How close can a proxy connection get to a direct Internet connection?

Aren't you tired of reading ads for yet another "best proxy service"?

"We have the highest-quality and fastest proxies in the entire galaxy..."

That's pretty much what the marketing of a typical proxy provider looks like. Sound familiar?

But what's actually behind these claims? Usually, nothing.

There are no objective tests with open-source code. No objective comparisons against a direct Internet connection or other proxy services.

All that's left are the provider's nice promises, while customers' accounts get blocked and/or hit with CAPTCHAs...

We're going to change that.

Our goal is to develop proxy technology whose technical characteristics are as close as possible to those of a direct Internet connection.

This is critical for applications that collect publicly available data from the internet, for automation, and for other tasks with high network bandwidth requirements.

Our engineering team has spent several years developing CloudEngine, our proprietary networking engine designed to solve this problem.

It allows you to monetize your ISP's unused bandwidth by deploying your own proxy service, or to use that bandwidth for your own needs.

But instead of simply claiming that our solution is the "best", we decided to demonstrate just how close it gets to a direct Internet connection.

We also plan to regularly compare our engine against solutions from other providers using measurable technical metrics.

For testing, we use our own custom-built, open-source benchmarks. You can download them from GitHub and run them locally.

To introduce you to the technology, we'll show the results of comparing an internet connection routed through our engine with a direct internet connection.

Let's get started!

You can connect to a dedicated modem using any of the supported protocols: SOCKS5, OpenVPN, Shadowsocks, or HTTPS.

For this test, we're using SOCKS5.

Once connected, the first thing we check is the basic characteristics of the network connection, such as speed and ping, using speedtest.net:

“But what’s the point of having high speed and ping close to a direct connection if the network connection can still be identified as a proxy?” you might say.

A direct connection without a proxy supports both TCP and UDP, whereas most proxies only support TCP.

Therefore, for a proxy connection to be indistinguishable from a direct connection, it must also support both TCP and UDP.

To check whether a proxy supports UDP, we use two QUIC tests:

• browserleaks.com/quic - the result should be true;
• quic.nginx.org/quic.html - all the QUIC indicators should be green;

Once we've confirmed that all protocols except HTTPS support UDP, we check whether the proxy can be detected based on ping:

• obfusgated.com/tools/vpn-detection-test - the closer to 0, the better;

Next, we check whether the proxy can be detected through passive operating system fingerprinting (p0f):

• tcpip.incolumitas.com - details.os_mismatch should be false. The closer avg_score_os_class[os] is to details.perfect_score, the better. However, the benchmark for comparison is avg_score_os_class[os] of the direct connection;

We also check whether the proxy's DNS servers match the mobile carrier's native DNS servers:

• browserleaks.com/dns

Good. Based on these tests, we found no differences between the direct Internet connection and the proxy connection.

“But what about typical real-world use cases? Is everything as good in practice as it looks in theory?“

To test various real-world scenarios, we developed a benchmark that you can download from GitHub and run locally.

Using this benchmark, we'll test data collection from major websites with serious anti-bot protection, including those using Cloudflare and Akamai.

We'll evaluate request success rates, how often CAPTCHAs and other challenges appear, content availability, and response times.

The test results showed a 100% request success rate, not a single CAPTCHA, and 100% of the content retrieved.

The full video of the test has been published on our YouTube channel.

“What about IP address control? Can you change your IP address? If so, how many IP addresses are available in the pool? Are there duplicates?“

Proxy providers often allow you to change your IP address, but they never control which new IP address the mobile carrier assigns.

At the same time, after an Internet connection is disconnected, the carrier assigns an IP address that was previously used in approximately 30% of cases.

In practice, this means that every time you rotate your IP, you risk getting an IP address that has already been used before.

“So, what can be done?“

The only reliable way to change the IP address on a dedicated modem is to keep track of all previously assigned IP addresses and request a new one whenever a duplicate is detected.

This is a problem we've solved and automated. You can download our benchmark and use it to rotate IP addresses properly.

If the carrier assigns a previously used address, the program automatically requests another one until it gets a unique IP.

Just take a look at the statistics for duplicate IP addresses from other proxy providers using standard dedicated modems compared to our solution:

“But what about the ability to maintain a stable session with the same IP address over an extended period of time?“

Natural IP rotation is a normal part of mobile Internet connections.

The mobile carrier may occasionally change the IP address on its own, and how often this happens depends on the specific carrier.

For applications that rely on persistent sessions, it's important that the IP address doesn't change on its own too frequently.

During our 7-day test, the natural IP rotation pattern matched the direct mobile connection exactly.

This is consistent with the natural rotation of a mobile connection and falls within a range of approximately 2–4 IP address changes per month.

“What about IP address quality?“

IP address quality refers to whether an IP address is listed in public proxy databases, blacklists, and similar sources.

It's important to understand that IP address quality has nothing to do with the quality of the proxy connection itself, which is the proxy provider's responsibility, since these are evaluated separately.

IP address quality is the responsibility of the mobile carrier, which should make sure its IP addresses are removed from such databases in a timely manner.

Moreover, different IP addresses belonging to the same mobile carrier can have different reputation scores. So how do we measure this?

We perform 10 IP address rotations and check each new address using specialized services that evaluate its quality and reputation:

• getipintel.net

A value from 0 to 1 indicates the probability that an IP address is a proxy/VPN or is being used for malicious activity. A value of 1 means the IP is clearly flagged (hosting, VPN, or a TOR node).

• abuseipdb.com

The score is based on abuse reports and blacklist data: 100 indicates a high likelihood that the IP address is malicious, while 0 means there is no reason to consider it suspicious.

• iplists.firehol.org

An IP address is flagged if it appears in aggregated open proxy blocklists, including addresses reported or detected within the last 30 days.

This is just the beginning. We'll continue expanding our testing methodology, running new tests, and publishing the results. We'd be happy to discuss them with the community.

To deploy your own infrastructure on CloudEngine, follow guide or contact our sales team.