How can I force SOCKS proxy(Danted) to open UDP port

Question

I nearly waste my 1 day for this issue.

I have 2 PCs; 1. Windows as a client, 10.20.30.20 2. Debian(latest) as a server, 10.20.30.10

I install Dante(SOCKS proxy) and configure/restart it. I can use this SOCKS proxy(10.20.30.10/1080TCP) from "1". (Firefox, No auth)

So I add this proxy to uTorrent's connection setting. Proxy Server: Type=SOCKS5, Proxy=10.20.30.10, Port=1080, No Auth

uTorrent start using my SOCKS proxy, but it can't connect to DHT/UDP. uTorrent make these connections(example);

*65432 = uTorrent's Listening Port

TCP 10.20.30.20:(random)->10.20.30.10:1080 {Yeah, this is what I'm expected!}
UDP 10.20.30.20:65432->10.20.30.10:(random) {Huh?}

Since uTorrent make a UDP packet, and Dante doesn't open UDP port(s) UDP packet was ignored(drop) by a server. Dante is opening only 1 port(TCP 1080), and I can't understand why uTorrent is not using TCP protocol when relaying UDP.

My questions are: 1. How can I force Dante to open UDP port dynamically, when asked? 2. If "SOCKS5 is supporting UDP" is true, why uTorrent can't send UDP to TCP port?

---

dante setting

logoutput: syslog
internal: 10.20.30.10 port = 1080
external: tun0
method: username none
clientmethod: none
user.privileged: root
user.notprivileged: nobody
user.libwrap: nobody
connecttimeout: 50

client pass {
from: 10.20.30.20/32 port 1024-65535 to: 0.0.0.0/0
}
client block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}

block {
from: 0.0.0.0/0 to: 127.0.0.0/8
log: connect error
}
pass {
from: 10.20.30.20/32 to: 0.0.0.0/0
protocol: tcp udp
#command: bind connect udpassociate
##^ I already tried Enable/Disable command, change from to 0.0.0.0/0, and so on, but no success!
}
block {
from: 0.0.0.0/0 to: 0.0.0.0/0
log: connect error
}

Answer 1

I had same issues with UDP not working even though I used protocol: tcp udp. After playing with it, changing the following to the socks pass commands below worked for me.

client pass...
client block...

socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    command: bind connect udpassociate
}
socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    command: bindreply udpreply
}

Answer 2

Just in case, in addition to @anonnecroguest's answer:

The Dante SOCKS server supports five commands that can be used in the rule statements (bind, connect, udpassociate, bindrepy, udpreply). Conceptually, these fall into two groups; the first three correspond to requests made by the internal clients. The from address will be the address of the internal client and the to address will be the address of the external machine the client wishes to communicate with.

The remaining two (bindreply and udpreply) correspond to the result of communication made by external hosts, either a TCP connection made to a port binding created with bind, or an UDP packet sent to a port bound with udpassociate. For these two commands, the from address will correspond to the external host, and the to address to the internal client. For this reason, separate rules have been created for the two sets of commands.

Source: https://www.inet.no/dante/doc/1.3.x/config/server.html

For UDP, bind operations are not supported. The SOCKS client must send the first UDP packet. The SOCKS client also has no direct way to know what address the SOCKS server uses to forward the UDP packets it sends...
Third, for the BIND and UDPASSOCIATE operations, when a remote host attempts to connect or send a UDP packet to the SOCKS client via an association previously created by the client.

Source: https://www.inet.no/dante/doc/1.4.x/config/socks.html

#generic pass statement - bind/outgoing traffic
socks pass {  
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bind connect udpassociate
#        log: error # connect disconnect iooperation
        socksmethod: authmethod2
}

# ...

# generic pass statement for incoming connections/packets
socks pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bindreply udpreply
#        log: error # connect disconnect iooperation
} ```

Source: https://www.inet.no/dante/doc/1.4.x/config/auth.html

---

Related:
https://stackoverflow.com/a/49975561/5113030 (UDP relaying configuration with Dante...)
https://www.inet.no/dante/doc/1.4.x/config/session.html (This page describes how the session functionality can be configured...)