Secure Browsing on Public Wi-Fi Using a Raspberry Pi SOCKS5 Proxy

Hotel Wi-Fi, coffee shop networks, and airport hotspots are untrusted by default. Anyone on the same network can potentially intercept unencrypted traffic. This tutorial sets up a Raspberry Pi at home as a SOCKS5 proxy tunneled over SSH, so your traffic routes through your home network instead of the untrusted local one when you are traveling.

Executive Summary

#

When you connect to public Wi-Fi, your device opens an encrypted SSH connection back to your Raspberry Pi at home. Your browser sends all traffic through that tunnel. To the coffee shop network, it looks like you are sending encrypted data to one destination. Your actual browsing happens from your home IP address.

Prerequisites

#

• Raspberry Pi (any model) running Raspberry Pi OS Lite
• The Pi must be reachable from the internet (this tutorial uses a Cloudflare Tunnel)
• A Cloudflare account (free tier is fine)
• A domain managed by Cloudflare
• SSH key authentication already configured on the Pi

Implementation

#

Step 1: Verify SSH Access

#

Before traveling, confirm you can SSH into your Pi from outside your home network:

ssh [email protected]

If that works, you are ready to proceed.

Step 2: Open the SOCKS5 Tunnel

#

Run the following command on your client device. The -D flag tells SSH to open a local port and forward all traffic through the tunnel.

ssh -D 1080 -N -q [email protected]

What each flag does:

• -D 1080 opens a local SOCKS5 proxy on port 1080
• -N tells SSH not to run a remote command, just hold the tunnel open
• -q suppresses output so it runs quietly in the background

Leave this terminal open while you are using the proxy. Your Pi is now acting as a SOCKS5 proxy on localhost:1080.

Step 3: Configure Your Browser

#

Firefox has built-in proxy settings that do not affect the rest of your system.

1. Open Firefox and go to Settings
2. Search for proxy and click Settings under Network Settings
3. Select Manual proxy configuration
4. Set SOCKS Host to 127.0.0.1 and Port to 1080
5. Select SOCKS v5
6. Check Proxy DNS when using SOCKS v5 to route DNS queries through the tunnel and prevent DNS leaks
7. Click OK

For system-wide proxy settings, use 127.0.0.1 and port 1080 in your OS network settings. Windows users should note that some apps fall back to SOCKS4 by default.

Step 4: Mobile Devices

#

Android and iOS do not support SOCKS5 natively for system-wide use. On Android, use Termux to open the SSH tunnel and configure Firefox separately. On iOS, the most practical option is a WireGuard VPN, which is covered in a separate tutorial.

Step 5: Verify Your Traffic Is Routed Correctly

#

With the tunnel open and your browser configured, visit https://ifconfig.me. You should see your home IP address, not the IP of the coffee shop or hotel network.

If you still see the local network IP, check that:

• The SSH tunnel command is still running in your terminal
• The browser proxy settings are saved correctly
• You selected SOCKS v5 and not SOCKS v4
• The proxy DNS option is enabled in Firefox

Step 6: Make the Tunnel Persistent (Optional)

#

If you want the tunnel to reconnect automatically when the connection drops, use autossh.

# Install autossh
sudo apt install autossh      # Debian/Ubuntu/Pop!_OS
brew install autossh          # macOS

# Run the tunnel with autossh
autossh -M 0 -f -D 1080 -N -q [email protected]

The -M 0 flag lets SSH handle keepalives itself and -f runs it in the background.

Lab Notes & Troubleshooting

#

The tunnel keeps dropping. Use autossh as covered in Step 6. It monitors the connection and restarts it automatically.

I still see the hotel IP after configuring the proxy. The SSH tunnel command must be running in an open terminal. If you closed it, the tunnel is gone. Re-run the command and try again.

DNS is leaking. Make sure the Proxy DNS when using SOCKS v5 checkbox is enabled in Firefox. Without it, DNS queries bypass the tunnel.

Mobile does not work. Android and iOS require third-party apps for SOCKS5. For a cleaner mobile solution, set up WireGuard on your Pi instead.

Summary

#

You now have a way to browse securely on any untrusted network by routing traffic through your home Raspberry Pi over an encrypted SSH tunnel. The setup requires no special software beyond SSH and takes about 30 minutes to configure. When you are done, close the terminal running the SSH command and remove the proxy settings in your browser to return to normal browsing.