Most Nodetonet tunnels have a paired Android phone sitting at the far end — that is the heart of the mobile-proxy pitch. But there is a second mode that gets less attention and is surprisingly useful: an upstream-only proxy, where no device is paired at all. The tunnel terminates entirely on the Nodetonet edge and every byte is forwarded straight to the third-party provider you supply.
Think of it as renting our endpoint, not our hardware. If you already have a residential, datacenter or backconnect provider but want a stable front door with real access controls layered on top, upstream-only is exactly that front door.
What an upstream-only proxy is
When you create a proxy in the panel you normally pick a token — that is, a paired Android device loaded with the Nodetonet agent app. In upstream-only mode you skip that step entirely. Instead you supply an upstream address in host:port:user:pass format. The edge accepts incoming connections from your clients, authenticates them against the credentials you set, enforces your ACL rules, then re-dials out to the provider URL you registered.
The full data path looks like this:
your client → sub42.nodetonet.com:48888 → upstream.provider.com:7777 → target siteThere is no phone in that chain. The exit IP your requests carry is the provider's exit address, not a mobile carrier address. The proxy stays alive even when no devices are online — because there are no devices involved at all.
When upstream-only is the right choice
You already have a working provider. The question is whether adding a Nodetonet layer earns its keep. Here are the scenarios where it clearly does:
- Stable endpoint. Many residential providers rotate gateway hostnames or retire ports without warning. Your assigned
sub42.nodetonet.comsubdomain never changes, so your automation does not break when the provider reshuffles their infrastructure. - SSL termination on your own subdomain. HTTPS-protocol proxies receive a real Let's Encrypt certificate on that subdomain — useful for clients or libraries that refuse plaintext HTTP proxies. See how wildcard SSL certificates work for details.
- Per-client credentials. Issue a different username and password to each downstream consumer — a customer, a team member, a specific script — without handing out your actual provider credentials. Each proxy client gets its own scoped access including independent quotas, thread caps, expiry dates and IP allow-lists.
- Hard quota ceiling. Set a gigabyte cap per client so one runaway scraper cannot blow your monthly provider budget. Bandwidth usage accrues in real time and the connection is cut when the limit is hit.
- Domain and IP filtering. Apply a domain allow-list or deny-list to restrict which targets the upstream will be used for — useful when reselling access to a curated set of sites. See domain restrictions and IP allow-deny lists.
- Edge proximity. Choose the Nodetonet edge server geographically closest to your scraper fleet. The upstream dial happens from that edge, cutting round-trip latency for multi-hop requests.
- Audit trail. All connections flow through the panel, so you get per-client usage logs and can spot abuse early without asking your provider for data.
If you only ever need raw IPs and nothing else, use the provider directly. Upstream-only earns its keep when the Nodetonet layer — the stable endpoint, SSL, per-client auth, or quota — brings genuine value on top of what you already have.
Upstream-only vs device-backed proxy at a glance
| Dimension | Device-backed proxy | Upstream-only proxy |
|---|---|---|
| Exit IP type | Real mobile carrier (4G/5G CGNAT) | Whatever your upstream provides |
| Availability | Depends on paired device being online | Always up — no device in the path |
| IP rotation | Controlled by Nodetonet token group | Controlled by upstream provider |
| Per-client auth & quota | Yes | Yes |
| SSL subdomain | Yes | Yes |
| Domain / IP filtering | Yes | Yes |
| Best when | You need genuine mobile IPs | You already have a provider and want Nodetonet's control layer |
For use cases that require the highest trust level — ad verification on mobile-only placements, sneaker bots, social-media multi-account — a mobile proxy backed by real devices is still the stronger choice. Upstream-only shines as an operational layer for existing provider subscriptions.
Creating an upstream-only proxy
Go to the Proxies section in the panel, click New Proxy, and fill in the form:
- Protocol — choose HTTP, SOCKS5 or HTTPS depending on what your clients need. If you choose HTTPS the edge issues an SSL certificate automatically. For a side-by-side comparison of protocols see HTTP vs SOCKS5 — which to pick.
- Token — select
Upstream Onlyfrom the dropdown (no device token). - Upstream Proxy — paste your provider string in
host:port:user:passformat. Username modifiers like-country-de,-session-abc12or any carrier tag pass through verbatim, so sticky sessions, geo-targeting and every other provider-side option keep working. See upstream username modifiers for the full list.
Click Create. The panel returns a normal-looking connection string, identical in shape to a device-backed proxy:
curl -x http://u8x2:p7q1@sub42.nodetonet.com:48888 https://api.ipify.orgThe reported IP will be your upstream provider's exit. Verify it immediately with the free What is my IP tool, then check your provider's dashboard to confirm the credentials are accepted. If authentication fails you will see a 407 response — the most common cause is a malformed upstream string. See debugging upstream auth failures for a step-by-step fix.
Programmatic creation via the API
From the REST API, pass tokenId: null and include the upstream field. The call is otherwise identical to a device-backed proxy. See your first API call for authentication setup.
curl -X POST \
-H "Authorization: Bearer $KEY" \
-H "Content-Type: application/json" \
-d '{"protocol":"http","port":"auto","tokenId":null,
"upstream":"gate.provider.com:7000:user:pass"}' \
https://nodetonet.com/api/v1/proxiesThe response contains the assigned port and subdomain — the same shape as any other proxy. You can then create proxy clients programmatically with individual quotas and credentials, letting you fully automate a reseller provisioning flow.
Layering upstream-only with device-backed proxies
Nothing stops you from running both modes in the same panel. A common pattern: keep a token-group of mobile devices for your highest-priority, block-sensitive targets, and route lower-risk bulk work through an upstream-only proxy backed by a cheaper datacenter or residential provider. Both types appear side-by-side in the Proxies list and share the same per-client auth system, so the operational overhead is minimal.
You can also chain an upstream into a device-backed proxy using the upstream-forwarding option — the device goes online, dials out through your configured upstream, and the exit IP is the upstream's rather than the mobile carrier's. That pattern is covered in forwarding through a residential provider.
Billing and cost
Upstream-only proxies are billed like any other Nodetonet proxy — on prepaid credit, with no monthly subscription. The edge charges only for what passes through it; idle proxies with no active connections cost nothing. Your upstream provider will separately bill you for egress according to their own pricing. Setting a per-client quota cap in the panel is the simplest way to keep the upstream bill predictable. Read more in quota limits per client.
Get started
Ready to set one up? Create a free account, browse all platform features, or visit the proxy glossary for any term above. Questions? Reach the team at support@nodetonet.com or join the community at discord.gg/nodetonet.