Firefox SOCKS5 Proxy: Setup, DNS, and Authentication

You can set a Firefox SOCKS5 proxy inside Firefox without changing the proxy settings for Windows, macOS, or Linux. Open Firefox's Connection Settings, choose Manual proxy configuration, enter the SOCKS host and port, select SOCKS v5, and keep Proxy DNS when using SOCKS v5 checked.

Firefox SOCKS5 proxy authentication is the catch. The Connection Settings form has no username or password fields for SOCKS5. If your proxy needs a login, use one of these:

• IP allowlisting. Authorize your public IP with the provider, then enter only the host and port.
• A proxy extension. Firefox's extension proxy API accepts a SOCKS5 username and password, so an extension can log in where the settings form cannot.
• A local forwarder. A program on 127.0.0.1 logs in to the upstream proxy, and Firefox connects to it without a password.

Firefox SOCKS5 proxy: quick setup

Use these steps when the endpoint does not require a username and password:

1. Open the Firefox menu and select Settings.
2. Find Proxy settings or Network Settings, depending on your Firefox version.
3. Select Configure proxy or Settings.
4. Choose Manual proxy configuration.
5. Enter the proxy hostname in SOCKS Host and its port in Port.
6. Select SOCKS v5.
7. Enable Proxy DNS when using SOCKS v5 if the option is shown.
8. Review the No Proxy For list so required destinations are not bypassed.
9. Save the settings, then open https://ipv4.unknownproxies.com/ip.
10. Confirm the displayed address is the expected proxy exit IP.

Enter only a hostname such as proxy.example.com in SOCKS Host. Do not paste socks5://, a full username:password@host:port URL, or the provider's HTTP endpoint into that field.

Before you change Firefox

Collect the endpoint details from your proxy provider:

Confirm that the host and port belong to a SOCKS5 endpoint. A provider may expose HTTP and SOCKS5 on different ports even when the hostname is the same. The text shape host:port does not identify a protocol by itself.

Test one endpoint before changing the browser if you have cURL:

curl --proxy "socks5h://proxy.example.com:1080" \
  https://ipv4.unknownproxies.com/ip

For an authenticated endpoint:

curl --proxy "socks5h://proxy.example.com:1080" \
  --proxy-user "username:password" \
  https://ipv4.unknownproxies.com/ip

The h in socks5h:// tells cURL to ask the proxy to resolve the destination hostname. cURL's SOCKS proxy documentation distinguishes this from socks5://, which normally resolves the hostname locally.

If the cURL test fails, fix the endpoint, port, protocol, credentials, allowlist, or plan status before troubleshooting Firefox. Be careful with the authenticated example: commands can remain in shell history, so use temporary credentials when possible and never paste real secrets into screenshots or tickets.

How to configure a SOCKS5 proxy in Firefox

Mozilla is reorganizing the Settings interface, so the path depends on the Firefox version:

• In newer versions, open Settings > Privacy & Security, find Connection and software security, select Advanced settings, then go to Proxy settings > Configure proxy.
• In versions with the older layout, open Settings > General, scroll to Network Settings, then select Settings.
• You can also search Firefox Settings for proxy and open the matching connection control.

Mozilla's Firefox connection settings guide documents both layouts. Replies on Mozilla's support forum, as of October 2026, say the old "Network settings" section was renamed "Proxy settings" in Firefox 149 and moved from General to Privacy & Security around Firefox 152. If you do not see the section you expect, check your version under Help > About Firefox.

The dialog offers No proxy, Auto-detect proxy settings for this network, Use system proxy settings, Manual proxy configuration, and an automatic configuration (PAC) URL. Only the manual option has a SOCKS field.

Enter the SOCKS host and port

In the connection dialog:

1. Select Manual proxy configuration.
2. Leave HTTP Proxy and HTTPS Proxy empty unless you deliberately use separate HTTP endpoints.
3. Enter the SOCKS5 hostname without a scheme in SOCKS Host.
4. Enter the assigned numeric port.
5. Select SOCKS v5, not SOCKS v4.
6. Enable Proxy DNS when using SOCKS v5 if Firefox displays that checkbox.
7. Check No Proxy For, then save.

