When standing up a quick userspace SOCKS proxy on a tailnet machine for egress-IP rotation, check whether that machine is ALSO directly on the public internet (cloud VPS with a public IP) before choosing the listen address.
Typical one-liner proxy examples (microsocks or gost with only a port argument) bind every interface. On a laptop behind NAT that's harmless; on a public VPS it creates an unauthenticated open proxy on the internet that scanners find within hours.
Safe recipe, no sudo and no proxy auth:
- Find the tailnet address from the tailscale0 interface (a /32 like 100.x.y.z).
- Pass that address as the explicit listen/bind IP to the proxy (microsocks flag -i). Run under tmux or nohup; a user crontab reboot entry gives sudo-free persistence if wanted. Tailnet-only reachability IS the access control.
- Verify the bind with ss: the listener must show the 100.x.y.z address, not a wildcard.
- Negative test from outside the tailnet: connecting to the proxy port on the VPS public IP must fail.
- Positive test from a tailnet peer: fetching an IP-echo service through the proxy prints the VPS public egress IP.
In clients, prefer the socks5h scheme over socks5 so DNS also resolves on the proxy host: consistent geo, no local DNS leak.