What is a backconnect proxy?
Definition
One gateway address that sends each request or session through a different exit in the provider's pool, so your configuration never changes.
The name describes which way the connection runs. Exit devices, often home machines behind NAT that cannot accept inbound connections, dial out to the provider and keep that link open. The provider then sends your traffic back down it. You configure one hostname and port, and behind it the gateway picks an exit from the pool: a new one per request, the same one for a session, or a new one after a time window.
your client ──▶ gateway gw.example.net:8000 ──▶ exit device ──▶ target site
▲ │
└── tunnel opened outward ───┘
by the exit, kept aliveResidential services work this way because there is no other practical way to reach consumer devices. The IEEE Security and Privacy study of five residential proxy services describes the customer’s view exactly so: on sign-up you receive a gateway address or URL, and the gateway forwards each request to different residential hosts, which send it to the target and relay the response.
Three ways the gateway picks an exit
The same study sorted gateways by how they reuse exits. The labels are the researchers’; providers use their own names for the same behaviour.
| Model | What the gateway does | How you usually ask for it |
|---|---|---|
| Non-sticky | Moves to a different exit after every request it forwards | The plain credentials, or a rotating port |
| Sticky | Keeps the same exit until it goes offline, then switches to the next; some let you set a sticky time | A session label in the username, or a sticky port |
| Half-sticky | Lets the client switch between the two during a run by changing a parameter such as the session ID | Changing the session label when you want a new exit |
In practice the difference looks like this. The username syntax is a placeholder, because every provider formats it differently:
# Non-sticky: expect a different exit address on each line
for i in 1 2 3; do curl -s -x http://user:pass@gw.example.net:8000 https://api.ipify.org; echo; done
# Sticky: same session label, same exit until that device drops
for i in 1 2 3; do curl -s -x http://user-session-a1b2:pass@gw.example.net:8000 https://api.ipify.org; echo; doneWhat the single endpoint hides
A stable hostname makes the configuration simple and the diagnosis harder. A refused connection could come from the gateway, from the exit it chose, or from the target. Latency to the gateway says nothing about the path from the exit to the site. The gateway’s own location is not the exit location, so geo-targeting is a request you make through parameters, not something the hostname tells you.
There can also be more machinery than you see. The researchers found hidden backend gateways sitting between the advertised frontend gateway and the exits. Some backends had been labelled malicious and were dropped by the providers, while every frontend gateway stayed clean and long-lived. Name resolution varies too: four of the five services resolved the target’s hostname on the exit device, and the fifth could do it on either side by configuration. That decides which resolver the target’s DNS server sees. If that matters to you, use socks5h or an HTTP proxy, which both hand the hostname to the proxy side, and then ask the provider where it resolves.
Why an exit can vanish mid-transfer
The exit is somebody’s device. Its owner closes a laptop, a phone changes network, a router reboots, and no protocol warns you first. The study saw the effect at scale: exits thinned out during local night hours across time zones, the pattern you would expect from home devices being switched off.
Treat a dropped transfer as routine. Retry it, and keep the retry on the same session label if the job needs one identity, accepting that the gateway may have to hand you a new exit anyway. The rotation guide covers how to detect a session that ended early, and the status-code guide covers separating a proxy-side failure from a target-side one.
Backconnect or a list of addresses
A list of fixed addresses still makes sense when you want the opposite property: one known identity that does not move, as with most datacenter and ISP products. A backconnect gateway is the right shape when the exits are many, short-lived and outside the provider’s control. The proxy type guide works through which of the two a job needs, and what is a proxy server? covers the request path underneath both.