Options:
-pNUMBER change default server port to NUMBER
-
--g(GRACE_TRAFF,GRACE_NUM,GRACE_DELAY)
-delay GRACE_DELAY milliseconds before polling if average
-polling size is below GRACE_TRAFF bytes and GRACE_NUM read
-operations in a single direction are detected within 1
-second. Useful to minimize polling -s
-(for admin) secure, allow only secure operations, currently
-only traffic counters view without ability to reset.
-(for dnspr) simple, do not use resolver and 3proxy cache,
-always use external DNS server.
-(for udppm) singlepacket, expect only one packet from both
-client and server
--u Never ask for username/password
--u2 (for socks) require username/password in
-authentication methods
--a (for proxy) anonymous proxy (no information about
-client reported)
--a1 (for proxy) anonymous proxy (random client
-information reported)
--a2 (for proxy) generate Via: and X-Forwarded-For:
-instead of Forwarded:
-6 Only resolve IPv6 addresses. IPv4 addresses are
packed in IPv6 in IPV6_V6ONLY compatible way.
-4 Only resolve IPv4 addresses
--46 Resolve IPv6 addresses if IPv4 address is not
-resolvable
--64 Resolve IPv4 addresses if IPv6 address is not
-resolvable
+-46 Prefer IPv4. Resolve IPv6 addresses if IPv4 address
+is not resolvable
+-64 Prefer IPv6. Resolve IPv4 addresses if IPv6 address
+is not resolvable
+-e External address. IP address of the interface the
+proxy should initiate connections from. External IP must be
+specified if you need incoming connections. By default the
+system will decide which address to use in accordance with
+the routing table.
+-i Internal address. IP address the proxy accepts
+connections to. By default, connections to any interface are
+accepted. Unix domain sockets can be specified with
+-iunix:/path/to/socket syntax. On Linux, abstract
+sockets use -iunix:@socketname syntax.
+-DiINTERFACE, -DeINTERFACE bind
+internal (-Di) / external (-De) interface to
+given INTERFACE (e.g. eth0) if SO_BINDTODEVICE is
+supported by the system. You may need to run as root or have
+CAP_NET_RAW capability in order to bind to an
+interface, depending on the system, so this option may
+require root privileges and can be incompatible with some
+configuration commands like chroot and setuid
+(and daemon if setcap is used).
+-niPATH, -nePATH (Linux only)
+Switch to the network namespace identified by the filesystem
+path PATH (e.g. /var/run/netns/myns or
+/proc/PID/ns/net) for the listening socket
+(-ni) or for outgoing connections (-ne). With
+-ni the current namespace is saved before opening the
+listening socket and restored immediately after binding, so
+that the rest of the process (outgoing connections, child
+threads) runs in the original namespace unless -ne is
+also given. With -ne the process switches to the
+specified namespace after the listening socket is bound (and
+after restoring from -ni if applicable). Requires
+CAP_SYS_ADMIN (or CAP_NET_ADMIN on recent
+kernels) and is incompatible with
+chroot/setuid/daemon if privileges are
+dropped before the switch takes effect.
+-Ne (for socks) External NAT address (between 3proxy and
+destination server) to report to client for CONNECT and
+BIND. By default external address is reported. It’s
+only useful in the case of IP-IP NAT (will not work for
+PAT).
+-Ni (for socks) Internal NAT address (between client and
+3proxy) to report to client for UDPASSOC. By default
+internal address is reported. It’s only useful in the
+case of IP-IP NAT (will not work for PAT).
-RHOST:port listen on given local
HOST:port for incoming connections instead of making remote
outgoing connection. Can be used with another 3proxy service
@@ -163,39 +193,32 @@ TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS,
USE_TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT,
SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE,
SO_DONTROUTE may be supported depending on OS.
--DiINTERFACE, -DeINTERFACE bind
-internal (-Di) / external (-De) interface to
-given INTERFACE (e.g. eth0) if SO_BINDTODEVICE is
-supported by the system. You may need to run as root or have
-CAP_NET_RAW capability in order to bind to an
-interface, depending on the system, so this option may
-require root privileges and can be incompatible with some
-configuration commands like chroot and setuid
-(and daemon if setcap is used).
--e External address. IP address of the interface the
-proxy should initiate connections from. External IP must be
-specified if you need incoming connections. By default the
-system will decide which address to use in accordance with
-the routing table.
--i Internal address. IP address the proxy accepts
-connections to. By default, connections to any interface are
-accepted. Unix domain sockets can be specified with
--iunix:/path/to/socket syntax. On Linux, abstract
-sockets use -iunix:@socketname syntax.
--Ne (for socks) External NAT address (between 3proxy and
-destination server) to report to client for CONNECT and
-BIND. By default external address is reported. It’s
-only useful in the case of IP-IP NAT (will not work for
-PAT).
