diff --git a/Cargo.lock b/Cargo.lock
index 2cf4fc216b..1e43fec687 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1363,6 +1363,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "trust-dns-resolver",
+ "url",
 ]
 
 [[package]]
@@ -2756,18 +2757,6 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
-[[package]]
-name = "filetime"
-version = "0.2.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
-dependencies = [
- "cfg-if",
- "libc",
- "libredox",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "findshlibs"
 version = "0.10.2"
@@ -2847,15 +2836,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "fsevent-sys"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -3261,51 +3241,6 @@ dependencies = [
  "arrayvec",
 ]
 
-[[package]]
-name = "hickory-proto"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07698b8420e2f0d6447a436ba999ec85d8fbf2a398bbd737b82cac4a2e96e512"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna 0.4.0",
- "ipnet",
- "once_cell",
- "rand 0.8.5",
- "thiserror",
- "tinyvec",
- "tokio",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "hickory-resolver"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28757f23aa75c98f254cf0405e6d8c25b831b32921b050a66692427679b1f243"
-dependencies = [
- "cfg-if",
- "futures-util",
- "hickory-proto",
- "ipconfig",
- "lru-cache",
- "once_cell",
- "parking_lot 0.12.3",
- "rand 0.8.5",
- "resolv-conf",
- "smallvec",
- "thiserror",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "hkdf"
 version = "0.12.4"
@@ -3684,16 +3619,6 @@ dependencies = [
  "unicode-normalization",
 ]
 
-[[package]]
-name = "idna"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
 [[package]]
 name = "idna"
 version = "1.0.3"
@@ -3816,26 +3741,6 @@ dependencies = [
  "regex",
 ]
 
-[[package]]
-name = "inotify"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
-dependencies = [
- "bitflags 1.3.2",
- "inotify-sys",
- "libc",
-]
-
-[[package]]
-name = "inotify-sys"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "inout"
 version = "0.1.3"
@@ -3881,15 +3786,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "iprange"
-version = "0.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37209be0ad225457e63814401415e748e2453a5297f9b637338f5fb8afa4ec00"
-dependencies = [
- "ipnet",
-]
-
 [[package]]
 name = "is-terminal"
 version = "0.4.13"
@@ -3964,17 +3860,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "json5"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
-dependencies = [
- "pest",
- "pest_derive",
- "serde",
-]
-
 [[package]]
 name = "jsonrpc-core"
 version = "18.0.0"
@@ -4029,26 +3914,6 @@ dependencies = [
  "indexmap 1.9.3",
 ]
 
-[[package]]
-name = "kqueue"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
-dependencies = [
- "kqueue-sys",
- "libc",
-]
-
-[[package]]
-name = "kqueue-sys"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -4077,7 +3942,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -4086,17 +3951,6 @@ version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
-[[package]]
-name = "libredox"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
-dependencies = [
- "bitflags 2.6.0",
- "libc",
- "redox_syscall 0.5.7",
-]
-
 [[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
@@ -4163,12 +4017,6 @@ dependencies = [
  "linked-hash-map",
 ]
 
-[[package]]
-name = "lru_time_cache"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9106e1d747ffd48e6be5bb2d97fa706ed25b144fbee4d5c02eae110cd8d6badd"
-
 [[package]]
 name = "match_cfg"
 version = "0.1.0"
@@ -4278,18 +4126,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.0.2"
@@ -4397,25 +4233,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44a1290799eababa63ea60af0cbc3f03363e328e58f32fb0294798ed3e85f444"
 
-[[package]]
-name = "notify"
-version = "6.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
-dependencies = [
- "bitflags 2.6.0",
- "crossbeam-channel",
- "filetime",
- "fsevent-sys",
- "inotify",
- "kqueue",
- "libc",
- "log",
- "mio 0.8.11",
- "walkdir",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -5392,9 +5209,9 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "reqwest"
-version = "0.12.8"
+version = "0.12.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f713147fbe92361e52392c73b8c9e48c04c6625bce969ef54dc901e58e042a7b"
+checksum = "a77c62af46e79de0a562e1a9849205ffcb7fc1238876e9bd743357570e04046f"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -5999,7 +5816,6 @@ version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ecb3780dfbc654de9383758015b9bb95c6e32fecace36ebded09d67e854d130"
 dependencies = [
- "arc-swap",
  "async-trait",
  "base64 0.22.1",
  "blake3",
@@ -6007,10 +5823,8 @@ dependencies = [
  "bytes",
  "cfg-if",
  "futures",
- "hickory-resolver",
  "libc",
  "log",
- "notify",
  "once_cell",
  "percent-encoding",
  "pin-project",
@@ -6044,41 +5858,6 @@ dependencies = [
  "sha1",
 ]
 
