cproxy
cproxy
can redirect TCP and UDP traffic made by a program to a proxy, without requiring the program supporting a proxy.
Compared to many existing complicated transparent proxy setup, cproxy
usage is as easy as proxychains
, but unlike proxychains
, it works on any program (including static linked Go programs) and redirects DNS requests.
Note: The proxy used by cproxy
should be a transparent proxy port (such as V2Ray's dokodemo-door
inbound and shadowsocks ss-redir
). A good news is that even if you only have a SOCKS5 or HTTP proxy, there are tools that can convert it to a transparent proxy for you (for example, transocks, ipt2socks and ip2socks-go).
Installation
You can install by downloading the binary from the release page or install with cargo
:
cargo install cproxy
Usage
proxychains
Simple usage: just like You can launch a new program with cproxy
with:
cproxy --port -- --arg1 --arg2 ...
All TCP connections and DNS requests will be proxied. In this case, your local transparent proxy should support DNS address overriding to make DNS requests redirection work properly. For an example setup, see wiki. If you don't want to proxy DNS requests, run with
cproxy --port --no-dns -- --arg1 --arg2 ...
Simple usage: use iptables tproxy
If your system support tproxy
, you can use tproxy
with --use-tproxy
flag:
cproxy --port <destination-local-port> --use-tproxy -- <your-program> --arg1 --arg2 ...
# or for existing process
cproxy --port <destination-local-port> --use-tproxy --pid <existing-process-pid>
With --use-tproxy
, there are several differences:
- All UDP traffic are proxied instead of only DNS UDP traffic to port 53.
- Your V2Ray or shadowsocks service should have
tproxy
enabled on the inbound port. For V2Ray, you need"tproxy": "tproxy"
as in V2Ray Documentation. For shadowsocks, you need-u
as shown in shadowsocks manpage.
An example setup can be found here.
Note that when you are using the tproxy
mode, you can override the DNS server address with cproxy --use-tproxy --override-dns
. This is useful when you want to use a different DNS server for a specific application.
Advanced usage: proxy an existing process
With cproxy
, you can even proxy an existing process. This is very handy when you want to proxy existing system services such as docker
. To do this, just run
cproxy --port --pid
The target process will be proxied as long as this cproxy
command is running. You can press Ctrl-C to stop proxying.
How does it work?
cproxy
creates a unique cgroup
for the proxied program, and redirect its traffic with packet rules.
Limitations
cproxy
requiressudo
and root access to modifycgroup
.- Currently only tested on Linux.
Similar projects
There are some awesome existing work:
- graftcp: work on most programs, but cannot proxy UDP (such as DNS) requests.
graftcp
also has performance hit on the underlying program, since it usesptrace
. - proxychains: easy to use, but not working on static linked programs (such as Go programs).
- proxychains-ng: similar to proxychains.
- cgproxy:
cgproxy
also uses cgroup to do transparent proxy, and the idea is similar tocproxy
's. There are some differences in UX and system requirements:cgproxy
requires systemcgroup
v2 support, whilecproxy
requires v1.cgproxy
requires a background daemon processcgproxyd
running, whilecproxy
does not.cgproxy
requirestproxy
, which is optional incproxy
.cgproxy
can be used to do global proxy, whilecproxy
does not intended to support global proxy.