Do not select Also use this proxy for HTTPS as a substitute for the SOCKS field. That option shares an HTTP proxy with HTTPS traffic; it does not convert an HTTP endpoint into SOCKS5 or make a SOCKS5 endpoint work in the HTTP field.

Firefox's proxy settings apply to the browser profile, not every program on the device. A terminal, another browser, an updater, and background apps can continue using the normal network route. If you need other Windows apps on the same route, the Windows 11 SOCKS5 proxy guide covers routing clients.

Proxy DNS when using SOCKS v5

Proxy DNS when using SOCKS v5 makes Firefox send the destination hostname to the SOCKS5 proxy and let the proxy resolve it. When it is off, Firefox looks up the hostname with your normal DNS resolver first, and your local network or ISP can see which sites you visit. Keep it on for remote proxies, regional tests, and SSH tunnels.

The checkbox sits at the bottom of the Connection Settings dialog. It maps to the network.proxy.socks_remote_dns preference, which has historically been off by default, so do not assume it is on. To check the value, open about:config and search for remote_dns. Managed installations can set the same behavior with Mozilla's UseProxyForDNS proxy policy, which the policy page ties to that preference.

Firefox also has a separate DNS over HTTPS (DoH) setting. DoH sends DNS queries to an HTTPS resolver. SOCKS proxy DNS asks the SOCKS5 server to resolve the name. They are different paths, so check which one is active during a test. Mozilla explains the DoH modes in its DNS over HTTPS guide.

Review the bypass list

Entries in No Proxy For connect directly. Firefox commonly bypasses local destinations, and you may need that behavior for routers, development servers, or internal services.

Do not delete bypass entries without understanding why they exist. Instead:

• Keep localhost and 127.0.0.1 direct when local development tools require them.
• Add an internal hostname only when policy requires a direct connection.
• Remove a public test destination from the list if you expect it to use the proxy.
• Remember that a bypassed site showing your normal IP does not prove the SOCKS5 endpoint is broken.

Firefox SOCKS5 proxy authentication

Firefox can speak SOCKS5 username/password authentication, but the Connection Settings form has no place to enter the credentials. Mozilla's SOCKS5 username/password bug tracks adding those fields and is still open. Do not paste credentials into SOCKS Host. Firefox will not parse them.

Pick one of these options:

Use an extension for SOCKS5 authentication

This is where Firefox differs from Chrome, which cannot send SOCKS5 credentials at all, as our Chrome SOCKS5 proxy guide explains. Firefox's proxy.onRequest API lets an extension return a ProxyInfo object. For type: "socks" (SOCKS v5), that object accepts username, password, and proxyDNS. Proxy-switcher extensions that offer SOCKS5 login fields use this API. FoxyProxy is the best-known one: vendor setup guides show a SOCKS5 entry with separate username and password fields. Proxy Toggle was an early extension built for the same gap. Install from addons.mozilla.org and check the update date, since Firefox only runs extensions signed by Mozilla.

An extension that controls the proxy can see every site you visit and redirect traffic. Check the publisher, permissions, update history, and privacy policy before you install one. If you do not want to trust a third party, a private extension is short. A minimal background script looks like this:

// background.js: send every request through an authenticated SOCKS5 proxy
browser.proxy.onRequest.addListener(
  () => ({
    type: "socks",
    host: "proxy.example.com",
    port: 1080,
    username: "username",
    password: "password",
    proxyDNS: true,
  }),
  { urls: ["<all_urls>"] }
);

The manifest needs the proxy permission and the <all_urls> host permission. Load it from about:debugging#/runtime/this-firefox with Load Temporary Add-on. Release versions of Firefox remove temporary add-ons on restart, and permanent installs must be signed by Mozilla. Do not commit real credentials to a file you share.

Use a local forwarder

A local forwarder logs in to the upstream SOCKS5 proxy and exposes a no-password SOCKS5 listener such as 127.0.0.1:1080. Enter 127.0.0.1 and 1080 in Firefox's SOCKS fields. Bind the listener to 127.0.0.1 only, and check whether the forwarder resolves DNS locally or remotely. The same pattern keeps credentials off the screen when an AI model drives Firefox, as in the sandboxes used by computer use agents.

