In July 2026 a BlackHatWorld poster asked the questions a home-built mobile proxy runs into: "Hello, is there any way to turn one, or multiple eSIMs into an rotating mobile proxy for a specific country? Let's say I want to get sweden/turkey or german mobile proxies and have the possibility to put some setup in any cheap country, would I get one IP from the coutnry where setup is located, or one IP from the provider? When I would make the IP rotating, I could live well off with just one eSIM with unlimited data. What is the catch?"
Two other threads, an undated one about chaining a VPN and a proxy on a phone and an r/homelab post from April 2019, add the plumbing. The hardware side is in do you actually need mobile proxies. This post is about the network.
Whose IP a roaming eSIM gets
A roaming eSIM gets its public IP wherever its traffic leaves the mobile network, and for travel eSIMs that is usually the issuing operator or a third-party hub, not the country the device sits in.
The GSMA's roaming guidelines (IR.88) separate traffic that is "Home Routed" from traffic "broken out from the Visited Network". Home routing tunnels the data back to the operator that issued the SIM, and that operator hands out the public address: home network, home country. With local breakout the visited network assigns it, and only then does the rig's location matter. In hub breakout a company on the IPX (the private network that operators use for roaming) runs the gateway, and the exit can sit in a third country.
Someone measured it. "Unraveling the Airalo Ecosystem", posted to arXiv in August 2024, tested 24 country eSIMs from Airalo. Three came from the local operator itself. Of the 21 roaming ones, five were home-routed through Singtel, so eSIMs used in Japan, the UAE, Pakistan, Malaysia and China all surfaced on Singapore addresses (AS45143). The other 16 used hub breakout. The authors: "We did not detect any eSIM using LBO."
So the answer to the poster: from the provider's side, in every roaming case that study measured. A rig in a cheap country changes which tower it talks to. It rarely changes where the traffic comes out.
What a German "mobile IP" from a travel eSIM can look like
A travel eSIM sold for Germany can exit from a hosting company's address range in a third country, which looks nothing like a German carrier.
In that study, the eSIM used in Germany was issued by Play, a Polish operator, and broke out at gateways run by Packet Host (AS54825, Amsterdam) or OVH (AS16276, France). Both are hosting companies. The Turkey eSIM came out in Amsterdam too. Sweden was not measured.
Yesim's help centre says the same of its own plans: some eSIMs "may route your Internet traffic through certain countries where Yesim has network hubs."
The study covers one retailer, and routing contracts change, so read it as a warning, not a map. How a given site scores such an address is not public. The ASN is visible to anyone, and IP lookups (ours included) classify an address by the network that owns it. A hosting range will not pass for a German phone. A German carrier address needs an eSIM from a German operator.
Test before you build. Put the eSIM in the phone or modem, switch Wi-Fi off, and open our free IP fraud score checker over mobile data; it shows connection type and ASN. Reconnect a few times and check again another day. A carrier ASN in the country you paid for passes. Anything else, stop there.
Rotation: what reconnecting changes
Reconnecting a mobile data session usually brings a new public address from the same gateway's pool, which changes the number and not much more.
Carriers put many subscribers behind each public address with carrier-grade NAT (CGNAT), and the IETF's requirements for it (RFC 6888) make "Paired" pooling the default: all sessions from one internal address leave on one external address. One line, one public IP at a time. Rotation makes addresses sequential, never parallel, so fifteen accounts on one eSIM share the current address and all jump together at the next reconnect. Sometimes the old address comes straight back.
The owning network and the breakout country stay put. On a hub-routed eSIM every rotation lands in the same hosting ranges.
The catch with one unlimited eSIM
The catch is in the terms and the network: unlimited plans throttle, many forbid automated use, and the line takes no incoming connections.
Airalo's fair use policy, as published in October 2026: "when you use more than 3GB in a day, we'll slow down (or 'throttle') your internet speed to 1 Mbps for the rest of that day." A saturated 1 Mbps line moves about 450 MB an hour. The same page forbids "reselling, redistributing or commercially sharing the data connection with third parties" and running it "on an unattended, automated or machine-to-machine basis, including through SIM farms". A proxy that other machines dial into around the clock is the second; selling access to it is the first. Airalo puts no limit on tethering. Holafly does: "the hotspot feature is not unlimited to preserve network integrity."
