A proxy reaches only the layer it sits at, and the layers above it. An HTTP proxy at L7 reads and rewrites your requests. A SOCKS proxy at L5 relays them untouched and swaps your route. Neither can touch what the OS kernel stamps below it: the TCP/IP fingerprint at L4 and L3 rides the wire to the proxy, real and unchangeable. Toggle the proxy, the reach moves, the red leak stays.
OSI stack · a packet descends, each layer wraps it encapsulation ↓
HTTP proxy
on the wire · you → proxy your real TCP + IP is already here, before the proxy
proxy's reach opaque to proxy OS kernel, leaks local only
Which layer a proxy sits at decides what it can hide. No proxy hides the kernel's TCP/IP fingerprint below it, the OS stamps it and the packet carries it to the proxy regardless. Only VPN-level routing or OS stack tuning changes it.