Verify the Firefox SOCKS5 proxy

Verify the change in layers:

1. Before enabling the proxy, open https://ipv4.unknownproxies.com/ip and note the normal public IPv4 address.
2. Enable the Firefox SOCKS5 proxy and reload the page.
3. Confirm the address changes to the expected proxy exit.
4. Open a new private window and repeat the IP check to reduce confusion from an old tab or cached navigation.
5. Load a normal HTTPS page and verify that Firefox reports a valid certificate.
6. Test a hostname that has not recently been opened.
7. Confirm that a destination in No Proxy For still uses its intended direct route.
8. Open the same IP page in another browser and confirm that it remains direct if only Firefox should be proxied.

An exit-IP change proves that the tested Firefox request used the proxy. It does not prove that every application, WebRTC peer connection, DNS mode, IPv6 path, or non-web protocol on the device uses the same route.

For stable login, QA, or account workflows, keep one browser profile, proxy session, region, and cookie set together. If you rotate the exit during a stateful session, the destination may treat the change as suspicious. The sticky vs rotating proxies guide explains when continuity matters.

Check for DNS and WebRTC leaks in Firefox

An exit-IP check does not cover two leak paths. Test both after setup, with the proxy on.

DNS leaks

Open a DNS leak test page. Resolvers owned by your home or office ISP mean a lookup left the proxy path. Common causes are Proxy DNS when using SOCKS v5 being off, a name served from cache, a site in No Proxy For, or DNS over HTTPS sending queries to its own resolver. A user thread on Mozilla's community forum reports a leak in Firefox 122 even with WebRTC and DoH switched off, so treat one clean result as a sample, not proof, and retest on a hostname you have not opened before.

WebRTC leaks

WebRTC gathers connection candidates over UDP, and a SOCKS5 or HTTP proxy in Firefox's settings does not carry that traffic. A page can then read your real public IP. Open a WebRTC leak test with the proxy on and look for your own address in the results.

The only setting that removes the leak path completely is media.peerconnection.enabled set to false in about:config. That also breaks in-browser calls such as Google Meet or Jitsi. If you need WebRTC, community guides point to media.peerconnection.ice.proxy_only_if_behind_proxy, but the sources disagree on which ICE proxy preference matters most, and Mozilla documents them sparsely. Change one, retest, and keep what the leak page confirms.

Troubleshoot a Firefox SOCKS5 proxy

Change one variable at a time. The fastest order is endpoint reachability, protocol, authentication method, DNS, bypass rules, and only then the destination response.

Fix "The proxy server is refusing connections"

This Firefox message means the browser could not establish a usable proxy connection. It does not identify one specific cause.

Check:

• The host contains no scheme, path, spaces, username, or password.
• The port is the provider's SOCKS5 port.
• SOCKS v5 is selected.
• The plan or tunnel is active.
• A local listener such as 127.0.0.1:1080 is running before Firefox tries to use it.
• The network or firewall permits the outbound port.

If the same endpoint fails in cURL, Firefox is not the first problem. If cURL works without credentials but Firefox fails, create a clean test profile or temporarily disable only extensions that control proxy settings.

If you cannot tell whether the endpoint or a network security rule is stopping the connection, use the proxy vs firewall troubleshooting sequence to compare direct access, port reachability, proxy authentication, and the destination response.

Fix DNS failures

If a numeric IP destination connects but a hostname does not, check Proxy DNS when using SOCKS v5. Also review Firefox's DoH protection mode, cached DNS, VPN software, and enterprise policies.

The leak section above covers how to confirm which resolver answered.

Check extensions, VPNs, and system settings

The connection dialog tells you when an extension controls how Firefox connects. A system proxy, VPN, local forwarder, and Firefox extension can also overlap and create a loop or an unexpected direct route.

For a controlled test:

1. Note the current settings so you can restore them.
2. Disconnect unrelated VPNs.
3. Disable proxy-controlling extensions in the test profile.
4. Select only Firefox's manual SOCKS5 configuration.
5. Test one endpoint and one IP-check destination.
6. Add other network layers back one at a time.

Avoid resetting the operating system's entire network stack for a Firefox-only problem. That can remove unrelated VPN, DNS, or enterprise configuration without addressing a wrong browser field.

