Using Polipo with Tor and SOCKS Parent Proxies

Polipo with Tor was a common pairing for years. Applications that only spoke HTTP could connect to the caching proxy, and the proxy forwarded their traffic to Tor's SOCKS port. The same technique works with any SOCKS proxy, which is why understanding the parent proxy settings is still useful today.

This guide explains the idea, shows the configuration, and highlights limits you must understand. Modern Tor Browser handles its own connections and does not need a separate HTTP proxy, so this setup is mostly relevant for other HTTP-only tools.

Why Put an HTTP Proxy in Front of SOCKS

SOCKS is a general-purpose proxy protocol. Many programs support only HTTP proxies, however, and cannot talk to a SOCKS server directly. Placing an HTTP proxy in front solves that mismatch: the program sends HTTP proxy requests, and the HTTP proxy translates them into SOCKS connections.

Earlier Tor bundles shipped an HTTP proxy for exactly this reason. Over time the Tor Project moved away from that approach, but the parent proxy feature remains a neat way to bridge HTTP-only software to a SOCKS endpoint you control.

Configuring the SOCKS Parent

Two variables do the work. socksParentProxy holds the host and port of the SOCKS server, and socksProxyType selects the protocol version. A local Tor client usually listens on port 9050, though your setup may differ.

proxyAddress = "127.0.0.1"
proxyPort = 8123
socksParentProxy = "localhost:9050"
socksProxyType = socks5

Keep proxyAddress on localhost for this kind of setup. Exposing an HTTP front end for a SOCKS tunnel to other machines widens who can use the tunnel, which is rarely what you want.

Choosing socks4a or socks5

Both socks4a and socks5 let the SOCKS server resolve host names, which avoids leaking DNS lookups to your local resolver. Pick the version your SOCKS server supports; socks5 is the more common choice today.

DNS and Leaks

When routing through a privacy tool, DNS matters as much as the connection itself. With a SOCKS parent configured, the proxy passes host names to the SOCKS server rather than resolving them locally. Still, applications can bypass the proxy for some requests, so verify behaviour with packet capture or your tool's diagnostics.

• Confirm the application really uses the HTTP proxy for every request.
• Check that no direct DNS queries leave the machine during use.
• Remember that plugins or helpers may ignore proxy settings.

Caching and Privacy Trade-offs

A cache stores what you fetched. On a privacy-focused setup, that history sitting on disk can be a liability. Many people disable the disk cache in this role by setting diskCacheRoot to an empty string, keeping the proxy as a pure translator.

Headers can also identify clients. Options such as censoredHeaders remove selected headers, but header changes alone do not make browsing anonymous. Fingerprinting happens at many levels, which is why dedicated privacy browsers exist.

Using an HTTP Parent Instead

If your upstream is another HTTP proxy, for example a company proxy, use parentProxy instead of the SOCKS variables. The proxy then forwards requests to that upstream and can still cache plain HTTP responses locally, which can reduce repeated traffic.

parentProxy = "proxy.example.lan:3128"

Testing the Chain

Test with a simple request through the HTTP proxy, then compare the result with your SOCKS server's logs or its own check page. If requests fail, confirm that the SOCKS server is running and listening on the port you configured.

curl -x http://127.0.0.1:8123 -I http://example.com/

Important Limitations

The project is archived, so it does not receive fixes for newer protocols or security issues. For anonymity-sensitive work, rely on actively maintained tools and follow the guidance of the privacy project you use. Our article on safety and maintenance status covers this in more depth.

Configuring Client Applications

Once the chain works, configure each HTTP-only program to use the local proxy. Many command-line tools respect the http_proxy environment variable, while graphical programs usually have a manual proxy setting. Point them at 127.0.0.1 and port 8123.

export http_proxy=http://127.0.0.1:8123
export https_proxy=http://127.0.0.1:8123

Setting https_proxy to the same HTTP proxy is common, because HTTPS requests are sent through it with CONNECT. Check each tool's documentation, as some use different variable names or ignore environment settings altogether.

Running Several Instances

You can run more than one instance with different ports and parents, for example one plain caching instance and one that forwards through SOCKS without a disk cache. Give each its own configuration file, port and, if caching, its own cache directory so they never write to the same files.

• Use separate configuration files passed with -c.
• Assign a unique proxyPort to each instance.
• Keep cache directories separate or disable caching where privacy matters.

Label each configuration file clearly so you always know which instance does what. A short comment at the top of each file describing its purpose prevents confusion months later.

Polipo with Tor FAQs

Conclusion

Polipo with Tor or any SOCKS proxy works by translating HTTP proxy requests into SOCKS connections through socksParentProxy and socksProxyType. Keeping it on localhost, choosing a SOCKS version that resolves names remotely and disabling the disk cache make the setup cleaner.

Because the software is no longer maintained, use this approach for experiments or HTTP-only tools, and choose current privacy tools for sensitive browsing. For the full option list, see the configuration guide.