yrutschle/sslh
Sslh
sslh is a network proxy that runs a single service listening on one port, inspects the first data packet of each incoming connection, and forwards the traffic to the appropriate backend based on the detected protocol. It acts as a protocol multiplexer, transparent TCP proxy, and UDP router, while also functioning as a privileged port manager and connection resource manager. By inspecting initial packets, sslh can distinguish protocols such as SSH, HTTP, TLS, and OpenVPN, routing each connection to the correct backend service from a single listen port.
To operate efficiently without per-connection threads, sslh uses an asynchronous event-driven I/O architecture that handles thousands of concurrent connections in a single process. It avoids running with full root permissions by binding to restricted ports using Linux capabilities or by delegating socket ownership to systemd for on-demand startup. After initial setup, sslh restricts filesystem access with Linux Landlock to limit the damage from potential exploits. Connections can be forwarded transparently so that backend services see the original client IP address, and UDP flows are managed with a hash-based table and configurable timeouts.
sslh can operate behind an SSL-terminating proxy, and it enforces host-based access control rules per service while capping concurrent connections per protocol to prevent resource exhaustion. It also supports the PROXY protocol to preserve client IP information when transparent forwarding is not available.
Features
- Single Port Protocol Multiplexing - Inspecting the first data packet to identify and forward SSH, HTTP, TLS, and OpenVPN connections to their respective backend services from one listen port.
- Per-Protocol Connection Limiters - Capping the number of concurrent connections per protocol or listen port to prevent resource exhaustion from denial-of-service attacks.
- Protocol Detection Forwarders - Inspects initial packets to detect protocols and route each connection to the correct backend service.
- Transparent TCP Proxies - Forwards connections to backend services while preserving the original client IP address using routing deflection rules.
- UDP Protocol Routing - Forwards UDP packets based on protocol detection, maintaining a flow mapping table with configurable limits and timeouts.
- Capability-Based Port Binding - A service that binds to restricted ports using Linux capabilities to avoid running with full root permissions.
- Privileged Port Bindings - Binding to restricted ports using Linux capabilities or systemd socket activation to run the whole process without root permissions.
- Event-Driven Connection Multiplexing - Manages thousands of concurrent connections in a single thread using an event loop, avoiding per-connection thread overhead.
- Event-Driven I/O - sslh uses an asynchronous event-driven I/O model to handle many concurrent connections efficiently without dedicating a thread per connection.
- Socket-Activated Orchestration - sslh uses systemd socket activation to bind ports without root and start on demand, with an optional generator for socket unit files.
- Systemd Socket Activation - Delegates socket ownership to systemd to bind privileged ports and start the daemon on demand without requiring root access.
- Connection Resource Managers - A traffic manager that limits concurrent connections per port and enforces host-based access control via TCP wrappers.
- PROXY Protocol Forwarders - Accepts and forwards PROXY protocol headers to backends so they receive the original client IP and port.
- OpenVPN Connection Routings - Provides a dedicated mechanism to detect and route OpenVPN connections despite their delayed initial data packet.
- UDP Session Management - Maintains a hash-based table of UDP flows with configurable connection limits and timeouts to handle demultiplexed datagrams efficiently.
- TCP Wrapper Integrations - Enforcing host-based access rules per service and restricting filesystem access with Linux Landlock to limit damage from exploits.
- Host-Based Access Restrictors - Checks connecting client IPs against host-based access rules per service before forwarding connections.
- Landlock Filesystem Sandboxing - Applies Linux Landlock to restrict filesystem access after initial setup, limiting damage from exploits.
- Network Tunneling - Applicative protocol multiplexer for sharing ports between SSH and HTTPS.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
