3proxy/3proxy
3proxy
3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic forwarder capable of routing TCP and UDP traffic across HTTP, SOCKS, and various email and file protocols.
The project provides specialized capabilities for secure traffic inspection, including the decryption and analysis of HTTPS and TLS streams through certificate spoofing and mutual authentication. It further supports client identity anonymization by routing outbound traffic through recursive upstream proxy chains.
The software covers a broad range of network management functions, including protocol routing for FTP, POP3, and SMTP, as well as port forwarding and IPv4/IPv6 bridging. It includes administrative tools for bandwidth throttling, connection limiting, and real-time content filtering using regular expressions to modify payloads and headers.
Security and observability are handled through policy-based access control, RADIUS identity verification, and comprehensive network activity logging with automatic rotation.
Features
- HTTP Proxies - Acts as a web gateway that handles HTTP requests and provides TLS decryption for encrypted web traffic.
- SOCKS Proxies - Provides a SOCKS proxy server for routing TCP and UDP traffic to bypass network restrictions.
- Traffic Routing - Proxies web requests and supports tunneling other TCP-based protocols over HTTPS.
- Access Control Lists - Provides rule-based access control lists to filter network traffic based on IP addresses, usernames, and ports.
- Multi-Protocol Network Servers - Routes TCP and UDP traffic across HTTP, SOCKS, and various email and file protocols in a lightweight server.
- Network Port Forwarding - Maps local TCP and UDP ports to redirect incoming network connections to specified remote destinations.
- TCP Connection Forwarding - Redirects incoming traffic from a local TCP port to a specified remote destination port.
- Network Interface Bindings - Assigns specific internal and external IP addresses to control which interfaces accept or initiate connections.
- Network Traffic Routing - Redirects TCP and UDP requests between clients and servers using various proxy and port-mapping protocols.
- Port Forwarding - Maps TCP and UDP ports to redirect network traffic from local listeners to remote destinations.
- SMTP Traffic Forwarders - Provides dedicated routing for SMTP requests from internal users to external email servers.
- Proxy Chaining - Routes outbound traffic through a sequence of upstream proxies to hide the original source.
- Protocol-Based Routing Rules - Forwards TCP and UDP traffic using SOCKS protocols to enable access to remote resources.
- TCP and UDP Forwarders - Routes raw TCP and UDP traffic between clients and servers via local port mapping.
- Network Access Control - Functions as a security layer enforcing policies to regulate traffic flow based on IP, identity, and ACLs.
- Network Traffic Filtering - Blocks or redirects network traffic based on source networks, ports, usernames, and request methods.
- Policy-Based Access Control - Enforces security permissions based on policies involving usernames, IP addresses, ports, and time of day.
- Proxy Authentication - Enforces user authentication using passwords or network names to control access to the proxy service.
- Traffic Inspection Tools - Provides capabilities for intercepting and decrypting TLS traffic using certificate spoofing for stream inspection.
- Network Stream Rewriting - Uses regular expressions to match and modify network payloads and headers in real-time.
- Data Throughput Optimizers - Optimizes high-bandwidth transfer performance using TCP data splicing and algorithm suppression.
- Bandwidth Limiters - Caps the transfer speed and total data volume for users to prevent network resource exhaustion.
- Per-Protocol Connection Limiters - Caps the number of simultaneous connections per service to prevent resource exhaustion and denial-of-service attacks.
- Content-Type Filtering - Blocks server responses based on specific MIME types or content-type headers to control data delivery.
- Proxy DNS Routers - Handles DNS proxying and caching with a built-in resolver and support for DNS-over-TCP.
- Payload Rewriters - Replaces text patterns in data streams with alternative strings to modify or censor content in real-time.
- Pattern-Based Content Filtering - Blocks or modifies network data in both directions using regular expression matches in headers and payloads.
- Per-User Transfer Quotas - Implements data transfer rates and total volume quotas for users or destinations over specified periods.
- Protocol-Specific Routing - Forwards requests from internal users to external FTP servers for both proxy-aware and non-aware clients.
- TLS Termination - Handles TLS termination at the proxy layer to decrypt and inspect secure streams before re-encrypting them.
- SNI Routing - Redirects secure connections to a destination host based on the Server Name Indication in the TLS handshake.
- Regex-Based Request Modifications - Modifies client requests and headers using regular expressions to enforce policies or change content.
- HTTPS Decryption Proxies - Decrypts HTTPS traffic using a custom authority certificate for inspection and modification.
- POP3 - Forwards email requests to external servers by extracting the destination address from user credentials.
- Dynamic Library Loading - Supports loading external shared libraries at runtime to inject custom logic into the data processing pipeline.
- Mutual TLS Authentication - Intercepts secure connections and provides mutual authentication for both client and upstream links.
- Identity Anonymization - Obscures the original source of requests by routing outbound traffic through recursive proxy chains.
- Payload-Based Traffic Filtering - Filters network traffic by inspecting and modifying request headers and payloads using regular expressions.
- RADIUS Authentication - Delegates user authentication and IP assignment to external RADIUS servers for scalable access management.
- Connection Limiters - Prevents network resource exhaustion by capping data transfer speeds, volume quotas, and simultaneous connections.
- Traffic Management Decryptors - Handles encrypted connections using server name sniffing and certificate-based decryption to manage secure data flow.
- Extensible Plugin Architectures - Implements an extensible architecture that loads external libraries to add specialized logic to the data pipeline.
- Network Traffic Logs - Provides persistent storage and management of intercepted network request and response data.
- Network Activity Archiving - Records connection data and network events to files or databases with automatic rotation for auditing.
- Systems And Services - Listed in the “Systems And Services” section of the The Book Of Secret Knowledge awesome list.
- Networking and Communication - Tiny, free proxy server.