Separate proxy failures from website blocks

If the exit-IP page and another neutral HTTPS page work, the Firefox SOCKS5 proxy is connected. A 401, 403, 429, CAPTCHA, or login challenge from one site is that site's response to your session or request rate, not a SOCKS5 failure. Changing proxy fields will not fix it, and a new IP does not grant access the site has refused. Follow the site's terms and retry guidance.

Remove the SOCKS5 proxy from Firefox

Return to the same connection settings dialog and choose:

• No proxy to make Firefox connect directly, or
• Use system proxy settings to return control to the operating system.

Save the change, close any test tabs, and repeat the public IP check. If Firefox still uses the proxy, inspect proxy-controlling extensions, a PAC file, enterprise policy, and any local routing client that remains connected.

Choosing a proxy for Firefox

Match the proxy and session behavior to the browser task:

• A stable ISP proxy fits repeated QA, account, retail, and ticketing browser-profile sessions that should keep one exit IP.
• A sticky residential proxy fits permitted regional checks that need a consumer-network route and continuity.
• A rotating residential route fits independent public-page checks where a change of identity will not break session state.

Unknown Proxies supports SOCKS connections on residential and ISP plans. ISP proxies also support IP-based authentication, so an allowlisted ISP endpoint works in Firefox's manual SOCKS form with no password. Residential proxies use a username and password, so pair them with an extension that passes SOCKS5 credentials or a local forwarder. If normal HTTP browsing is the only goal, compare SOCKS5 vs HTTP proxy before adding complexity.

SOCKS5 is a routing protocol, not an encryption guarantee. Continue using HTTPS for sensitive sites, and avoid unknown open proxies: the operator can observe connection metadata and any unencrypted application data.

FAQ

Does Firefox support SOCKS5 proxies?

Yes. Firefox has a manual SOCKS Host field and a SOCKS v5 selector in its connection settings. The setting affects Firefox, not every app on the device.

Where are Firefox proxy settings?

In newer Firefox versions, open Settings > Privacy & Security > Connection and software security > Advanced settings > Proxy settings > Configure proxy. In the older layout, use Settings > General > Network Settings > Settings. Searching Settings for proxy is the quickest version-independent approach.

Can I enter a SOCKS5 username and password in Firefox?

Not in the Connection Settings form. Firefox supports SOCKS5 authentication through its extension proxy API, so a trusted proxy extension such as FoxyProxy can pass the username and password. You can also allowlist your IP with the provider or run a local forwarder on 127.0.0.1. Do not paste credentials into SOCKS Host.

Should I enable "Proxy DNS when using SOCKS v5"?

Usually, yes, when you want destination hostnames resolved through the SOCKS5 route. Check Firefox's separate DNS over HTTPS mode and your organization's DNS policy as well, because remote SOCKS DNS and DoH are different mechanisms.

Can Firefox leak my real IP through WebRTC with a SOCKS5 proxy?

Yes. WebRTC uses UDP, which Firefox's proxy settings do not carry, so a page can read your real public IP. Set media.peerconnection.enabled to false in about:config to remove the path, then confirm with a WebRTC leak test.

Does SOCKS5 encrypt Firefox traffic?

No. SOCKS5 relays connections but does not itself encrypt the application data. HTTPS still provides end-to-end protection for web content.

Why does Firefox show my normal IP after setup?

The proxy may not be selected, the test site may appear in No Proxy For, an extension may control the connection, or the endpoint may be a transparent or local route that does not change the public exit. Verify manual mode and test a known remote proxy.

Final thoughts

A Firefox SOCKS5 proxy takes a minute when the endpoint needs no password: enter the SOCKS host and port, select SOCKS v5, keep Proxy DNS when using SOCKS v5 on, and verify the exit IP. Keep the fields clean, with no scheme or credentials, and remember that the setting covers Firefox only.

For a proxy that needs a username and password, use IP allowlisting, a trusted extension that passes SOCKS5 credentials, or a local forwarder. The settings form will not show a login prompt. Once the route works, keep the proxy session and browser profile consistent for stateful tasks, and treat destination errors separately from proxy connection failures.

Technical references: Mozilla Firefox connection settings, Mozilla proxy enterprise policy, Firefox SOCKS5 authentication issue, cURL SOCKS proxy guide, and RFC 1928.