5 proxy credentials (Option A) | From a proxy provider — you'll get an IP, port, username, and password. |
| WireGuard config file (Option B) | From your VPN provider (e.g. Surfshark Manual Setup > WireGuard). |
Part 1: Install OpenWrt
1.1 Download the firmware
Go to openwrt.org and find the sysupgrade image for your router model.
For Cudy WR3000 v1: search "Cudy WR3000" on the OpenWrt Table of Hardware.
1.2 Flash it
- Open your router's stock web admin (usually
192.168.10.1for Cudy). - Go to System > Firmware Upgrade.
- Upload the OpenWrt sysupgrade
.binfile. - Wait 2-3 minutes. Don't unplug power.
- The router will reboot. Its new address is
192.168.1.1.
1.3 First login
Code:
No password is set by default. Set one now:
Code:
passwd1.4 Connect the router to the internet
Plug an ethernet cable from your main router/modem into the WAN port of the Cudy. The Cudy gets internet via DHCP automatically.
Verify:
Code:
ping -c 3 google.com1.5 Update package lists
Code:
opkg updateYou now have a working OpenWrt router. Pick your path below.
Part 2 (Option A): Transparent SOCKS5 Proxy
This setup makes every device on your network use a SOCKS5 proxy — without any device knowing about it. The router intercepts all TCP traffic and tunnels it through the proxy.
How it works
Code:
Device sends normal HTTP/HTTPS request
↓
Router intercepts it (nftables REDIRECT)
↓
redsocks converts it to SOCKS5
↓
Traffic exits through the proxy serverDNS is also routed through the proxy (via
dnstc), so your ISP can't see what domains you visit.2.1 Install redsocks
Code:
opkg update
opkg install redsocks2.2 Configure redsocks
Create
/etc/redsocks.conf with your proxy details. Replace the four values with your own:
Code:
cat > /etc/redsocks.conf << 'EOF'
base {
log_debug = off;
log_info = on;
log = "syslog:daemon";
daemon = on;
redirector = iptables;
}
redsocks {
local_ip = 0.0.0.0;
local_port = 12345;
ip = YOUR_PROXY_IP;
port = YOUR_PROXY_PORT;
type = socks5;
login = "YOUR_USERNAME";
password = "YOUR_PASSWORD";
}
dnstc {
local_ip = 0.0.0.0;
local_port = 5300;
}
EOF2.3 Create the init script for redsocks
Code:
cat > /etc/init.d/redsocks << 'INITEOF'
#!/bin/sh /etc/rc.common
START=90
[ -e "/etc/redsocks.conf" ] || exit 0
start() {
if [ -e "/var/run/redsocks.pid" ]; then
echo "redsocks is already running"
exit 0
fi
echo -n "Starting redsocks..."
/usr/sbin/redsocks -p /var/run/redsocks.pid
echo " done"
}
stop() {
if [ ! -e "/var/run/redsocks.pid" ]; then
echo "redsocks is not running"
exit 0
fi
echo -n "Stopping redsocks..."
kill $(cat /var/run/redsocks.pid)
rm /var/run/redsocks.pid
echo " done"
}
INITEOF
chmod +x /etc/init.d/redsocks2.4 Create the firewall rules
This is the magic. These nftables rules intercept all traffic from your LAN and redirect it through redsocks.
