XMRig Proxy Deployment Guide

Table of contents

Introduction

If you have multiple devices and want a unified configuration, want to reduce the risk of being banned by a pool, or experience packet loss and unstable connections while mining, deploying XMRig Proxy can be a practical solution.

Although it does not increase hashrate itself, it can make your mining setup more stable, easier to manage, and less prone to errors:

• Connect all miners to a single proxy to save time and effort with centralized configuration
• Significantly reduce the number of pool connections to avoid rate limits or IP bans
• Use the proxy as a relay to improve connection success and stability when network conditions are poor, routes to the pool are indirect, or packet loss is frequent
• Support both private-network and public-network deployments for different mining setups

This tutorial walks through compilation, configuration, and deployment, then runs the proxy as a systemd service that starts automatically on boot for stable, efficient, long-term operation.

XMRig Proxy acts rather like a “commander,” coordinating your miners so they work together and keep producing.

1. Install system dependencies

apt update
apt install -y git build-essential cmake libuv1-dev uuid-dev libmicrohttpd-dev libssl-dev

2. Download and compile the source

cd /root
git clone https://github.com/xmrig/xmrig-proxy.git
mkdir -p xmrig-proxy/build
cd xmrig-proxy/build
cmake ..
make -j$(nproc)

3. Copy the executable and default configuration file

cp /root/xmrig-proxy/build/xmrig-proxy /root/proxy
cp /root/xmrig-proxy/src/config.json /root/config.json

4. Edit the pool settings

Open /root/config.json, find the "pools" section, and replace it with the following (replace YOUR_WALLET_ADDRESS with your Tari wallet address):

"pools": [
    {
        "algo": "rx/0",
        "coin": null,
        "url": "pool-global.tari.snipanet.com:3333",
        "user": "YOUR_WALLET_ADDRESS",
        "pass": "x",
        "rig-id": null,
        "keepalive": true,
        "enabled": true,
        "tls": false,
        "tls-fingerprint": null,
        "daemon": false
    }
],

Leave the other settings at their defaults.

5. Configure a systemd service

cat > /etc/systemd/system/xmrig-proxy.service <<EOF
[Unit]
Description=XMRig Proxy Service
After=network.target

[Service]
ExecStart=/root/proxy --config=/root/config.json
Restart=always
Nice=10
CPUWeight=1

[Install]
WantedBy=multi-user.target
EOF

Start the service and enable it at boot:

systemctl daemon-reload
systemctl enable xmrig-proxy
systemctl start xmrig-proxy

View the service logs:

journalctl -fu xmrig-proxy

6. How do other miners connect to this proxy?

The configuration file includes these default listener settings:

"bind": [
    {
        "host": "0.0.0.0",
        "port": 3333,
        "tls": false
    },
    {
        "host": "::",
        "port": 3336,
        "tls": false
    }
],

This means the proxy listens on port 3333 on all local IP addresses.
Other miners can connect using the IP address of the machine running the proxy, for example:

"url": "192.168.1.10:3333",

Here, 192.168.1.10 is the private or public IP address of the host running the proxy.

7. Common commands

8. Appendix: example configuration with explanatory comments

To improve the security of communication between miners and the proxy server, XMRig Proxy supports TLS (Transport Layer Security). Particularly for public-network deployments or remote connections from multiple miners, enabling TLS can effectively prevent man-in-the-middle attacks and traffic sniffing, improving overall stability and trustworthiness.

