VPN vs SOCKS5 Proxy: The Proxy Fixed My Browser and Left the Incident Broken

The status dashboard turned green.

My terminal still said:

Connection timed out.

I was on a train between Prague and Berlin when our checkout service began rejecting payments. The engineering lead had found the bug. I needed to change one configuration file, push it to the repository and watch the emergency deployment finish.

The train Wi-Fi could open news sites but kept losing the development dashboard. I configured a SOCKS (IETF) proxy in Firefox, refreshed the page and watched it load immediately.

I assumed the problem was solved.

Then git push failed.

The desktop messenger showed me as offline.

The authentication request never reached the approval app.

I checked my public IP address in Firefox. It showed the proxy location exactly as expected.

That reassured me for almost a minute.

Then I realised what the test had actually proved: Firefox was using the proxy.

The rest of the incident was still travelling through the train’s connection.

The proxy had completed one narrow job

SOCKS (IETF) lets a compatible application send its connections through a proxy server. (IETF)

That was why the Firefox setup had been so quick. I entered the host and port, selected SOCKS (IETF) and enabled proxied DNS in the browser’s connection settings. (MDN)

The dashboard worked.

The IP-check page displayed the proxy address.

The admin console stopped timing out.

For work contained entirely inside Firefox, that might have been enough.

The production incident was not contained inside one browser.

I needed Firefox for the status dashboard, the terminal for Git, a desktop messenger for the engineering channel and a separate approval app on my phone.

The proxy had not failed at the job I gave it.

I had mistaken one working application for a working workflow.

The green IP test hid everything outside Firefox

I opened the terminal and checked its route.

It was still using the train Wi-Fi directly.

I added a proxy setting for the command-line tools and tried the push again.

The repository connection opened.

Then the credential helper failed to complete its browser handoff.

I returned to Firefox, approved the sign-in and tried again.

This time, Git began transferring the change, but the desktop messenger remained offline. It did not inherit Firefox’s proxy settings and offered no convenient place to enter the same SOCKS (IETF) details.

I now had three different network states on one laptop:

Firefox through the proxy.

The terminal partly configured for the proxy.

The messenger connecting directly.

Other users run into the same basic confusion: the browser shows a proxy address, but that does not mean every application follows it. (Reddit)

My screen made the consequence obvious.

Every application needed its own support, its own setting or another routing tool. Anything I missed could continue using the original network without appearing in Firefox’s IP test.

A changed route was not a complete protected connection

I had also treated “proxy” and “VPN” as interchangeable.

They were not.

SOCKS (IETF) forwards traffic for applications configured to use it. It does not, by itself, create one encrypted connection for the entire device. (IETF)

The services in my workflow still used HTTPS, so their own connections protected the data exchanged with them. (Ftc) The more immediate problem was fragmentation.

The browser followed one route.

The terminal followed another.

The messenger followed a third.

A background authentication service could connect directly without any warning inside Firefox.

With thirteen minutes left in the maintenance window, I no longer had time to investigate which tool was using which path.

The proxy had saved time at the beginning and charged it back application by application.

Configuring every tool consumed the time the proxy saved

I found a proxy option inside the Git client and entered the same host, port and credentials.

The push began again.

At 62 percent, the train passed through a weak section of Wi-Fi.

Firefox recovered.

The terminal did not.

The Git client returned:

Unexpected disconnect while reading sideband packet.

I restarted the transfer.

The authentication flow opened in Firefox but returned to the dashboard instead of the credential helper.

Then the messenger reconnected directly, delivered twenty-seven accumulated messages and notified the team that I had disappeared during the deployment.

That was the point when the proxy stopped feeling lightweight.

Inside Firefox, it was simple.

Across the incident, it had created a collection of separate network projects.

I could keep adding proxy settings, environment variables and routing tools.

Or I could place the whole workflow behind one connection and let the applications behave normally.

I chose the second option.

The established VPN covered more and still lost the push

I closed the proxy settings and opened my established commercial VPN.

