{"id":22355764,"url":"https://github.com/zbo14/forward-proxying","last_synced_at":"2025-08-01T09:09:02.682Z","repository":{"id":44067528,"uuid":"211186438","full_name":"zbo14/forward-proxying","owner":"zbo14","description":"Presentation on forward proxies.","archived":false,"fork":false,"pushed_at":"2023-05-06T21:20:38.000Z","size":92,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-31T14:28:47.354Z","etag":null,"topics":["forward-proxy","http","https","socks-proxy"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zbo14.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-09-26T21:44:47.000Z","updated_at":"2021-12-01T06:06:51.000Z","dependencies_parsed_at":"2022-09-06T19:01:30.861Z","dependency_job_id":null,"html_url":"https://github.com/zbo14/forward-proxying","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbo14%2Fforward-proxying","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbo14%2Fforward-proxying/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbo14%2Fforward-proxying/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbo14%2Fforward-proxying/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zbo14","download_url":"https://codeload.github.com/zbo14/forward-proxying/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245659053,"owners_count":20651525,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["forward-proxy","http","https","socks-proxy"],"created_at":"2024-12-04T14:07:55.378Z","updated_at":"2025-03-26T13:13:15.940Z","avatar_url":"https://github.com/zbo14.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Forward proxying\nThis is the repo for a presentation I did on forward proxies!\n\n## What is a forward proxy?\n* Think of it as a two-way detour for network traffic originating from/coming back to a client\n* Proxy receives octets from the client and sends octets to a destination host specified by the client\n* Proxy receives octets from the destination host and forwards them to the client\n\n## Why use a forward proxy?\n* Obscure ultimate destination of web traffic\n* Block outbound access to certain websites\n* Circumvent restrictive firewall rules that prevent outbound traffic to certain websites\n* Encrypt traffic when visiting HTTP sites on untrusted network (e.g. using SOCKS proxy that tunnels traffic over SSH)\n* Modify requests from your browser on the fly\n\n## Types of forward proxies\n\n### HTTP proxy\nThe following overview reflects the naive implementation in `/scripts/http-proxy.js`.\n\n#### Overview\n1. Client crafts HTTP request and specifies destination host in [`Forwarded`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded) or [`X-Forwarded-Host`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host) headers\n1. Proxy receives HTTP request from client and sends nearly-identical HTTP/S request to destination host\n1. Proxy receives HTTP/S response from destination host and forwards it to client\n\n#### Pros\n* Is HTTP aware; doesn't require tunneling a transport layer protocol through an application level protocol\n\n#### Cons\n* Doesn't appear to be well-supported in browsers or system settings\n* All HTTP requests from client aren't encrypted\n\n### HTTPS proxy\nA good example is [mitmproxy](https://mitmproxy.org/).\n\n#### Overview\n1. Proxy receives HTTPS request from client and pretends to be the destination host by forging a TLS certificate for domain signed by a trusted authority.\n1. Proxy sends the HTTPS request to the actual destination host\n1. Proxy receives the HTTPS response from the host and forwards it to the client\n\n#### Pros\n* Allows users to view their own encrypted web traffic (more convenient to do this in the browser though)\n* Allows users to modify their own encrypted web traffic on the fly\n\n#### Cons\n* Overhead of negotiating multiple TLS sessions per request\n* Proxy has to do a lot of work generating certs on-demand\n\n### HTTP tunneling proxy\nRefer to implementation in `/scripts/http-tunneling-proxy.js`.\n\n#### Overview\n1. Proxy receives an [HTTP `CONNECT` request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) from the client with destination hostname/port\n1. Proxy establishes a TCP connection to hostname/port and \"pipes\" it to the client socket from the HTTP `CONNECT` request\n1. Traffic then flows between the client and destination host through the \"pipe\"\n\n#### Pros\n* Sometimes supported where SOCKS isn't (e.g. check your iphone)\n* Tor can be used as an HTTP tunneling proxy\n\n#### Cons\n* More overhead than SOCKS\n  * We're using an application level protocol (HTTP) to tunnel a transport layer protocol (TCP)\n  * Each `CONNECT` request includes HTTP headers\n* Cannot proxy DNS requests\n* Client `CONNECT` requests aren't encrypted (traffic to/from HTTPS website is encrypted once TLS session is negotiated over \"pipe\")\n\n### SOCKS proxy\n\n#### Overview\nThe [wiki page](https://en.wikipedia.org/wiki/SOCKS) has explanations of the different protocol versions.\n\nThe following summary hand-waves some details, e.g. how the SOCKS4 handshake involves a single exchange of messages while SOCKS5 requires multiple.\n\n1. Proxy accepts a TCP connection from client and receives octets specifying...\n  * SOCKS version (4 or 5)\n  * SOCKS command\n      * Establish a TCP/IP stream connection\n      * Associate a UDP port (in version 5)\n  * Destination host and port\n  * Optional user ID\n  * Authentication method/credentials (in version 5)\n2. Proxy attempts to connect to destination host and responds to client with octets specifying...\n  * SOCKS version (4 or 5)\n  * Chosen authentication method, if any (in version 5)\n  * Status code\n  * Bound address and port\n3. If the handshake is successful, subsequent octets received on the client socket will be sent to the destination host (and vice-versa)\n\n#### Pros\n* SOCKS5 supports UDP port association so we can proxy DNS requests\n* Tor can be used as a SOCKS proxy\n* `OpenSSH` supports dynamic port forwarding and can act as a SOCKS proxy\n\n```bash\n## use `-D` to start a SOCKS proxy server on local port 12345\n## use `-N` since we only want to forward ports\n\nssh -Nv -D 127.0.0.1:12345 -i $KEY $USER@$HOST\n```\n\n#### Cons\n* Some applications/devices don't support SOCKS proxies\n* Traffic from client to SOCKS proxy isn't encrypted\n\n## What forward proxy should I use?\nDepends on what you're trying to do and what's supported by the applications/devices you're using. If you want to man-in-the-middle your own web traffic, then you'd use a TLS interception proxy like `mitmproxy`. Otherwise, you'd probably want to use a tunneling proxy. The ideal option would be a SOCKS proxy that tunnels your traffic over SSH. If the client you're using doesn't support SOCKS then an HTTP tunneling proxy will do.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzbo14%2Fforward-proxying","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzbo14%2Fforward-proxying","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzbo14%2Fforward-proxying/lists"}