Multi-hop Proxies
What are Multi-hop Proxies
Multi-hop proxies (multi-stage proxies, proxy chaining) are a method of routing traffic sequentially through multiple proxy servers. Instead of a single intermediate node, a chain of 2-5 or more servers is used, each of which only knows the previous and next node in the chain.
The goal is maximum anonymity: no single node in the chain knows both the source and destination of the traffic simultaneously.
How Multi-hop Works
Chain Principle
The client connects to Proxy 1, which forwards the traffic to Proxy 2, which then forwards it to Proxy 3, and finally Proxy 3 connects to the target website.
What Each Node Sees
Proxy 1: Knows the client's IP and Proxy 2's IP. Does not know the final destination.
Proxy 2: Knows Proxy 1's IP and Proxy 3's IP. Knows neither the client nor the final destination.
Proxy 3: Knows Proxy 2's IP and the target website. Does not know the client.
Target Website: Knows Proxy 3's IP. Does not know about the existence of the client or previous nodes.
Encryption in the Chain
For maximum security, each hop should use a separate layer of encryption (onion encryption):
The client encrypts data with three layers. Each proxy removes its layer and only sees the address of the next hop. This is the operating principle of Tor.
Types of Multi-hop
Simple Chain (proxy chain)
Proxies connect to each other in a chain. There is no multi-layer encryption. Each node sees the traffic in plain text.
Tools: ProxyChains, Proxifier.
Onion routing
Multi-layer encryption. Each node can only decrypt its own layer. Maximum anonymity.
Example: Tor (3 hops: Guard → Middle → Exit).
Cascading VPN
Sequential connection through multiple VPN servers. Each hop is a VPN tunnel.
Example: Mullvad (2-hop), IVPN (multi-hop).
Custom Chain
Combination of different proxy types: VPN → SSH → SOCKS5 → HTTP. Each hop uses a different protocol and provider.
Anonymity Levels
| Hops | Anonymity Level | Latency | Application |
|---|---|---|---|
| 1 | Basic | +10-50 ms | Regular use |
| 2 | Enhanced | +30-100 ms | Increased privacy |
| 3 | High (Tor) | +100-500 ms | Anonymity |
| 4-5 | Maximum | +200-1000 ms | Paranoid mode |
Advantages
1. Increased Anonymity
No single node possesses the complete picture. Even the compromise of one node does not reveal the client-server connection.
2. Protection Against Correlation Analysis
Multiple hops make timing correlation analysis of traffic (timing correlation attack) more difficult.
3. Jurisdictional Diversity
Nodes in different countries — it is difficult for law enforcement agencies in one country to obtain logs from all nodes.
4. Combining Providers
Different providers at each hop — compromising one does not grant access to the entire chain.
Disadvantages
1. Significant Speed Reduction
Each hop adds latency. 3 hops can increase ping by 5-10 times.
2. Reduced Bandwidth
Speed is limited by the slowest node in the chain.
3. Increased Points of Failure
If any node in the chain fails — the entire chain breaks.
4. Configuration Complexity
Correct multi-hop configuration requires an understanding of network protocols.
5. False Sense of Security
More hops do not always equate to more security. If all hops belong to the same provider — anonymity is zero.
Practical Configuration
ProxyChains (Linux)
Proxy chain configuration via the proxychains.conf file. Supports modes:
- strict (strict chain — all hops are mandatory)
- dynamic (skipping unavailable hops)
- random (random order of hops)
Proxifier (Windows/macOS)
GUI application for configuring proxy chains. Supports rules based on applications and domains.
SSH Chains
Sequential SSH tunneling through multiple servers.
Tor + Proxy
Adding a proxy before or after Tor:
- Proxy before Tor: hides the fact of Tor usage from the ISP
- Proxy after Tor: changes Tor's exit IP to the proxy's IP
Recommendations
- Use different providers for each hop
- Place hops in different jurisdictions to protect against legal requests
- Do not exceed 3-4 hops — further increases harm speed more than they help security
- Encrypt each hop — HTTPS, SSH, or VPN at each segment
- Test for leaks — check DNS and WebRTC at each stage
- Monitor stability — the failure of any hop interrupts the session
Conclusion
Multi-hop proxies are an advanced technique for achieving maximum anonymity. A correctly configured chain of 2-3 hops in different jurisdictions and with different providers ensures a high level of protection. The main thing to remember: the quality of the configuration is more important than the number of hops.