sockd-dante

logoutput: stderr
internal: vlan2 port = 1080
external: 10.1.0.18
method: pam
clientmethod: none
user.privileged: root
user.notprivileged: sockd
extension: bind

client pass {
    from: 0.0.0.0/0 port 1-65535 to: 0.0.0.0/0
}

pass {
    from: 10.0.0.0/8 port 1-65535 to: 0.0.0.0/0
    protocol: tcp udp
    method: pam
    
    pam.servicename: sockd-domain1
}

 clientmethod
	      A list of acceptable authentication methods for client-rules, in
	      order of preference.  It is  thus	 important  that  you  specify
	      these  in the correct order, normally with the more secure meth-
	      ods first.

	      These are the authentication methods that can be checked	before
	      the socks-negotiation has completed.

	      Supported	 values	 are  none,  gssapi,  rfc931 and pam.  For all
	      methods, except gssapi, that means the  authentication  will  be
	      based  on	 solely	 on  the IP-address of the client, possibly in
	      combination with a rfc931 ("ident") lookup.