An EU operator's SIM parked for good in a cheaper EU country has its own limit: the operator "can monitor and check your roaming use over a 4 month period" (the EU's Your Europe portal), then ask questions and charge extra if you spent more time and data abroad than at home.
Then inbound. The 2019 r/homelab poster wanted a Linux box that "will use Mobile 4G Network mainly but would use Home Broadband to make the proxies", because "Mobile 4G IPs doesn't allow Port-Forwarding." The public address is shared, so there is no port of your own to forward. RFC 6269: "If a CGN is present, the port must also be opened in the CGN. CGN makes subscribers dependent on their service provider for this functionality."
Getting clients in without port forwarding
The usual workaround is a reverse tunnel: the machine next to the SIM dials out to a server with a public IP, and clients connect to that server.
Outgoing connections cross CGNAT fine. The 2019 poster even had the server, planning to use the proxies "on my VPS Server in other country". OpenSSH has done this since version 7.6 (2017). On the box with the SIM:
ssh -N -R 1080 tunnel@your-vps.example.com
With no destination given, the manual says, "ssh will act as a SOCKS 4/5 proxy and forward connections to the destinations requested by the remote SOCKS client". Port 1080 on the VPS becomes a SOCKS proxy that exits through the box. Check it from the VPS:
curl --socks5-hostname 127.0.0.1:1080 https://ifconfig.me
By default sshd binds that port to loopback only (GatewayPorts no). Leave it there. The port has no password, and opening it lends your mobile line to every scanner that finds it. Make the mobile interface the box's default route, or exits leave through whatever else is plugged in. Mobile sessions drop, so restart the tunnel automatically with autossh or a systemd unit.
Phone > VPN > Proxy: what chaining does on a phone
A stock Android phone or iPhone runs one VPN-style tunnel at a time, so "Phone > VPN > Proxy > Internet" only works when one app, or the VPN server, handles both hops.
The second BlackHatWorld thread we know only from its search snippet, undated, replies unseen: "If you have a cell phone, how easy is it to setup both a VPN and a 4G proxy on it, forcing all apps through both? To where Phone>VPN>Proxy>Internet."
Android's documentation: "There can be only one VPN connection running at the same time." Without root, that VpnService interface is the documented way for an app to capture other apps' traffic, so a system-wide proxy app and a VPN app fight over one slot. Apple, for iOS: "Only one Personal VPN configuration can be enabled simultaneously on the system."
Chains that work put both hops in one client, or on the VPN server, or use apps with their own proxy setting inside the VPN. Who sees what:
| Hop | What it sees |
|---|---|
| Mobile carrier | Your line, your volume, the VPN server's address. Not the contents. |
| VPN provider | Your carrier address, the proxy's address, and anything sent to the proxy unencrypted. With plain SOCKS5 that means the destinations and the login (RFC 1929: the password goes "in cleartext"). |
| Proxy provider | The VPN server as the client, the destinations, the volume. |
| The site | The proxy's exit address, plus whatever the app reads from the phone. |
The gain is split knowledge: if the proxy link is encrypted too, no single company sees both your line and your destinations. The price is a round trip per hop and more things to break. One hop drops, the chain stops.
When renting beats building
Renting wins once you need a carrier address in a particular country, or several addresses at once; building suits a line or two at home, on a domestic SIM whose terms allow it.
Our mobile proxies are billed per GB, from EUR 7/GB at 1 GB down to EUR 4.50/GB at 100 GB, on carrier addresses shared by many phones through CGNAT. Mobile country availability varies, so check yours before buying. Accounts that need one fixed address fit static ISP proxies, about EUR 1.10 to 1.40 per IP per month, minimum 10. Residential, rotating or sticky for 5 minutes up to an hour, is billed per GB (pricing). Ours included, check an exit's ASN in the IP checker before building on it.