Code:
cat > /usr/bin/redsocks-rules << 'NFTEOF'
#!/bin/sh
LAN_IF="br-lan"
RS_PORT=12345
DNS_PORT=5300
nft -f - <<EOF
table ip redsocks {}
delete table ip redsocks
table ip6 redsocks {}
delete table ip6 redsocks
table ip redsocks {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
# Don't proxy traffic to private/local addresses
iifname "${LAN_IF}" ip daddr { 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 } return
# Redirect DNS (UDP 53) to dnstc, which forces TCP
iifname "${LAN_IF}" udp dport 53 redirect to :${DNS_PORT}
# Redirect all TCP to redsocks
iifname "${LAN_IF}" meta l4proto tcp redirect to :${RS_PORT}
}
chain forward {
type filter hook forward priority -5; policy accept;
# Block all non-TCP (kills QUIC/UDP so apps fall back to TCP)
iifname "${LAN_IF}" meta l4proto udp reject
}
}
# Block IPv6 forwarding entirely (proxy is IPv4-only)
table ip6 redsocks {
chain forward {
type filter hook forward priority -5; policy accept;
iifname "${LAN_IF}" reject
}
}
EOF
NFTEOF
chmod +x /usr/bin/redsocks-rulesWhat each rule does:
| Rule | Purpose |
|---|---|
ip daddr { private ranges } return | Don't proxy local traffic (router admin, LAN devices talking to each other). |
udp dport 53 redirect to :5300 | Catch DNS and route it through dnstc → TCP → proxy. Prevents DNS leaks. |
meta l4proto tcp redirect to :12345 | Send all TCP to redsocks, which forwards it to your SOCKS5 proxy. |
meta l4proto udp reject | Block UDP. This kills QUIC (fast but unproxyable) and forces apps to fall back to normal TCP. |
ip6 ... reject | Block IPv6 forwarding. Most SOCKS5 proxies are IPv4-only; without this, IPv6 traffic would bypass the proxy. |
2.5 Create the redirect init script
Code:
cat > /etc/init.d/redsocks-redir << 'INITEOF'
#!/bin/sh /etc/rc.common
START=91
STOP=10
start() {
/usr/bin/redsocks-rules
}
stop() {
nft delete table ip redsocks 2>/dev/null
}
restart() {
/usr/bin/redsocks-rules
}
INITEOF
chmod +x /etc/init.d/redsocks-redir2.6 Create the one-command proxy switcher
This is the killer feature — change your exit IP from your laptop in one command:
Code:
cat > /usr/bin/setproxy << 'SPEOF'
#!/bin/sh
# Usage: setproxy <ip> <port> [username] [password]
CONF=/etc/redsocks.conf
IP="$1"; PORT="$2"; LOGIN="$3"; PASS="$4"
if [ -z "$IP" ] || [ -z "$PORT" ]; then
echo "Usage: setproxy <ip> <port> [username] [password]"
exit 1
fi
AUTH=""
[ -n "$LOGIN" ] && AUTH="${AUTH} login = \"${LOGIN}\";
"
[ -n "$PASS" ] && AUTH="${AUTH} password = \"${PASS}\";
"
cat > "$CONF" <<EOF
base {
log_debug = off;
log_info = on;
log = "syslog:daemon";
daemon = on;
redirector = iptables;
}
redsocks {
local_ip = 0.0.0.0;
local_port = 12345;
ip = ${IP};
port = ${PORT};
type = socks5;
${AUTH}}
dnstc {
local_ip = 0.0.0.0;
local_port = 5300;
}
EOF
killall redsocks 2>/dev/null
rm -f /var/run/redsocks.pid
sleep 1
/etc/init.d/redsocks start >/dev/null 2>&1
sleep 1
/usr/bin/redsocks-rules 2>/dev/null
if pidof redsocks >/dev/null; then
echo "OK: proxy = ${IP}:${PORT} (login: ${LOGIN:-none}). redsocks is running."
else
echo "ERROR: redsocks failed to start. Debug: logread | grep redsocks | tail"
exit 1
fi
SPEOF
chmod +x /usr/bin/setproxy2.7 Add a watchdog (auto-restart if redsocks crashes)
Code:
cat > /usr/bin/redsocks_watchdog.sh << 'WDEOF'
#!/bin/sh
if ! pidof redsocks >/dev/null 2>&1; then
rm -f /var/run/redsocks.pid
/etc/init.d/redsocks start >/dev/null 2>&1
/usr/bin/redsocks-rules >/dev/null 2>&1
logger -t redsocks_watchdog "redsocks was down -> restarted"
fi
nft list table ip redsocks >/dev/null 2>&1 || /usr/bin/redsocks-rules >/dev/null 2>&1
WDEOF
chmod +x /usr/bin/redsocks_watchdog.sh
# Run watchdog every minute
(crontab -l 2>/dev/null; echo '* * * * * /usr/bin/redsocks_watchdog.sh') | crontab -2.8 Enable and start everything
Code:
service redsocks enable
service redsocks-redir enable
service redsocks start
/usr/bin/redsocks-rules2.9 Test it
On any device connected to the router's WiFi, open:
- whatismyipaddress.com — should show the proxy's IP, not your real ISP IP.
