Proxy services: assign different egress paths to ports

Proxy services expose a local or remote listening port whose traffic leaves through a selected WAN, VPN line, node, or node group. Treat every exposed port as a service that needs authentication and access control.

Common uses

• Give a local tool a stable HTTP or SOCKS5 entry point.
• Assign different ports to different WAN, VPN, node, or group paths.
• Provide a controlled egress to a trusted remote client.

What you should see when finished

• The proxy service has a unique name and port.
• The selected outbound interface is online.
• Authentication is enabled for a shared port.
• A client request reports the expected public IP.

Before you start

• Confirm the outbound interface name with the system interface list.
• Keep the first listener on the LAN only.
• Use a strong, unique username and password.
• Do not expose a management or reserved port.
• Decide how the port will be reached and which source addresses are trusted.

1. Open the proxy service page

Open the SoloIP advanced settings and enable the proxy service entry if the feature is hidden. If the menu is unavailable, check the firmware, plugin version, and license entitlement.

2. Add the first service

Name

Use a unique name such as studio-us-http. Keep the name stable so scripts and monitoring can refer to it.

Outbound interface

Choose the exact WAN, PPPoE, L2TP, PPTP, node, or node-group path supported by the page. Proxy-service outbound values use a bare interface name; do not add the routing-rule Interface: prefix.

Listening port

Choose an unused port above the system-reserved range. Check for conflicts before saving. Use a different port for every independent egress path.

Credentials

Set authentication for every port that is not strictly private. Store credentials in a password manager and do not include them in screenshots or URLs shared with a third party.

3. Enable the port

Save the service, enable it, and wait for the configuration reload. Check that the service status is enabled and that the outbound interface is online.

4. Connect a client

From a trusted LAN client, configure the proxy type, router address, port, username, and password. Use one new connection and query a public IP endpoint.

Minimal command-line check

curl -x http://user:password@192.168.50.1:20001 https://api.ipify.org

Do not paste a command containing a real password into a shared shell history or support ticket.

5. Share a port remotely only when required

Router has a public address

Use an explicit firewall allow rule for trusted source addresses and a non-default port. Keep the management interface separate from the proxy service.

Public address changes

Use a dynamic DNS name with a certificate or a private access path. Confirm that DNS updates do not expose the management port.

Through an overlay tunnel

Expose the port only inside the tunnel and restrict tunnel peers. Test the route from a permitted peer before adding more users.

Minimum security checks

• Authentication is enabled and credentials are unique.
• The listener is not reachable from an untrusted source.
• The chosen outbound interface is intentional.
• Logs and monitoring do not record credentials.
• A disabled port is no longer reachable.

6. Verify two different egresses

Create two ports with different outbound paths. Query a public IP through each port and compare the results. If both results are identical, check the client proxy type, the rule target, the node group member, and the actual interface binding.

7. Batch-create or import services

The supported import shapes are:

name,outbound_interface,port,username,password
outbound_interface,port,username,password
outbound_interface,port,username
outbound_interface,port

Start with replace disabled and import two rows. Review the response, then enable the services individually.

Common problems

The proxy service menu is missing

Check the plugin version, feature entitlement, and advanced settings visibility.

Port save fails or the client is refused

Check port conflicts, listener status, firewall policy, and whether the client is using the correct proxy protocol.

Authentication fails

Re-enter the credentials without surrounding spaces. Confirm that the client is not sending credentials for a different port.

Public IP does not match the selected path

Check the outbound interface, node/group health, and the client's use of the proxy. Repeat with a new connection.

Disabling one service breaks other ports

Check for duplicate ports, shared firewall rules, and whether the services were imported with the same name or port.

The port is reachable from the WAN

Close the exposure, review firewall rules and NAT, rotate the credentials, and only reopen it for an explicit trusted source.

Next step

Use verify the current egress path for each port before handing it to a script or remote client.