Deep dive
Why your UDP and QUIC traffic isn't being proxied — and how to fix it
macOS 13+ · Apple Silicon and Intel · Updated 2026-08-28
The quiet failure
Most proxy tooling on macOS was built around TCP. That was fine when nearly everything was TCP. It is no longer true: HTTP/3 runs over QUIC, which is UDP; games, voice chat and video calls have always been UDP; and an increasing share of ordinary web traffic negotiates QUIC first.
When a tool cannot carry UDP, it usually does not tell you. The traffic simply takes the direct path instead. Your browser looks fine, and meanwhile a whole class of traffic is going somewhere you did not intend.
Two things that have to be handled separately
1. Real UDP forwarding
SOCKS5 defines UDP ASSOCIATE for exactly this: the client asks the proxy for a UDP relay, then sends datagrams through it. ProxyRouter implements it, so an application routed to a UDP-capable upstream has its UDP carried rather than leaked.
2. QUIC as an explicit decision
QUIC deserves its own switch because the right answer depends on your upstream. ProxyRouter gives three states per rule:
- Proxy it — forward the QUIC datagrams through a UDP-capable upstream. Best performance when your proxy supports it.
- Force a fallback to TCP — block the QUIC attempt so the app drops to HTTP/2 over TCP, which any proxy can carry. The safe default when the upstream is TCP-only.
- Let it go direct — a deliberate choice for latency-sensitive traffic you do not want proxied at all.
Getting it right in practice
- Find out whether your upstream supports SOCKS5 UDP. Most modern local clients do; older HTTP proxies do not.
- If it does: route the app normally and set QUIC to Proxy. UDP is then carried end to end.
- If it does not: set QUIC to force TCP for browsers, and leave genuinely UDP-based apps (games, calls) on Direct rather than pretending they are proxied.
- Verify in Activity: both the TCP and UDP flows of the same app should show the path you expect.
FAQ
How do I know if my UDP is leaking?
The usual symptom is a mismatch: web pages behave as if the proxy is working, while a game, a voice call or a video app behaves as if it is not. In the Activity view, UDP flows are listed alongside TCP ones with the path each took, so a leak shows up as UDP marked Direct while the same app's TCP is marked with your upstream.
What does the QUIC 'force TCP' option actually do?
It blocks the QUIC attempt so the application falls back to HTTP/2 over TCP, which every SOCKS5 and HTTP proxy can carry. Browsers are designed for this fallback and switch within a fraction of a second. It is the pragmatic choice when your upstream has no UDP support.
Does my proxy server need to support UDP?
For real UDP forwarding, yes — the upstream has to implement SOCKS5 UDP ASSOCIATE. Most modern local clients do. If yours does not, use the force-TCP setting for QUIC and keep genuine UDP applications on Direct.
Why does Proxifier not do this on Mac?
Its macOS build does not implement SOCKS5 UDP forwarding, so UDP is left to take the direct path. That is a design limitation rather than a setting you have missed.
ProxyRouter comes with a free full-feature trial, no card required. You bring your own SOCKS5 or HTTP upstream — a corporate proxy, a staging gateway, or a port on localhost. We do not provide or resell proxy servers.