-[[package]]
-name = "shadowsocks-service"
-version = "1.21.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e79e4f64b489b29e542dea54ea5b4c69e51701e25b222034c257f8b84f74b7e3"
-dependencies = [
- "arc-swap",
- "async-trait",
- "byte_string",
- "byteorder",
- "bytes",
- "cfg-if",
- "futures",
- "httparse",
- "idna 1.0.3",
- "ipnet",
- "iprange",
- "json5",
- "libc",
- "log",
- "lru_time_cache",
- "nix",
- "once_cell",
- "pin-project",
- "rand 0.8.5",
- "regex",
- "serde",
- "shadowsocks",
- "socket2",
- "spin",
- "thiserror",
- "tokio",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -6568,7 +6347,8 @@ dependencies = [
 
 [[package]]
 name = "tentacle"
-version = "0.6.5"
+version = "0.6.6"
+source = "git+https://github.com/eval-exec/tentacle.git?branch=exec/proxy-and-onion#f620bfe595ba7f8c839d321ef6985b1948a8ec3f"
 dependencies = [
  "async-trait",
  "bytes",
@@ -6584,7 +6364,6 @@ dependencies = [
  "parking_lot 0.12.3",
  "rand 0.8.5",
  "shadowsocks",
- "shadowsocks-service",
  "socket2",
  "tentacle-multiaddr",
  "tentacle-secio",
@@ -6593,6 +6372,7 @@ dependencies = [
  "tokio-tungstenite",
  "tokio-util",
  "tokio-yamux",
+ "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "winapi",
@@ -6601,9 +6381,13 @@ dependencies = [
 [[package]]
 name = "tentacle-multiaddr"
 version = "0.3.4"
+source = "git+https://github.com/eval-exec/tentacle.git?branch=exec/proxy-and-onion#f620bfe595ba7f8c839d321ef6985b1948a8ec3f"
 dependencies = [
+ "arrayref",
  "bs58",
+ "byteorder",
  "bytes",
+ "data-encoding",
  "serde",
  "sha2",
  "unsigned-varint",
@@ -6612,6 +6396,7 @@ dependencies = [
 [[package]]
 name = "tentacle-secio"
 version = "0.6.4"
+source = "git+https://github.com/eval-exec/tentacle.git?branch=exec/proxy-and-onion#f620bfe595ba7f8c839d321ef6985b1948a8ec3f"
 dependencies = [
  "bs58",
  "bytes",
@@ -6836,7 +6621,7 @@ dependencies = [
  "backtrace",
  "bytes",
  "libc",
- "mio 1.0.2",
+ "mio",
  "parking_lot 0.12.3",
  "pin-project-lite",
  "signal-hook-registry",
@@ -6934,6 +6719,7 @@ dependencies = [
 [[package]]
 name = "tokio-yamux"
 version = "0.3.10"
+source = "git+https://github.com/eval-exec/tentacle.git?branch=exec/proxy-and-onion#f620bfe595ba7f8c839d321ef6985b1948a8ec3f"
 dependencies = [
  "bytes",
  "futures",
@@ -7340,12 +7126,12 @@ dependencies = [
 
 [[package]]
 name = "url"
-version = "2.5.2"
+version = "2.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
 dependencies = [
  "form_urlencoded",
- "idna 0.5.0",
+ "idna 1.0.3",
  "percent-encoding",
  "serde",
 ]
@@ -7594,7 +7380,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/network/Cargo.toml b/network/Cargo.toml
index 6931e9327c..b3474d4bae 100644
--- a/network/Cargo.toml
+++ b/network/Cargo.toml
@@ -34,10 +34,11 @@ serde_json = "1.0"
 bloom-filters = "0.1"
 ckb-spawn = { path = "../util/spawn", version = "= 0.121.0-pre" }
 bitflags = "1.0"
-p2p = { path = "/home/exec/Projects/github.com/nervosnetwork/tentacle/tentacle", package = "tentacle", default-features = false }
+p2p = { git = "https://github.com/eval-exec/tentacle", branch="exec/proxy-and-onion", package = "tentacle", default-features = false }
+url = "2.5.4"
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
-p2p = { path = "/home/exec/Projects/github.com/nervosnetwork/tentacle/tentacle", package = "tentacle", default-features = false, features = [
+p2p = { git = "https://github.com/eval-exec/tentacle", branch="exec/proxy-and-onion", package = "tentacle", default-features = false, features = [
     "upnp",
     "parking_lot",
     "openssl-vendored",
@@ -48,7 +49,7 @@ p2p = { path = "/home/exec/Projects/github.com/nervosnetwork/tentacle/tentacle",
 socket2 = "0.5"
 