--Ni (for socks) Internal NAT address (between client and
-3proxy) to report to client for UDPASSOC. By default
-internal address is reported. It’s only useful in the
-case of IP-IP NAT (will not work for PAT).
-H (for all services) Expect HAProxy PROXY protocol v1
header on incoming connection. This allows the proxy to
receive real client IP address from HAProxy or other load
balancer that supports the PROXY protocol. The header must
-be sent before any protocol-specific data.
+be sent before any protocol-specific data.
+
+-g(GRACE_TRAFF,GRACE_NUM,GRACE_DELAY)
+delay GRACE_DELAY milliseconds before polling if average
+polling size is below GRACE_TRAFF bytes and GRACE_NUM read
+operations in a single direction are detected within 1
+second. Useful to minimize polling -s
+(for admin) secure, allow only secure operations, currently
+only traffic counters view without ability to reset.
+(for dnspr) simple, do not use resolver and 3proxy cache,
+always use external DNS server.
+(for udppm) singlepacket, expect only one packet from both
+client and server
+-u Never ask for username/password
+-u2 (for socks) require username/password in
+authentication methods
+-a (for proxy) anonymous proxy (no information about
+client reported)
+-a1 (for proxy) anonymous proxy (random client
+information reported)
+-a2 (for proxy) generate Via: and X-Forwarded-For:
+instead of Forwarded:
Also, all options mentioned for proxy(8)
socks(8) pop3p(8) tcppm(8)
udppm(8) ftppr(8)
@@ -930,8 +953,10 @@ users test1:CL:password1
"test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
Note: double quotes are required because the password
-contains a $ sign.
-flush
+contains a $ sign.
flush
+
empty the active access list. The access list must be
flushed every time you create a new access list for a new
service. For example:
@@ -1015,6 +1040,220 @@ the given value, no data filtering will be performed through
filtering plugins to avoid data corruption and/or
Content-Length changing. Default is 1MB (1048576).
SSL/TLS support +is built into 3proxy (since 0.9.7) when compiled with +OpenSSL (WITH_SSL). Previously available as SSLPlugin, the +functionality is now integrated into the main binary. The +plugin line is no longer required.
+ +SSL/TLS can be +used for: - transparent MITM (Man-in-the-Middle) for TLS +traffic inspection - https:// proxy (TLS-encrypted +connection between client and proxy) - TLS client +connections to upstream servers with certificate +authentication - mTLS (mutual TLS) requiring client +certificates
+ +ssl_mitm
+- spoof certificates for services started below. Usage
+without ssl_client_verify is insecure.
+ssl_nomitm - do not spoof certificates for services
+started below
ssl_serv
+(or ssl_server) - require TLS connection from clients for
+services below
+ssl_noserv (or ssl_noserver) - do not require TLS
+connection from clients for services below
ssl_cli
+(or ssl_client) - establish TLS connection to upstream
+server for services below
+ssl_nocli (or ssl_noclient) - do not establish TLS
+connection to upstream server for services below
ssl_server_cert
+/path/to/cert - Server certificate (should not be
+self-signed, must contain SAN) for ssl_serv
+ssl_server_key /path/to/key - Server certificate
+key for ssl_server_cert or generated MITM certificate
+
+ssl_client_cert /path/to/cert - Client
+certificate for authentication on upstream server (used with
+ssl_cli)
+ssl_client_key /path/to/key - Client certificate
+key for ssl_client_cert
+ssl_client_ciphersuites ciphersuites_list - TLS
+client ciphers for TLS 1.3
+ssl_server_ciphersuites ciphersuites_list - TLS
+server ciphers for TLS 1.3
+ssl_client_cipher_list ciphers_list - TLS client
+ciphers for TLS 1.2 and below
+ssl_server_cipher_list ciphers_list - TLS server
+ciphers for TLS 1.2 and below
+ssl_client_min_proto_version tls_version - TLS
+client minimum TLS version (e.g., TLSv1.2)
+ssl_server_min_proto_version tls_version - TLS
+server minimum TLS version
+ssl_client_max_proto_version tls_version - TLS
+client maximum TLS version
+ssl_server_max_proto_version tls_version - TLS
+server maximum TLS version
+ssl_client_verify - verify the certificate for the
+upstream server (used with ssl_mitm or ssl_cli)
+ssl_client_no_verify - do not verify the certificate for
+the upstream server (default)
+ssl_server_verify - require client certificate
+authentication (mTLS) for ssl_serv
+ssl_server_no_verify - do not require client certificate
+(default)
+ssl_server_ca_file /path/to/cafile - CA
+certificate file for MITM
+ssl_server_ca_key /path/to/cakey - key for
+ssl_server_ca_file MITM CA
+ssl_server_ca_dir /path/to/cadir - CA directory
+for ssl_server_verify
+ssl_server_ca_store /path/to/castore - CA store
+for ssl_server_verify (OpenSSL 3.0+)
+ssl_client_ca_file /path/to/cafile - CA file for
+ssl_client_verify
+ssl_client_ca_dir /path/to/cadir - CA directory
+for ssl_client_verify
+ssl_client_ca_store /path/to/castore - CA store
+for ssl_client_verify (OpenSSL 3.0+)
+ssl_client_sni hostname - SNI hostname to send to
+upstream server
+ssl_client_alpn protocol1 protocol2 ... - ALPN
+protocols to negotiate with upstream server
+ssl_client_mode mode - when to establish TLS
+connection: 0 - on connect (default), 1 - after
+authentication, 2 - before data, 3 - only for secure parent
+types (ending with ’s’)
+ssl_certcache /path/to/cache/ - location for the
+generated MITM certificates cache
PCRE (Perl +Compatible Regular Expressions) filtering is built into +3proxy (since 0.9.7) when compiled with PCRE2 support +(WITH_PCRE). Previously available as PCREPlugin, the +functionality is now integrated into the main binary. The +plugin line is no longer required.