- dnsleaktest.com — DNS should resolve through the proxy, not your ISP.
2.10 Switching proxies
From your computer (Mac/Linux), swap the entire network's exit IP in one command:
Code:
# With authentication
ssh [email protected] setproxy 103.219.170.11 24283 myuser mypass
# Without authentication
ssh [email protected] setproxy 103.219.170.11 24283The change is instant — no router reboot needed.
Part 3 (Option B): WireGuard VPN
WireGuard is a modern, fast VPN protocol. This setup routes all traffic through a commercial VPN provider.
3.1 Install WireGuard
Code:
opkg update
opkg install wireguard-tools luci-proto-wireguard3.2 Get your config from your VPN provider
Most providers (Surfshark, Mullvad, IVPN, etc.) let you download a
.conf file. It looks like this:
Code:
[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = 10.14.0.2/16
DNS = 162.252.172.57
[Peer]
PublicKey = SERVER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0
Endpoint = us-lax.prod.surfshark.com:51820
PersistentKeepalive = 25You'll need three values from this file:
- PrivateKey (your key)
- PublicKey (server's key)
- Endpoint (server address)
3.3 Configure the WireGuard interface
Code:
# Create the WireGuard interface
uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='YOUR_PRIVATE_KEY'
uci add_list network.wg0.addresses='10.14.0.2/16'
uci set network.wg0.metric='10'
# Add the VPN server as a peer
uci set network.wg_peer0=wireguard_wg0
uci set network.wg_peer0.public_key='SERVER_PUBLIC_KEY'
uci set network.wg_peer0.endpoint_host='us-lax.prod.surfshark.com'
uci set network.wg_peer0.endpoint_port='51820'
uci set network.wg_peer0.persistent_keepalive='25'
uci add_list network.wg_peer0.allowed_ips='0.0.0.0/0'
uci set network.wg_peer0.route_allowed_ips='1'
# Save and apply
uci commit network3.4 Add WireGuard to the firewall
WireGuard needs to be in the
wan firewall zone so it can reach the internet:
Code:
# Get the current wan zone networks and add wg0
uci add_list firewall.@zone[1].network='wg0'
uci commit firewall3.5 Set DNS to your VPN provider's servers
Using your VPN provider's DNS prevents your ISP from seeing your DNS queries:
Code:
uci set network.wg0.dns='162.252.172.57 149.154.159.92'
uci commit network3.6 Disable IPv6 (prevents leaks)
Most VPN tunnels are IPv4-only. Without disabling IPv6, some traffic could bypass the VPN:
Code:
# Disable IPv6 system-wide
echo 'net.ipv6.conf.all.disable_ipv6=1' >> /etc/sysctl.conf
sysctl -p
# Disable the IPv6 WAN interface
uci set network.wan6.auto='0'
uci commit network
# Block IPv6 forwarding in the firewall
uci add firewall rule
uci set firewall.@rule[-1].name='Block-IPv6-Forward-Leak'
uci set firewall.@rule[-1].family='ipv6'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].dest='wan'
uci set firewall.@rule[-1].target='REJECT'
uci commit firewall3.7 Restart networking
Code:
/etc/init.d/network restart
/etc/init.d/firewall restart3.8 Verify the VPN is working
Code:
# Check WireGuard status
wg show
# Check your exit IP
wget -qO- http://ifconfig.meThe IP should match your VPN provider's server, not your ISP.
On any device connected to the router, visit whatismyipaddress.com to confirm.
