Torrent client proxy support: which of 15 clients route peers, trackers, DHT and UDP through a proxy, with lab counts and the cost per verified GB

Most torrent clients have a proxy setting. Far fewer send everything through it, and the difference only shows up when you count. This page puts fifteen clients in one table, built from each project's own documentation and source, and adds what we measured on 2026-10-08 for the four we could run in a lab: qBittorrent, Deluge, Transmission and aria2. Every client has its own guide with the setup and the check; this is the comparison.

The constraints are the same for all of them. A proxy relays connections; it does not encrypt them. Anything a client sends around the proxy leaves from your own IP, and swarms are public. Treat our SOCKS5 as TCP only: we do not advertise UDP relay, so DHT, UDP trackers and uTP will not run through it even in a client that tries. An HTTP proxy carries no UDP in any client. Residential traffic is billed per GB, and so is a shared IP's traffic past its included gigabyte, and a torrent you seed sends its payload through the proxy twice; the terms say how it is counted. For a copyright-enforcement worry, the projects' own advice is a VPN: qBittorrent's wiki says so outright. We cover lawful swarms, such as Linux and BSD images, open-source releases, public-domain archives and research data. Unauthorised sharing through our proxies is not allowed under the allowed-use policy.

#The table

"Documented" means the project's own docs or help centre say it; "source" means we read the code at a tagged release, which is good evidence but not a runtime test; "lab" means we ran it.

Three clients cannot hide your address from peers at all: Transmission, aria2 and WebTorrent Desktop. Four are mostly unknown: Free Download Manager, Vuze, Flud and, for UDP, BitComet. The rest can proxy peers when set correctly, and qBittorrent is the one where "set correctly" needs two extra boxes.

#How we measured

Docker containers on one Linux host, with two test proxies on the same network:

• SOCKS5: Dante 1.4.4, username and password required, UDP ASSOCIATE and BIND refused, so it behaves like a TCP-only gateway.
• HTTP: tinyproxy 1.11.3 with basic authentication, allowing CONNECT to any port.

Clients came from Alpine Linux packages: qbittorrent-nox 5.2.4 with libtorrent 2.1.0, transmission-daemon 4.1.3 and aria2 1.37.0 from the edge branch, and Deluge 2.2.0 with libtorrent 2.0.11 from 3.22. Each run started from an empty profile, added the Debian 13.7.0 netinst torrent (one HTTP tracker, two web seeds) with a 1 MiB/s download cap, waited 90 seconds, captured 60 seconds of UDP with tcpdump, and listed established TCP connections with ss. A short script classified UDP packets by their first bytes as uTP, DHT or UDP-tracker traffic, counting only packets the client sent to internet hosts.

Each configuration ran once, except qBittorrent with both boxes on SOCKS5, which we ran twice with the same 100 of 100 result; treat the rest as single observations. The method proves routing. It does not measure speed or anonymity, every exit address was our own, and we publish no speed figure.

#Lab results

Two results are worth more than the rest. Deluge and qBittorrent run the same engine, and what separated "everything proxied" from "nothing proxied" in our runs was two unticked boxes in qBittorrent. And the libtorrent clients, given a proxy that refuses UDP, dropped DHT and uTP instead of sending them direct; the UDP count went from tens of thousands of packets to zero.

#Cost per verified gigabyte

A gigabyte is verified when the socket count shows it crossed the proxy. Only those gigabytes buy anything: an address the swarm sees in place of yours. Through a client that proxies peers, a 10 GB download seeded to a ratio of 1.0 is at least 20 GB of proxy traffic, $79.00 on residential at checkout, which is $3.95/GB, paid twice for every gigabyte you keep. Protocol overhead and discarded pieces come on top.

The middle row is the one that surprises people. Our Transmission and aria2 runs fetched from the torrent's web seeds through the proxy, so a client that masks nothing can still run up traffic. A datacenter IP at $1.90/IP (dedicated) a month, or ISP at $3.20/IP (dedicated), has no bandwidth cap, though port speed and fair use bound it; for steady seeding that is usually the cheaper model, and the cost calculator finds the crossover for your volume. Peer-to-peer traffic for lawful content is fine on residential and on dedicated ISP and datacenter IPs, which carry no traffic meter. If the file is all you need, the project's HTTP mirror moves it through the proxy once.

#Reproduce the count on your machine

On Linux, with your proxy's IP and port:

PROXY=203.0.113.10:1080
ss -Htnp state established | grep CLIENT \
  | awk -v p="$PROXY" '$4 == p { via++ } $4 != p { direct++ } END { print "via proxy:", via+0, "direct:", direct+0 }'
ss -Huanp | grep CLIENT
sudo timeout 60 tcpdump -nni any "udp port LISTEN_PORT" 2>/dev/null | wc -l

On Windows, Get-NetTCPConnection -OwningProcess PID -State Established and Get-NetUDPEndpoint -OwningProcess PID give the same two lists, and Wireshark's udp.port == PORT does the capture. On macOS, lsof -nP -i -a -p PID. Note the exit address first with the curl line on our proxy checker. Run each configuration at least twice and restart the client between changes; one run is an anecdote, as our guide to testing a proxy provider argues at length.

For why SOCKS5 is the right protocol for peers and HTTP is not, see HTTP vs SOCKS5 proxies; for the question this table cannot answer, proxy vs VPN.