It had years of public history, mature applications and servers throughout Europe. Unlike the browser proxy, it could cover Firefox, Git and the messenger without separate configuration.

I selected the automatic location.

The VPN remained on Connecting.

I tried Germany.

The tunnel opened, and the messenger came online.

Firefox loaded the dashboard.

The Git push reached 18 percent and stopped.

A Czech route connected more quickly but lost the repository during authentication.

The VPN app showed an active connection. Normal webpages loaded. The production tools still could not complete the deployment.

The situation had now become clearer.

The SOCKS (IETF) proxy covered too little.

The established VPN covered the laptop but could not keep the route stable on the train Wi-Fi.

The maintenance window had eight minutes remaining.

I did not need another country or another IP test.

I needed the patch to reach the repository.

One route brought the incident back together

I closed the established provider and opened OnlydogVPN.

The smaller app did not begin with a country list. I selected the situation for working across a restrictive public network and connected.

Then I reopened the tools in the order I needed them.

The engineering messenger refreshed.

Firefox loaded the deployment dashboard.

The terminal reached the repository.

I ran the push.

Twenty percent.

Fifty.

The train Wi-Fi weakened again.

The transfer continued.

The repository accepted the change.

The deployment pipeline started.

The first test passed.

Then the second.

The production rollout moved from Pending to Running.

I sent the incident channel a message:

Patch is deploying now.

It delivered immediately.

On the dashboard, the checkout error rate began falling.

A test payment completed.

Then another.

The status page changed to:

All systems operational.

For the first time since the incident began, every application told the same story.

Only after the checkout recovered did the connection design matter. The smaller service uses an HTTP/3-based transport with added traffic obfuscation, giving the whole workflow one responsive route without requiring each application to support SOCKS5.

I could not inspect the train network’s internal filtering rules or identify the exact cause of every earlier failure. The visible result was decisive: the proxy restored one browser, while the smaller app restored the incident.

The connection survived the station

A few minutes later, the train entered Dresden station.

Its Wi-Fi disappeared beside the platform.

My phone hotspot took over.

The messenger paused.

Then the incident channel refreshed.

The VPN remained connected.

The dashboard continued updating, and the final deployment check changed from Running to Completed.

The HTTP/3-based route recovered when the laptop changed networks. (IETF)

On the screen, the result was simple:

Train Wi-Fi vanished.

Mobile data took over.

The incident remained closed.

That recovery gave the smaller app another advantage over the proxy setup.

I did not need to restore browser settings.

I did not need to reset terminal variables.

I did not need to wonder which application had returned to a direct route.

The whole workflow moved together.

SOCKS ( IETF ) still had a useful place

The incident did not make SOCKS (IETF) obsolete.

I would still use a SOCKS (IETF) proxy when I deliberately wanted to route one compatible application and leave everything else alone.

A developer might send one browser through a proxy to inspect an internal page.

A researcher might separate one browsing session from ordinary applications.

A download client might use a dedicated proxy without changing the rest of the device.

In those cases, application-level control is the benefit.

It becomes a weakness when the task crosses several applications and the user assumes the proxy covers all of them.

My emergency deployment required a browser, terminal, credential handoff, messenger and background services.

Treating each one as a separate proxy configuration was the wrong level of control.

The faster setup was the one I did not have to repeat.

A proxy IP was the wrong success test

The SOCKS (IETF) proxy passed the test I originally gave it.

Firefox displayed a different public IP.

That said nothing about Git, the messenger or the authentication helper.

The established VPN passed a broader visual test. Its app showed a connected tunnel.

That still did not prove the production tools could complete their work on the train network.

The smaller service passed the test that mattered:

The patch reached the repository.

The deployment completed.

The team stayed connected.

The checkout recovered before the maintenance window closed.

The smaller service has fewer locations and a shorter public history than the largest VPN providers.

Neither limitation affected the incident.

I began by comparing a VPN and SOCKS (IETF) as two ways to change an IP address.

The checkout came back when I compared them by the size of the task: the proxy carried one configured application, while the smaller VPN carried everything required to repair production.