A Rotating Proxy tunnel builds a proxy pool from your own devices: you select token groups, every connected device in them becomes an exit of one shared endpoint, and each of your users gets separate access as a client.
When to use it #
For a single device, use Proxy Server. For a pool, select a token group and use Clients to give each user separate access.
Billing. Each device in the pool counts toward tunnel usage and billing. See Plans and Balance.
Before you start #
- The Localtonet client is running on every device that should serve the pool, each with its own AuthToken.
- The tokens of those devices are in a token group. You manage groups under My Tokens, in Token Groups. See AuthTokens.
Create the pool #
-
Open the Rotating Proxy page #
Open My Tunnels › Rotating Proxy and expand Create Rotating Proxy Tunnel.
-
Fill in the form #
Field What to enter Proxy type Rotating HTTP or Rotating SOCKS5. Device token groups One or more groups containing the devices in your proxy pool. At least one group is required. Server region The server your proxy users connect to. URL type Random subdomain or Custom subdomain. A custom subdomain needs Balance. Subdomain Shown for Custom subdomain: the name you want. Domain The domain of the endpoint. Select Create tunnel.
-
Add a client #
In the Clients column select Clients, then Add client. A client is the username and password one of your users signs in with. See Clients.
-
Start the tunnel #
Select Start. The Server Domain and Server Port columns show the shared endpoint.
Token groups #
The token groups decide which devices serve the pool. Every connected device in a selected group becomes an exit of the shared endpoint and counts toward tunnel usage.
To change them, select Groups in the Token Group column of the tunnel. The Token groups window lists your groups with the number of tokens in each:
- Tick the groups to use. Select all ticks every group in the list, and Search groups narrows the list.
- A group marked "No tokens in this group yet, so it adds no devices" does nothing until you put tokens in it.
- At least one group must stay selected ("Select at least one token group.").
- If the tunnel is running, devices of the groups you add start serving as soon as you save, and those of the groups you remove stop.
If you have no groups yet, the window shows No token groups yet and a Create a token group link: put your devices' tokens in a group, then select it here.
Clients #
Each client signs in to the shared endpoint with its own username and password, and has its own usage, limit and expiry. Select Clients in the tunnel's row to open Proxy clients.
Add or edit a client #
Select Add client, or the Settings icon of a client to edit it.
| Field | What it does | Rules |
|---|---|---|
| Username and Password | The credentials of this client. Generate fills in a random username and password. | Both are required, 256 characters or fewer. Use a username without spaces or colons. A username can be used once per tunnel. |
| Bandwidth limit | Stops this client once it has transferred this much data. Enter a Limit and a Unit (MB, GB or TB), or use Quick set: 1 GB, 5 GB, 10 GB, 50 GB, 100 GB. | A whole number from 1 to 1024. |
| Expiration date | The client stops working after this date and time. Extend by adds 1, 7, 30 or 90 days, or a number of days you enter. Extending starts from the current expiry date, or from now if it has already passed. | Format DD.MM.YYYY HH:mm. |
| Note | Optional. Who the client is for. | Up to 500 characters. |
Select Add client or Save changes.
Expiration time zone. Expires at is in server time (UTC+3), not your local time. The client list shows the same moment in your own time when you point at the expiry.
The client list #
| Column or action | What it shows |
|---|---|
| Username, Password | The credentials. The password is hidden until you select the show button. |
| Usage | Data used so far, and the limit if one is set. Limit reached means the client is stopped; raise the limit in its settings to turn it back on. |
| Expires | Time left, Never or Expired. An expired client is stopped; extend the date in its settings to turn it back on. |
| Copy proxy | Copies the client as a ready-to-use proxy. |
| Request logs | Opens the requests recorded for this client. |
| Settings, Delete | Edit or delete the client. A deleted client can no longer use the proxy, and this cannot be undone. |
Above the list, Shared endpoint shows the address every client connects to, with a copy button, and Search clients filters by username or note. Two more buttons copy every client in the list, one per line: as proxies, or as username:password.
Copy format #
Each client is copied with its own username and password:
<HOST>:<PORT>:<USERNAME>:<PASSWORD>To try a client of a Rotating HTTP pool from a terminal:
curl -x http://<USERNAME>:<PASSWORD>@<HOST>:<PORT> https://example.comFor Rotating SOCKS5, use socks5h:// in place of http://.
Sticky sessions #
Normally each connection of a client can leave through a different device of the pool. To keep several connections on the same device, add a session ID to the client's username. The password stays the same:
<USERNAME>-session-<SESSION_ID><USERNAME>is the client's username.<SESSION_ID>is everything after-session-. You choose it yourself; use letters and digits.- The first connection with a new session ID is given to a device of the pool. Later connections with the same session ID go to that same device.
- To get a new session, use a different session ID. Without
-session-in the username, connections are not tied to a device. - A session does not keep a device online. When the device of a session is no longer connected, connections with that session ID can fail or continue on another device, so do not treat the exit IP of a session as guaranteed.
Sticky sessions work with Rotating HTTP and Rotating SOCKS5. For example:
curl -x http://<USERNAME>-session-<SESSION_ID>:<PASSWORD>@<HOST>:<PORT> https://example.comSettings #
Select the Settings icon of the tunnel to open Tunnel settings.
| Setting | What it does |
|---|---|
| Is Reserved? | Ensures that the Server Port value does not change. |
| Just Connect with Ipv4? | Use IPv4 for outgoing proxy connections. Stop the tunnel before you change it. |
| Tunnel Note | Save a private note to help you identify or document this tunnel. |
| VPN Access | Download a WireGuard or OpenVPN config that sends a whole device's traffic through this proxy. Each VPN device uses one proxy client: it uses the selected client's quota and expiry, and keeps a sticky exit device. See Proxy Server for the steps. |
| Server Port | Change the port clients use to connect. Stop the tunnel first. |
| Outbound Port | The devices in this proxy's token groups connect to this port. See Ports. |
| IP Restriction | Control which client IP addresses can access this tunnel. See Access control. |
| Tunnel IP | View the IPv4 and IPv6 addresses clients use to reach this tunnel. IP addresses may change; use the domain address where you can. |
| Bandwidth Traffic, Activity Log, Tunnel Health | Traffic over time, starts, stops and setting changes, and recent health check results. See Logs and inspection. |
Limits and expiry are set per client, not on the tunnel. Load balancing targets are not offered on this page; a rotating proxy takes its devices from its token groups.
Troubleshooting #
"Select at least one AuthToken group."
The Device token groups field is empty. Select a group, or create one under My Tokens first.
"Rotating proxy tunnels use AuthToken groups. Change the groups instead."
A rotating proxy has no single AuthToken to change. Select Groups in the tunnel's row and change the groups.
"Another client of this tunnel already uses this username."
Choose a different username for the client.
"If you want to edit this, you must stop the tunnel first!"
The server port and some other values can only be changed while the tunnel is stopped. Stop it, make the change and start it again.
A client stopped working
Open Clients and check the Usage and Expires columns. Raise the bandwidth limit or extend the expiration date in the client's settings.
"No port yet"
No port is assigned to this tunnel yet, so clients are copied without one. Copy the client again once the Server Port column shows a port.
