Skip to contentHow to hide your real server IP address
Your origin IP is the one address your CDN and firewall cannot hide for you. This guide shows how to route your server's outbound traffic through an exit so third parties only ever record the exit IP, never your real one.
Why exposing your origin IP is dangerous
The address your defenses can't mask for you.
Every outbound connection your server makes leaks something valuable: its real public IP address. When your backend calls a third-party API, fires a webhook, scrapes a page, or fetches a remote resource, the destination records the origin IP that request came from. Collect enough of those data points and an attacker can map your infrastructure directly.
This matters because your origin IP is usually the one address your protective layers cannot hide:
- Targeted DDoS. Volumetric attacks aimed straight at your origin bypass edge scrubbing entirely.
- CDN and WAF bypass. If someone learns the IP behind Cloudflare or your load balancer, they can hit the server directly and walk around every rule you configured at the edge.
- Direct exploitation. A known origin IP is a fixed target for port scans, credential brute force, and vulnerability probes.
- Deanonymization. A stable origin IP ties together separate accounts, jobs, and identities that were meant to stay unlinked.
The fix is architectural, not cosmetic: never let your origin IP be the address a third party records. Send outbound traffic through a separate proxy exit so the remote end only ever logs the exit IP. For inbound and full-tunnel needs, a WireGuard VPN does the same at the network layer. Want a stable exit that is yours alone? Add a dedicated personal IP. Just want to test the concept first? The free public proxy list lets you experiment before committing — use those at your own risk.
Route your outbound traffic through an exit
Five steps to put a proxy between your server and the internet.
Get proxy credentials
Create an s4m account and provision an authenticated proxy. You will receive a host, a SOCKS5 port and an HTTP port, plus a username and password. Throughout this guide we use the placeholders proxy.s4m.online, port 1080 (SOCKS5) and 3128 (HTTP) with credentials USER:PASS. s4m proxies are datacenter proxies — fast, authenticated, and metered pay-as-you-go.
Record your current origin IP
Before changing anything, see what the world sees today. A plain request to a reflection service like api.ipify.org returns your real origin IP. Keep this value handy — it is exactly the address you are about to stop leaking.
Send a request through the exit
Point a single request at the SOCKS5 or HTTP endpoint using your credentials. The destination now records the s4m exit IP instead of your origin. Prefer socks5h:// so DNS is resolved through the proxy too, which avoids leaking lookups from your server's resolver.
Set environment variables for app-wide coverage
Export HTTP_PROXY and HTTPS_PROXY so any tooling that honors them (curl, wget, many HTTP libraries, package managers) routes through the exit without per-call changes. Set NO_PROXY for hosts that must stay direct, such as internal metadata endpoints.
Verify, then lock it in
Re-run the reflection check through the proxy and confirm the returned IP is the exit, not your origin. If you need the exit IP to stay constant across restarts and rotations, bind a dedicated personal IP to the proxy. For whole-box tunneling instead of per-request proxying, put the server behind the WireGuard VPN.
Working example: curl and Python
Compare your origin IP against the exit IP with api.ipify.org.
# 1. See what the world records right now (your REAL origin IP) curl -s https://api.ipify.org && echo # 2. App-wide coverage: many CLIs and libraries honor these export HTTP_PROXY="http://USER:[email protected]:3128" export HTTPS_PROXY="http://USER:[email protected]:3128" export NO_PROXY="localhost,127.0.0.1,169.254.169.254" # keep internal calls direct # 3. Route ONE request through the SOCKS5 exit. # socks5h:// = resolve DNS through the proxy too (no DNS leak) curl -s --proxy socks5h://USER:[email protected]:1080 https://api.ipify.org && echo # -> prints the s4m exit IP, never your origin # 4. Same thing from Python (pip install "requests[socks]") python3 - <<'PY' import requests proxies = { "http": "socks5h://USER:[email protected]:1080", "https": "socks5h://USER:[email protected]:1080", } origin = requests.get("https://api.ipify.org", timeout=15).text exit_ip = requests.get("https://api.ipify.org", proxies=proxies, timeout=15).text print("origin :", origin) # your server's real IP print("via s4m :", exit_ip) # what third parties now see assert origin != exit_ip, "proxy is not being used!" PY # HTTP proxy variant (port 3128) if you prefer CONNECT over SOCKS: # curl -s --proxy http://USER:[email protected]:3128 https://api.ipify.org
Which option fits your setup?
Per-request proxying, full-tunnel VPN, or a fixed IP of your own.
Datacenter proxy exit
Best for outbound requests from apps, scrapers, and jobs. Authenticated SOCKS5 and HTTP endpoints, metered pay-as-you-go, drop-in via env vars or per-call. These are datacenter proxies — not residential — so they are fast and predictable. See /proxy/.
WireGuard VPN tunnel
Best when you want the whole server (or device) behind a tunnel, inbound and outbound. Flat, a flat monthly rate on paid plans, WireGuard or OpenVPN, with apps for Windows, macOS, Linux, Android, iOS, and routers. See /vpn/.
Dedicated personal IP
A dedicated IP is exclusive during its assignment under the service terms. Prior history, assignment duration, availability and supported bindings still matter. An exit IP can have a prior history. Accounts, cookies and browser signals may still identify a user; changing an address does not guarantee a clean reputation. Related topics: /pricing/.
Questions, answered
Does routing outbound traffic actually hide my origin IP?
Yes, for the traffic you route. Any request sent through the proxy or VPN reaches its destination from the exit IP, so third parties log that address instead of your origin. It is not magic, though: if some code path still connects directly, that request will reveal your real IP. Route all outbound paths and keep internal calls in NO_PROXY. We avoid absolute claims like "untraceable" — this hides your origin IP from the destination, which is exactly what stops direct attacks and CDN bypass.
Are s4m proxies residential?
No. s4m sells authenticated datacenter SOCKS5 and HTTP proxies. They are stable and metered pay-as-you-go. We do not offer or claim residential proxies. Separately, s4m also publishes a free public proxy list harvested from open sources and continuously validated — those are third-party and use-at-your-own-risk, good for testing but not for production.
Proxy exit or the VPN — which should I use?
Use a proxy when you only need to mask outbound requests at the application layer; it is precise and easy to scope with environment variables. Use the WireGuard VPN when you want the entire machine tunneled, including inbound connectivity, at the network layer. Many users pair the two: VPN for the box, proxies for specific jobs.
Can I keep the same exit IP every time?
Yes. Add a dedicated personal IP — a static address that is yours alone — and bind it to your proxy or VPN. That gives you a consistent exit that survives restarts, which is useful for allowlisting with partners while still keeping your true origin hidden.
Will this slow down my requests?
Adding a hop adds some latency, and proxy traffic is metered, so there is a real cost to routing everything. In practice the overhead is small for typical API and web traffic. If throughput matters more than per-request scoping, the VPN's paid plans offer a flat monthly rate (not metered per-GB).
Hide your origin IP today
Spin up an authenticated datacenter proxy or a WireGuard VPN, add a dedicated IP if you need a fixed exit, and stop leaking your real server address. Anonymous accounts available; pay with card or crypto.
People found this page by searching for
- how to hide your real server IP address
- what is ip address
- ip address for android
- what is CGNAT and how to get around it
- http proxy for android
- vpn kill switch
- ERR_PROXY_CONNECTION_FAILED
- Anti-Detect browsers and proxies
- socks5 proxy tutorial
- proxy authentication
- how wireguard works
Real search phrases this page answers — the linked ones open the page that covers them in depth.