 [target.'cfg(target_family = "wasm")'.dependencies]
-p2p = { path = "/home/exec/Projects/github.com/nervosnetwork/tentacle/tentacle", package = "tentacle", default-features = false, features = [
+p2p = { git = "https://github.com/eval-exec/tentacle", branch="exec/proxy-and-onion", package = "tentacle", default-features = false, features = [
     "wasm-timer",
 ] }
 idb = "0.6"
diff --git a/network/src/errors.rs b/network/src/errors.rs
index 0e3bb8d496..4814159db0 100644
--- a/network/src/errors.rs
+++ b/network/src/errors.rs
@@ -27,6 +27,8 @@ pub enum Error {
     Dial(String),
     /// Peer store error
     PeerStore(PeerStoreError),
+    /// Config error
+    Config(String),
 }
 
 /// Error from tentacle
diff --git a/network/src/lib.rs b/network/src/lib.rs
index c672dab65a..90be01fbcd 100644
--- a/network/src/lib.rs
+++ b/network/src/lib.rs
@@ -16,6 +16,7 @@ mod peer;
 pub mod peer_registry;
 pub mod peer_store;
 mod protocols;
+mod proxy;
 mod services;
 
 #[cfg(test)]
diff --git a/network/src/network.rs b/network/src/network.rs
index 26ec80707e..046f03964a 100644
--- a/network/src/network.rs
+++ b/network/src/network.rs
@@ -19,7 +19,7 @@ use crate::services::{
     dump_peer_store::DumpPeerStoreService, outbound_peer::OutboundPeerService,
     protocol_type_checker::ProtocolTypeCheckerService,
 };
-use crate::{Behaviour, CKBProtocol, Peer, PeerIndex, ProtocolId, ServiceControl};
+use crate::{proxy, Behaviour, CKBProtocol, Peer, PeerIndex, ProtocolId, ServiceControl};
 use ckb_app_config::{default_support_all_protocols, NetworkConfig, SupportProtocol};
 use ckb_logger::{debug, error, info, trace, warn};
 use ckb_spawn::Spawn;
@@ -122,6 +122,12 @@ impl NetworkState {
         let peer_store = Mutex::new(PeerStore::load_from_dir_or_default(
             config.peer_store_path(),
         ));
+        info!("Loaded the peer store.");
+        if config.proxy_config.enable {
+            proxy::check_proxy_url(&config.proxy_config.proxy_url)
+                .map_err(|reason| Error::Config(reason))?;
+        }
+
         let bootnodes = config.bootnodes();
 
