When running a Gentoo Linux system in a restricted network environment, routing package downloads and repository synchronization through a proxy is sometimes necessary. Here is how to configure emerge to use HTTP or SOCKS proxies.

Before getting started, It is recommended to configure Portage to use Git instead of rsync. Git makes emerge --sync much faster after the initial clone and handles HTTP and SOCKS proxy configurations easily through standard Git and HTTP settings.

Adding the proxy to make.conf

The standard method to route emerge fetches through a proxy is to define standard environment variables in /etc/portage/make.conf.

HTTP proxy

To configure an HTTP proxy, add the following to /etc/portage/make.conf:

# Configuration for an HTTP proxy
http_proxy="http://192.168.1.100:3128"
https_proxy="http://192.168.1.100:3128"
ftp_proxy="http://192.168.1.100:3128"

# Uncomment when using rsync instead of Git for 'emerge --sync'
# RSYNC_PROXY="http://192.168.1.100:3128"

Replace 192.168.1.100 with your proxy server's IP address and 3128 with its port number.

Defining http_proxy, https_proxy, and ftp_proxy in /etc/portage/make.conf works because Portage exports these variables into the environment of the child processes it spawns. Consequently, underlying tools like wget, curl, and git will inherit and apply these proxy settings, provided they are communicating over HTTP or HTTPS (e.g., fetching tarballs or syncing a git repository via HTTPS).

However, it does not work for tools using non-HTTP protocols:

• When using the native rsync:// protocol for repository syncing, rsync ignores HTTP proxy variables. It requires the RSYNC_PROXY environment variable.
• When cloning or syncing via the native git:// or ssh:// protocols, Git will not respect http_proxy or https_proxy. For ssh:// transport, proxying is handled outside of Portage entirely via ProxyCommand or ProxyJump in ~/.ssh/config. If you are syncing using the native git:// protocol, you need to configure core.gitproxy or use a tool like netcat to route the traffic.

SOCKS proxy

One way to route Gentoo repository synchronization through a SOCKS proxy is to configure the repository to use Git over HTTPS instead of rsync, because the rsync daemon protocol does not provide a native SOCKS proxy setting.

1. Read this article: Configuring Portage to use Git instead of rsync.
2. Add the following to /etc/portage/make.conf:

# Configuration for a SOCKS proxy
# The socks5h scheme ensures DNS resolution happens on the proxy server
http_proxy="socks5h://192.168.1.100:1080"
https_proxy="socks5h://192.168.1.100:1080"

Replace 192.168.1.100 with your proxy server's IP address and 1080 with its port number.

Note: Use the socks5h:// scheme when the destination hostname should be resolved by the SOCKS proxy rather than locally. This is useful when local DNS resolution is unavailable or should not be used.

Proxy socks only: Making emerge use curl

By default, Gentoo's Portage package manager uses wget as its download agent to fetch source code archives. This behavior is defined by the default FETCHCOMMAND and RESUMECOMMAND variables.

While wget has built-in support for standard HTTP and HTTPS proxies, it lacks native support for SOCKS proxies. If you try to route your Portage downloads through a SOCKS proxy, the default wget configuration will fail unless you pipe it through an external network wrapper like proxychains.

A solution is to replace the default Portage download agent with curl, as it provides native support for SOCKS proxies and handles DNS resolution on the proxy side:

# Overriding default fetch behavior to use curl with SOCKS5h support
FETCHCOMMAND="curl --retry 3 --connect-timeout 60 -x socks5h://192.168.1.100:1080 -o \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
RESUMECOMMAND="curl -C - --retry 3 --connect-timeout 60 -x socks5h://192.168.1.100:1080 -o \"\${DISTDIR}/\${FILE}\" \"\${URI}\""

Note: Replace 192.168.1.100 with your proxy server's IP address and 1080 with its port number.