{"id":13813653,"url":"https://github.com/path-network/go-mmproxy","last_synced_at":"2025-04-06T00:07:17.949Z","repository":{"id":44735173,"uuid":"188919440","full_name":"path-network/go-mmproxy","owner":"path-network","description":"Golang implementation of MMProxy","archived":false,"fork":false,"pushed_at":"2024-05-26T14:50:12.000Z","size":45,"stargazers_count":269,"open_issues_count":10,"forks_count":50,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-03-29T23:07:51.510Z","etag":null,"topics":["mmproxy","nginx","proxy","proxy-protocol","tcp","udp"],"latest_commit_sha":null,"homepage":"https://path.net","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/path-network.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-27T23:09:19.000Z","updated_at":"2025-03-28T05:25:29.000Z","dependencies_parsed_at":"2023-11-20T13:46:32.630Z","dependency_job_id":"fb296763-d27e-4e38-b841-b7ac00b558c8","html_url":"https://github.com/path-network/go-mmproxy","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/path-network%2Fgo-mmproxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/path-network%2Fgo-mmproxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/path-network%2Fgo-mmproxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/path-network%2Fgo-mmproxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/path-network","download_url":"https://codeload.github.com/path-network/go-mmproxy/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247415967,"owners_count":20935388,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["mmproxy","nginx","proxy","proxy-protocol","tcp","udp"],"created_at":"2024-08-04T04:01:24.426Z","updated_at":"2025-04-06T00:07:17.927Z","avatar_url":"https://github.com/path-network.png","language":"Go","readme":"# go-mmproxy\n\nThis is a Go reimplementation of [mmproxy](https://github.com/cloudflare/mmproxy), created to improve on mmproxy's runtime stability while providing potentially greater performance in terms of connection and packet throughput.\n\n`go-mmproxy` is a standalone application that unwraps HAProxy's [PROXY protocol](http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) (also adopted by other projects such as NGINX) so that the network connection to the end server comes from client's - instead of proxy server's - IP address and port number.\nBecause they share basic mechanisms, [Cloudflare's blogpost on mmproxy](https://blog.cloudflare.com/mmproxy-creative-way-of-preserving-client-ips-in-spectrum/) serves as a great write-up on how `go-mmproxy` works under the hood.\n\n## Building\n\n```shell\ngo install github.com/path-network/go-mmproxy@latest\n```\n\nYou'll need at least `go 1.21` to build the `go-mmproxy` binary.\nSee [Go's Getting Started](https://golang.org/doc/install) if your package manager does not carry new enough version of golang.\n\n## Requirements\n\n`go-mmproxy` has to be ran:\n\n- on the same server as the proxy target, as the communication happens over the loopback interface;\n- as root or with `CAP_NET_ADMIN` capability to be able to set `IP_TRANSPARENT` socket opt.\n\n## Running\n\n### Routing setup\n\nRoute all traffic originating from loopback back to loopback:\n\n```shell\nip rule add from 127.0.0.1/8 iif lo table 123\nip route add local 0.0.0.0/0 dev lo table 123\n\nip -6 rule add from ::1/128 iif lo table 123\nip -6 route add local ::/0 dev lo table 123\n```\n\nIf `--mark` option is given to `go-mmproxy`, all packets routed to the loopback interface will have the mark set.\nThis can be used for setting up more advanced routing rules with iptables, for example when you need traffic from loopback to be routed outside of the machine.\n\n#### Routing UDP packets\n\nBecause UDP is connectionless, if a socket is bound to `0.0.0.0` the kernel stack will search for an interface in order to send a reply to the spoofed source address - instead of just using the interface it received the original packet from.\nThe found interface will most likely _not_ be the loopback interface, which will avoid the rules specified above.\nThe simplest way to fix this is to bind the end server's listeners to `127.0.0.1` (or `::1`).\nThis is also generally recommended in order to avoid receiving non-proxied connections.\n\n### Starting go-mmproxy\n\n```\nUsage of ./go-mmproxy:\n  -4 string\n    \tAddress to which IPv4 traffic will be forwarded to (default \"127.0.0.1:443\")\n  -6 string\n    \tAddress to which IPv6 traffic will be forwarded to (default \"[::1]:443\")\n  -allowed-subnets string\n    \tPath to a file that contains allowed subnets of the proxy servers\n  -close-after int\n    \tNumber of seconds after which UDP socket will be cleaned up (default 60)\n  -l string\n    \tAddress the proxy listens on (default \"0.0.0.0:8443\")\n  -listeners int\n    \tNumber of listener sockets that will be opened for the listen address (Linux 3.9+) (default 1)\n  -mark int\n    \tThe mark that will be set on outbound packets\n  -p string\n    \tProtocol that will be proxied: tcp, udp (default \"tcp\")\n  -v int\n    \t0 - no logging of individual connections\n    \t1 - log errors occurring in individual connections\n    \t2 - log all state changes of individual connections\n```\n\nExample invocation:\n\n```shell\nsudo ./go-mmproxy -l 0.0.0.0:25577 -4 127.0.0.1:25578 -6 [::1]:25578 --allowed-subnets ./path-prefixes.txt\n```\n\n## Benchmark\n\n### Setup\n\nThe benchmark was ran on Dell XPS 9570 with Intel Core i9-8950HK CPU @ 2.90GHz (12 logical cores). The upstream service to which proxy sent traffic was mocked by [bpf-echo](https://github.com/path-network/bpf-echo) server.\nTraffic was generated by [tcpkali](https://github.com/satori-com/tcpkali) v1.1.1 .\n\nThe following command was used for load generation in all cases (50 connections, 10s runtime, send PROXYv1 header for each connection, use `PING\\r\\n` as TCP message):\n\n```\ntcpkali -c 50 -T 10s -e1 'PROXY TCP4 127.0.0.1 127.0.0.1 \\{connection.uid} 25578\\r\\n' -m 'PING\\r\\n' 127.0.0.1:1122\n```\n\n### Results\n\n|                         | ⇅ Mbps    | ↓ Mbps    | ↑ Mbps    | ↓ pkt/s   | ↑ pkt/s   |\n| ----------------------- | --------- | --------- | --------- | --------- | --------- |\n| cloudflare/mmproxy      | 1524.454  | 756.385   | 768.069   | 70365.9   | 65921.9   |\n| go-mmproxy GOMAXPROCS=1 | 7418.312  | 2858.794  | 4559.518  | 262062.7  | 391334.6  |\n| go-mmproxy              | 45483.233 | 16142.348 | 29340.885 | 1477889.6 | 2518271.5 |\n| no proxy                | 52640.116 | 22561.129 | 30078.987 | 2065805.4 | 2581621.3 |\n\n![result barchart](benchmark.png)\n","funding_links":[],"categories":["Go"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpath-network%2Fgo-mmproxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpath-network%2Fgo-mmproxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpath-network%2Fgo-mmproxy/lists"}