         let peer_registry = PeerRegistry::new(
@@ -992,6 +998,14 @@ impl NetworkService {
                     if init.is_ready() {
                         break;
                     }
+
+                    if config.proxy_config.enable {
+                        let proxy_config = ProxyConfig {
+                            proxy_url: config.proxy_config.proxy_url.clone(),
+                        };
+                        service_builder = service_builder.tcp_proxy_config(Some(proxy_config));
+                    }
+
                     match find_type(multi_addr) {
                         TransportType::Tcp => {
                             // only bind once
@@ -1000,7 +1014,7 @@ impl NetworkService {
                             }
                             if let Some(addr) = multiaddr_to_socketaddr(multi_addr) {
                                 let domain = socket2::Domain::for_address(addr);
-                                let bind_fn = move |socket: p2p::service::TcpSocket| {
+                                let bind_fn = move |socket: p2p::service::TcpSocket, context: p2p::service::TransformerContext| {
                                     let socket_ref = socket2::SockRef::from(&socket);
                                     #[cfg(all(
                                         unix,
@@ -1010,20 +1024,14 @@ impl NetworkService {
                                     socket_ref.set_reuse_port(true)?;
                                     socket_ref.set_reuse_address(true)?;
                                     if socket_ref.domain()? == domain {
-                                        socket_ref.bind(&addr.into())?;
+                                        if !(config.proxy_config.enable && matches!(context.state, p2p::service::SocketState::Dial)) {
+                                            socket_ref.bind(&addr.into())?;
+                                        }
                                     }
                                     Ok(socket)
                                 };
                                 init.transform(TransportType::Tcp);
                                 service_builder = service_builder.tcp_config(bind_fn);
-
-                                if config.proxy_config.enable {
-                                    let proxy_config = Some(ProxyConfig {
-                                        proxy_url: config.proxy_config.proxy_url.clone(),
-                                    });
-                                    service_builder =
-                                        service_builder.tcp_proxy_config(proxy_config);
-                                }
                             }
                         }
                         TransportType::Ws => {
@@ -1033,7 +1041,7 @@ impl NetworkService {
                             }
                             if let Some(addr) = multiaddr_to_socketaddr(multi_addr) {
                                 let domain = socket2::Domain::for_address(addr);
-                                let bind_fn = move |socket: p2p::service::TcpSocket| {
+                                let bind_fn = move |socket: p2p::service::TcpSocket, context: p2p::service::TransformerContext| {
                                     let socket_ref = socket2::SockRef::from(&socket);
                                     #[cfg(all(
                                         unix,
@@ -1043,7 +1051,14 @@ impl NetworkService {
                                     socket_ref.set_reuse_port(true)?;
                                     socket_ref.set_reuse_address(true)?;
                                     if socket_ref.domain()? == domain {
-                                        socket_ref.bind(&addr.into())?;
+                                        if !(config.proxy_config.enable
+                                            && matches!(
+                                                context.state,
+                                                p2p::service::SocketState::Dial
+                                            ))
+                                        {
+                                            socket_ref.bind(&addr.into())?;
+                                        }
                                     }
                                     Ok(socket)
                                 };
diff --git a/network/src/proxy.rs b/network/src/proxy.rs
new file mode 100644
index 0000000000..3e3cb29aea
--- /dev/null
+++ b/network/src/proxy.rs
@@ -0,0 +1,28 @@
+pub(crate) fn check_proxy_url(proxy_url: &str) -> Result<(), String> {
+    let parsed_url = url::Url::parse(proxy_url).map_err(|e| e.to_string())?;
+    if parsed_url.host_str().is_none() {
+        return Err(format!("missing host in proxy url: {}", proxy_url));
+    }
+    let scheme = parsed_url.scheme();
+    if scheme.ne("socks5") {
+        return Err(format!("CKB doesn't support proxy scheme: {}", scheme));
+    }
+    Ok(())
+}
+
+#[test]
+fn parse_socks5_url() {
+    let result = url::Url::parse("socks5://username:password@localhost:1080");
+    assert!(result.is_ok());
+    let parsed_url = result.unwrap();
+    dbg!(&parsed_url);
+    assert_eq!(parsed_url.scheme(), "socks5");
+    // username
+    assert_eq!(parsed_url.username(), "username");
+    // password
+    assert_eq!(parsed_url.password(), Some("password"));
+    // host
+    assert_eq!(parsed_url.host_str(), Some("localhost"));
+    // port
+    assert_eq!(parsed_url.port(), Some(1080));
+}
diff --git a/util/app-config/Cargo.toml b/util/app-config/Cargo.toml
index 4c11e257f1..f938e204d2 100644
--- a/util/app-config/Cargo.toml
+++ b/util/app-config/Cargo.toml
@@ -22,8 +22,8 @@ ckb-pow = { path = "../../pow", version = "= 0.121.0-pre" }
 ckb-resource = { path = "../../resource", version = "= 0.121.0-pre" }
 ckb-build-info = { path = "../build-info", version = "= 0.121.0-pre" }
 ckb-types = { path = "../types", version = "= 0.121.0-pre" }
-secio = { path="/home/exec/Projects/github.com/nervosnetwork/tentacle/secio", package = "tentacle-secio" }
-multiaddr = { path="/home/exec/Projects/github.com/nervosnetwork/tentacle/multiaddr", package = "tentacle-multiaddr" }
+secio = { git = "https://github.com/eval-exec/tentacle.git", branch="exec/proxy-and-onion", package = "tentacle-secio" }
+multiaddr = { git = "https://github.com/eval-exec/tentacle.git", branch="exec/proxy-and-onion", package = "tentacle-multiaddr" }
 rand = "0.8"
 sentry = { version = "0.34.0", optional = true }
 ckb-systemtime = { path = "../systemtime", version = "= 0.121.0-pre" }
diff --git a/util/app-config/src/configs/network.rs b/util/app-config/src/configs/network.rs
index 4eafa7df87..3df0459117 100644
--- a/util/app-config/src/configs/network.rs
+++ b/util/app-config/src/configs/network.rs
@@ -104,6 +104,7 @@ pub struct Config {
 #[derive(Clone, Debug, Serialize, Deserialize, Default)]
 pub struct ProxyConfig {
     pub enable: bool,
+    // like: socks5://username:password@127.0.0.1:1080
     pub proxy_url: String,
 }