NaïveProxy Quickstart: Server and Client Setup Guide

This guide walks you through deploying a complete NaïveProxy setup: a Caddy-based server on a remote host and a local client that exposes a SOCKS5 proxy. By the end your browser traffic will travel through an authenticated HTTPS tunnel that looks identical to regular Chrome activity.

Always download the latest NaïveProxy client release. The binary embeds a specific Chromium version, and its TLS fingerprint must match current Chrome to be effective. Using an outdated build produces signatures a censor can distinguish from real browser traffic.

Server Setup
Client Setup

The recommended server-side stack is Caddy built with the NaïveProxy fork of the forwardproxy plugin. This single binary handles TLS termination, serves real web content to unauthenticated visitors (active-probing resistance), and forwards authenticated proxy requests with padding.

Install xcaddy

xcaddy is the official tool for building Caddy with custom plugins. Install it with:

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest

Build Caddy with the naive forwardproxy plugin

Build a Caddy binary that includes the NaïveProxy fork of forwardproxy:

~/go/bin/xcaddy build \
  --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive

Alternatively, download a pre-built binary from the forwardproxy releases page.

Create a Caddyfile

Create a Caddyfile in the same directory as your caddy binary. Replace user, pass, me@example.com, and example.com with your own values:

{
  order forward_proxy before file_server
  log {
    exclude http.log.error # Avoid logging user activity
  }
}
:443, example.com {
  tls me@example.com
  encode
  forward_proxy {
    basic_auth user pass
    hide_ip
    hide_via
    probe_resistance
  }
  file_server {
    root /var/www/html
  }
}

:443 must appear first in the site address list for this Caddyfile to work correctly. The probe_resistance directive instructs Caddy to serve ordinary web content to any request that lacks valid credentials, preventing active probing of the proxy’s existence. See the Caddy TLS docs for certificate customization options, and the HAProxy setup wiki if you prefer HAProxy as a frontend.

Run Caddy

Grant Caddy permission to bind to privileged ports, then start it:

sudo setcap cap_net_bind_service=+ep ./caddy
./caddy start

Caddy will automatically obtain a TLS certificate from Let’s Encrypt for example.com. See also the Systemd unit example for running Caddy as a persistent background service.

The naive client binary runs on your local machine. It reads a small JSON config file and starts a SOCKS5 listener that you can point any application or browser at.

Download the naive binary

Download the latest naive binary for your platform from the GitHub releases page.On Linux, mark it executable after downloading:

chmod +x ./naive

Create config.json

Create a config.json file in the same directory as the binary. Replace user, pass, and example.com with the credentials and hostname you configured on the server:

{
  "listen": "socks://127.0.0.1:1080",
  "proxy": "https://user:pass@example.com"
}

This configures a SOCKS5 listener on 127.0.0.1:1080 that tunnels all traffic through your NaïveProxy server over HTTPS.

If HTTPS performance is poor on your network path, try switching to QUIC by replacing https:// with quic:// in the proxy URI:

{
  "listen": "socks://127.0.0.1:1080",
  "proxy": "quic://user:pass@example.com"
}

QUIC (HTTP/3) can provide lower latency and better performance under packet loss. See How It Works for details on the QUIC transport option.

Start the proxy

Run naive from the directory containing config.json:

./naive

Or pass the config file path explicitly:

./naive config.json

The client will start and your SOCKS5 proxy will be available at 127.0.0.1:1080. Configure your browser, operating system, or any SOCKS5-aware application to use it.

What’s Next

Advanced configuration — see parameter usage for all naive flags including --insecure-concurrency, --tunnel-timeout, --idle-timeout, and log options.
Server alternatives — the HAProxy setup guide documents using HAProxy as a frontend instead of Caddy.
Understand the internals — read How It Works to understand what makes this traffic hard to detect.

Get Started

Server Setup

Client Setup

Advanced

NaïveProxy Quickstart: Server and Client Setup Guide

What’s Next

Build docs developers (and LLMs) love

Get Started

Server Setup

Client Setup

Advanced

Documentation Index

​What’s Next

Build docs developers (and LLMs) love

What’s Next