socks_proxy

This server provides a SOCKS proxy with support for TCP CONNECT and UDP ASSOCIATE.

The following common keys are supported:

• escaper

• auditor

• user_group

• shared_logger

• listen_in_worker

• tcp_sock_speed_limit

• udp_sock_speed_limit

• ingress_network_filter

• dst_host_filter_set

• dst_port_filter

• tcp_copy_buffer_size

• tcp_copy_yield_size

• udp_relay_packet_size

• udp_relay_yield_count

• udp_relay_batch_count

• udp_relay_underlying_buffer_size

• tcp_misc_opts

• udp_misc_opts

• task_idle_check_interval

• task_idle_max_count

• flush_task_log_on_created

• flush_task_log_on_connected

• task_log_flush_interval

• extra_metrics_tags

The authentication methods supported by this server depend on the type of the configured user group.

auth scheme	user group type	is supported
user	hashed_user	yes
gssapi	gss_api	not yet

listen

optional, type: tcp listen

Listening configuration for this server.

The instance count setting will be ignored if listen_in_worker is correctly enabled.

default: not set

Added in version 1.7.20: change listen config to be optional

use_udp_associate

optional, type: bool, alias: enable_udp_associate, udp_associate_enabled

Controls whether UDP ASSOCIATE is used instead of UDP CONNECT.

default: false

username_params

optional, type: username_params

Allows the egress context to be populated from username parameters.

This is mainly useful when the selected escaper chain includes comply_context.

default: not set

Added in version 1.13.0.

negotiation_timeout

optional, type: humanize duration

Maximum time allowed for SOCKS negotiation before processing the actual SOCKS command.

default: 4s

udp_client_initial_timeout

optional, type: humanize duration

Maximum time to wait for the first UDP packet after the UDP port information is returned to the client.

default: 30s

udp_bind_ipv4

optional, type: list of ipv4 addr str

IPv4 addresses used when binding the local UDP socket exposed to the SOCKS client. If not set, the server IP used for the TCP connection is used when creating the UDP listener.

If set, the tcp connect can be in ipv6 address family.

Multiple addresses are allowed. One address is picked when the UDP listener is created.

default: not set

udp_bind_ipv6

optional, type: list of ipv6 addr str

IPv6 addresses used when binding the local UDP socket exposed to the SOCKS client. If not set, the server IP used for the TCP connection is used when creating the UDP listener.

If set, the tcp connect can be in ipv4 address family.

Multiple addresses are allowed. One address is picked when the UDP listener is created.

default: not set

udp_bind_port_range

optional, type: port range

UDP port range used when binding the local UDP socket exposed to the SOCKS client. If not set, the port is chosen by the operating system.

udp_socket_buffer

optional, type: socket buffer config

Socket-buffer configuration for the UDP socket.

default: not set

Changed in version this: will not change escaper side config since version 1.13.5

transmute_udp_echo_ip

optional, type: map | bool

Use this when the server should return an IP address other than the real local bind IP of the UDP listener.

In map form, the key is the local IP and the value is the IP address the client should use instead. If no matching key is found, the unspecified address of the same family is used.

If set to true, an empty map is used. If set to false, the feature is disabled.

default: not set

Changed in version 1.9.9: allow bool value and change to use unspecified ip if no match records

auto_reply_local_ip_map

deprecated

Changed in version 1.11.8: deprecated, use transmute_udp_echo_ip instead

Example

use_udp_associate: true
udp_bind_ipv4:
  - 192.0.2.10
  - 192.0.2.11
udp_bind_port_range: 40000-45000
transmute_udp_echo_ip:
  192.0.2.10: 198.51.100.10
  192.0.2.11: 198.51.100.11