Use forward Chisel SOCKS and version-supported UDP routing

Needs: Compatible client/server roles, reachable carrier, correctly placed SOCKS listener and explicitly supported UDP-aware mode when required

Shell commands

# Baseline
# Pivot/server side
chisel server --socks5 --port CHISEL_PORT

# Kali/client side
chisel client --fingerprint 'SERVER_FINGERPRINT' PIVOT:CHISEL_PORT \
  127.0.0.1:1080:socks

Current upstream Chisel distinguishes

# Current upstream Chisel distinguishes
socks / R:socks       -> SOCKS5 TCP CONNECT only
udpsocks / R:udpsocks -> TCP CONNECT plus SOCKS5 UDP ASSOCIATE

Shell commands

# Baseline
# Requires compatible current peers
chisel client --fingerprint 'SERVER_FINGERPRINT' \
  LHOST:CHISEL_PORT R:127.0.0.1:1080:udpsocks

This does not make ProxyChains UDP-capable—ProxyChains remains TCP-only. The UDP application must support SOCKS5 UDP ASSOCIATE, or another compatible adapter must be used. Current Chisel peers, TCP and UDP firewall access to the SOCKS listener, and its documented association/fragmentation limits all matter.

Verify → Verify the actual required transport end to end, with correct listener/exit placement.

If it fails → Version syntax, client compatibility and UDP destination reachability must all hold. Retain the known-working TCP path. More detail ↓

If → then

Several protocols/subnets require a route-style interface through an agent → Route a selected internal subnet through Ligolo-ng
Needs: Compatible proxy/agent, permitted local interface/route management, reachable carrier and selected assigned subnet
A SOCKS listener or an SSH jump host is already available → Use ProxyChains, native SOCKS clients and SSH jump paths appropriately
Needs: Client/proxy transport compatibility, correct proxy configuration and controlled name resolution
An IP connection works while hostname/Kerberos access fails → Preserve DNS, Kerberos names and time across a pivot
Needs: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use forward Chisel SOCKS and version-supported UDP routing

USE WHEN: The assessment-side client can reach a pivot-side tunnel server
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A forward proxy route with documented TCP/UDP behavior

Recognize the clue

Identify which side can reach a tunnel server, then inspect the exact peer version and whether TCP or SOCKS5 UDP ASSOCIATE is required.

chisel --version
chisel client --help

SYNTHETIC EXAMPLE OUTPUT

Tool-side client -> pivot server: possible
Needed transport: TCP, or explicitly supported UDP-aware mode
Ordinary ProxyChains: TCP-only

Means: Forward placement and actual client transport determine the mode; a UDP-capable tunnel binary does not make every wrapper UDP-capable.

Confirm: Verify compatible peers, server SOCKS setting, listener route and the real application's UDP/TCP support.

After validation: The intended application's required transport works end to end: use that configured mode.
Ruled out in this context: A TCP-only wrapper is used for a UDP-only operation: reject that combination.
Still inconclusive: TCP success without UDP-aware client/firewall evidence leaves UDP unresolved.

Troubleshooting: Version syntax, client compatibility and UDP destination reachability must all hold. Retain the known-working TCP path.

Current upstream Chisel distinguishes:

This does not make ProxyChains UDP-capable—ProxyChains remains TCP-only. The UDP application must support SOCKS5 UDP ASSOCIATE, or another compatible adapter must be used. Current Chisel peers, TCP and UDP firewall access to the SOCKS listener, and its documented association/fragmentation limits all matter.

Why it works

Forward and reverse Chisel place listeners differently. Ordinary SOCKS clients/ProxyChains do not acquire UDP support merely because a tunnel binary offers a UDP-aware mode.

Worked example · hypothetical

Observation: forward SOCKS works for TCP but a UDP-dependent client fails. Test: inspect Chisel version and that client's UDP/SOCKS support. Illustrative output: the client is TCP-only. Interpretation: select a compatible routed/UDP route instead of assuming the tunnel carries the traffic.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