3.9 Switching VPN servers
To change to a different server (e.g. from US to UK):
- Generate a new config in your VPN provider's dashboard.
- Run:
Code:
uci set network.wg_peer0.public_key='NEW_SERVER_PUBLIC_KEY'
uci set network.wg_peer0.endpoint_host='uk-lon.prod.surfshark.com'
uci commit network
/etc/init.d/network restartBonus: Randomize Your WiFi MAC Address
Every WiFi access point broadcasts a unique MAC address (BSSID). This can be used to track your router's physical location (e.g. by Google's location services). Randomizing it on every boot adds a layer of privacy.
Code:
# Create the randomizer script
cat > /usr/bin/rand-bssid << 'RBEOF'
#!/bin/sh
RAND=$(head -c5 /dev/urandom | hexdump -v -e '/1 ":%02x"')
MAC="02${RAND}"
uci set wireless.default_radio0.macaddr="${MAC}"
uci commit wireless
wifi reload radio0 >/dev/null 2>&1
logger -t rand-bssid "Set random BSSID radio0 = ${MAC}"
RBEOF
chmod +x /usr/bin/rand-bssid
# Create init script (runs before networking starts)
cat > /etc/init.d/randbssid << 'INITEOF'
#!/bin/sh /etc/rc.common
START=15
start() {
/usr/bin/rand-bssid
}
INITEOF
chmod +x /etc/init.d/randbssid
service randbssid enableTroubleshooting
SOCKS5 issues
| Problem | Fix |
|---|---|
| No internet on devices | ssh [email protected] 'logread | grep redsocks | tail' — check for proxy connection errors. |
| redsocks not running | ssh [email protected] '/etc/init.d/redsocks restart; /usr/bin/redsocks-rules' |
| Check firewall rules | ssh [email protected] 'nft list table ip redsocks' |
| DNS leaking | Make sure dnstc section exists in /etc/redsocks.conf and UDP 53 redirect rule is active. |
| QUIC/UDP bypassing proxy | The udp reject rule should block it. Check with nft list table ip redsocks. |
| Nuclear option | ssh [email protected] reboot |
VPN issues
| Problem | Fix |
|---|---|
wg show shows no handshake | Check that endpoint_host resolves: nslookup us-lax.prod.surfshark.com. The WAN must be connected to the internet first. |
| Slow speeds | Try a closer server. WireGuard itself adds minimal overhead. |
| IPv6 leak | Run curl -6 ifconfig.me — it should fail. If it doesn't, revisit step 3.6. |
| VPN connected but no internet | Make sure wg0 is in the wan firewall zone and route_allowed_ips is 1. |
Security Notes
- SSH keys: For convenience, copy your SSH public key to the router so you don't need a password:
Code:ssh-copy-id [email protected] - Change the default password if you haven't already (
passwdon the router). - LuCI web interface is at
http://192.168.1.1— handy for Wi-Fi settings, but all the proxy/VPN config is best done via SSH. - Proxy credentials are stored in plain text in
/etc/redsocks.conf. The router itself is the security boundary — anyone with SSH access can read them.
Quick Reference
Code:
# === SOCKS5 ===
# Change proxy (from your Mac/PC):
ssh [email protected] setproxy IP PORT USER PASS
# Check status:
ssh [email protected] 'pidof redsocks && echo "running" || echo "stopped"'
# === WireGuard VPN ===
# Check VPN status:
ssh [email protected] wg show
# Change VPN server:
ssh [email protected] 'uci set network.wg_peer0.public_key="NEW_KEY"; \
uci set network.wg_peer0.endpoint_host="NEW_HOST"; \
uci commit network; /etc/init.d/network restart'
# === General ===
# What IP does the world see?
ssh [email protected] 'wget -qO- http://ifconfig.me'
# Reboot the router:
ssh [email protected] rebootBuilt and tested on a Cudy WR3000 v1 running OpenWrt 24.10.5. Total cost: ~$30 for the router + your proxy/VPN subscription.
