divert_tcp

This escaper forwards every TCP stream to another proxy and prepends a PROXY Protocol v2 header first.

It behaves like a chained TCP proxy escaper, but it always prepends PROXY Protocol v2 metadata that tells the peer which upstream target should be used.

The PPv2 Type-Values are:

• 0xE0 | Upstream Address

  Target upstream address, encoded in UTF-8 without a trailing \\0. This field is always present. The next proxy server should connect to this upstream address.

• 0xE1 | TLS Verify Name

  TLS verification name, encoded in UTF-8 without a trailing \\0. This is set only if the TLS handshake starts on our side.

• 0xE2 | Username

  Client username, encoded in UTF-8 without a trailing \\0. This is set only if client authentication is enabled on our side.

• 0xE3 | Task ID

  Task ID in UUID binary format. This field is always present.

The following interfaces are supported:

• tcp connect

• http(s) forward

There is no path selection support for this escaper.

The following common keys are supported:

• shared_logger

• resolver, required only if proxy_addr is domain

• resolve_strategy

• tcp_sock_speed_limit

• bind_interface

• no_ipv4

• no_ipv6

• tcp_connect

• happy eyeballs

• tcp_misc_opts

• extra_metrics_tags

proxy_addr

required, type: upstream str | seq

Set the target proxy address. The default port is 3128 and may be omitted.

If a seq is used, each element must be a weighted upstream addr.

proxy_addr_pick_policy

optional, type: selective pick policy

Set the policy used to select the next proxy address.

The key for ketama/rendezvous/jump hash is <client-ip>[-<username>]-<upstream-host>.

default: random

bind_ipv4

optional, type: ipv4 addr str

Set the bind IP address for IPv4 sockets.

default: not set

bind_ipv6

optional, type: ipv6 addr str

Set the bind IP address for IPv6 sockets.

default: not set

tcp_keepalive

optional, type: tcp keepalive

Configure TCP keepalive.

User-level TCP keepalive settings are not applied.

default: no keepalive set

Example

proxy_addr:
  - addr: divert-a.example.net:3128
    weight: 2.0
  - divert-b.example.net:3128
proxy_addr_pick_policy: rendezvous
resolver: default
tcp_keepalive: 60s