Complete configuration file

{
  "access-log-file": null,
  "access-password": null,
  "algo-ext": true,
  "api": {
    "id": null,
    "worker-id": null
  },
  "http": {
    "enabled": false,
    "host": "0.0.0.0",
    "port": 10006,
    "access-token": "your_password",
    "restricted": false
  },
  "background": false,
  "bind": [
    {
      "host": "0.0.0.0",
      "port": 10002,
      "tls": true
    },
    {
      "host": "::",
      "port": 3336,
      "tls": false
    }
  ],
  "colors": true,
  "title": true,
  "custom-diff": 0,
  "custom-diff-stats": true,
  "donate-level": 0,
  "log-file": null,
  "mode": "nicehash",
  "pools": [
    {
      "algo": "rx/0",
      "coin": null,
      "url": "pool-global.tari.snipanet.com:9001",
      "user": "your_wallet_address",
      "pass": "debian",
      "rig-id": null,
      "keepalive": true,
      "enabled": true,
      "tls": true,
      "tls-fingerprint": null,
      "daemon": false
    }
  ],
  "retries": 2,
  "retry-pause": 1,
  "reuse-timeout": 0,

  "tls": {
    "enabled": true,
    "protocols": "TLSv1.3",
    "cert": "/usr/local/nginx/conf/ssl/your_domain.crt",
    "cert_key": "/usr/local/nginx/conf/ssl/your_domain.key",
    "ciphers": null,
    "ciphersuites": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
    "dhparam": null
  },
  "user-agent": null,
  "syslog": false,
  "verbose": false,
  "watch": true,
  "workers": true
}

pools: pool connection settings

"pools": [
  {
    "algo": "rx/0",                   // rx/0 stands for RandomX
    "coin": null,                    // Leave unset for automatic detection
    "url": "pool-global.tari.snipanet.com:9001", // Use port 9001 (TLS enabled)
    "user": "your_wallet_address",   // Wallet address that receives mining proceeds
    "pass": "debian",                // Password field; most pools accept any string
    "rig-id": null,                  // Miner identifier (optional)
    "keepalive": true,               // Set to true to avoid frequent reconnections
    "enabled": true,                 // Whether this pool configuration is enabled
    "tls": true,                     // Enable TLS encryption for the pool connection
    "tls-fingerprint": null,         // Specify the fingerprint of the pool TLS certificate
    "daemon": false                  // Usually set to false
  }
]

tls: TLS certificates and encryption settings

"tls": {
  "enabled": true,       // Enable TLS for incoming miner connections
  "protocols": "TLSv1.3",// Allow only TLSv1.3
  "cert": "/usr/local/nginx/conf/ssl/your_domain.crt",     // Public key
  "cert_key": "/usr/local/nginx/conf/ssl/your_domain.key", // Private key
  "ciphers": null,       // Not used by TLS 1.3; may be left unset
  "ciphersuites": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
                         // TLS 1.3 cipher suites
  "dhparam": null        // Not needed for TLS 1.3
}

bind: listening ports and TLS settings

"bind": [
  {
    "host": "0.0.0.0",   // Listen on all IPv4 addresses
    "port": 10002,       // Proxy listening port
    "tls": true          // Enable TLS
  },
  {
    "host": "::",        // Listen on all IPv6 addresses
    "port": 3336,        // Unencrypted port
    "tls": false         // Do not enable TLS
  }
]

The proxy listens on local port 10002.
Other miners can connect through the configured domain, for example:

The pools configuration is as follows:

"pools": [
    {
        "algo": null,
        "coin": null,
        "url": "your_domain:10002",
        "user": "debian+20000",
        "pass": "debian",
        "rig-id": null,
        "nicehash": false,
        "keepalive": true,
        "enabled": true,
        "tls": true,
        "sni": false,
        "tls-fingerprint": null,
        "daemon": false,
        "socks5": null,
        "self-select": null,
        "submit-to-origin": false
    }
],

Parameter explanations:

"url": "your_domain:10002",         // Server domain + listening port
"user": "debian+20000",            // // Miner identifier + +requested difficulty (a 1KH/s device in this example)
"keepalive": true,                 // Keep connections alive to reduce reconnections
"tls": true                        // Enable TLS encryption

If you have multiple devices or a more complex network environment, XMRig Proxy is a practical choice for centralized connections and unified management.