Hello everyone.
Over the past few months we have been working on two important networking features: SOCKS5 UDP Relay and DNS anti-pollution. Both are now available in the latest Chute release.
SOCKS5 UDP Relay
SOCKS5 is a well-known proxy protocol most people use for TCP traffic. But the RFC 1928 specification also defines a UDP relay mechanism — UDP ASSOCIATE — which is essential for applications that need UDP proxying (such as online gaming, voice calls, or DNS-over-UDP).
The SOCKS5 UDP relay is a split-plane design:
- A TCP control channel negotiates authentication and establishes the UDP association
- A separate UDP data channel carries the actual datagrams, each wrapped in a 10-byte SOCKS5 UDP header containing the destination address and port
The implementation spans three layers:
Outbound Relay — When an application sends UDP data through a SOCKS5 proxy, Chute wraps each datagram in the SOCKS5 UDP header and forwards it through the UDP association.
Inbound Proxy Server — The local SOCKS5 proxy server now accepts UDP ASSOCIATE requests, establishing the relay and forwarding wrapped datagrams to their destinations.
Connection Lifecycle — We implemented automatic cleanup for idle UDP associations. When the TCP control channel disconnects or a session times out, resources are released promptly to prevent leaks.
DNS Anti-Pollution
On some networks, intermediate routers or firewalls hijack DNS requests and return false responses. This is called DNS pollution or DNS hijacking. When using a SOCKS5 UDP relay, DNS queries sent through the relay are also vulnerable — the upstream proxy server performs the DNS resolution on your behalf, but the response could still be tampered with on the path between the proxy and the DNS resolver.
Our solution: the SOCKS5 UDP relay now detects when an outgoing datagram looks like a DNS query and redirects it through our own DNS system rather than letting the upstream proxy handle it. Specifically:
- When a UDP datagram is about to be sent through the SOCKS5 relay, we inspect the payload
- If it matches DNS wire-format (port 53 and valid DNS header), we extract the query
- Instead of forwarding through the SOCKS5 relay, we resolve it locally through Chute’s own DNS system — which can use DoT, DoH, or any configured secure DNS transport
- The response is wrapped back in a SOCKS5 UDP header and delivered to the application as if it came from the relay
This way, even when using a SOCKS5 proxy, your DNS queries bypass the relay and go through Chute’s own encrypted DNS channels. Combined with DoT and DoH, this means complete DNS integrity regardless of which proxy protocol you use.
Performance Considerations
UDP is connectionless by nature, so managing state is more complex than TCP. We track each UDP association with a timeout — if no datagrams are exchanged within a configurable window, the association is cleaned up. This prevents resource leaks while keeping associations alive for active streams.
For the DNS anti-pollution path, we also added negative caching. When a domain is confirmed to be blocked or hijacked, subsequent queries for the same domain are short-circuited to reduce redundant resolution attempts.
SOCKS5 UDP Relay and DNS anti-pollution are two features that make Chute more robust on unreliable networks. The UDP relay enables applications that depend on UDP to work through proxies, and the DNS anti-pollution mechanism ensures that even when using third-party proxies, your DNS queries remain secure and untampered.
If you encounter any issues, please contact us via Support.
Thanks.
Chute Devs