+ +PCRE filtering +allows creating matching and replacement rules with regular +expressions for client requests, headers, and data.
+ +pcre
+TYPE FILTER_ACTION REGEXP [ACE]
+Apply a rule for matching regular expression.
+pcre_rewrite TYPE FILTER_ACTION REGEXP
+REWRITE_EXPRESSION [ACE]
+Match and replace with rewrite expression.
+pcre_extend FILTER_ACTION [ACE]
+Extend the ACL of the last pcre or pcre_rewrite command by
+adding an additional ACE.
+pcre_options OPTION1 [OPTION2 ...]
+Set matching options. Both PCRE2 native options and PCRE
+compatibility options are supported. PCRE options are mapped
+to their PCRE2 equivalents for backward compatibility.
+PCRE2 options: PCRE2_CASELESS, PCRE2_MULTILINE,
+PCRE2_DOTALL, PCRE2_EXTENDED, PCRE2_DOLLAR_ENDONLY,
+PCRE2_UNGREEDY, PCRE2_UTF, PCRE2_UCP, PCRE2_NO_AUTO_CAPTURE,
+PCRE2_FIRSTLINE, PCRE2_DUPNAMES, PCRE2_MATCH_UNSET_BACKREF,
+PCRE2_ALT_BSUX, PCRE2_ALT_CIRCUMFLEX, PCRE2_ALT_VERBNAMES,
+PCRE2_USE_OFFSET_LIMIT, PCRE2_EXTENDED_MORE, PCRE2_LITERAL,
+PCRE2_MATCH_INVALID_UTF.
+PCRE compatibility options: PCRE_CASELESS, PCRE_MULTILINE,
+PCRE_DOTALL, PCRE_EXTENDED, PCRE_ANCHORED,
+PCRE_DOLLAR_ENDONLY, PCRE_EXTRA, PCRE_NOTBOL, PCRE_NOTEOL,
+PCRE_UNGREEDY, PCRE_NOTEMPTY, PCRE_UTF8,
+PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CALLOUT,
+PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART,
+PCRE_FIRSTLINE, PCRE_DUPNAMES, PCRE_NEWLINE_CR,
+PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY,
+PCRE_NEWLINE_ANYCRLF, PCRE_BSR_ANYCRLF,
+PCRE_BSR_UNICODE.
TYPE - type of
+filtered data (comma-delimited list):
+request - content of the client’s request (e.g., HTTP
+GET request string)
+cliheader - content of the client request headers
+srvheader - content of the server’s reply headers
+clidata - data received from the client (e.g., HTTP POST
+data)
+srvdata - data received from the server (e.g., HTML
+page)
FILTER_ACTION -
+action on match:
+allow - allow this request without checking the rest of the
+rules
+deny - deny this request without checking the rest of the
+rules
+dunno - continue with the rest of the rules (useful with
+pcre_rewrite)
REGEXP - PCRE +(Perl) regular expression. Use * if no regexp matching is +required.
+ + +REWRITE_EXPRESSION +- substitution string. May contain Perl-style substrings $1, +$2, etc. $0 means the whole matched string. \r and \n may be +used to insert new lines; the string may be empty +("").
+ +ACE - access +control entry (user names, source IPs, destination IPs, +ports, etc.), identical to allow/deny/bandlimin commands. +The regular expression is only matched if the ACL matches +the connection data. Warning: Regular expressions +don’t require authentication and cannot replace +authentication and/or allow/deny ACLs.
+3APA3A is -pronounced as ``zaraza´´.
-3proxy is -designed by Vladimir 3APA3A Dubrovin -(3proxy@3proxy.org)
+designed by Vladimir Dubrovin <vlad@3proxy.org>