2014-04-08 17:03:21 +08:00
|
|
|
|
<ul>
|
|
|
|
|
|
<li>3APA3A 3proxy tiny proxy server HowTo
|
|
|
|
|
|
<br>Under construction, very incomplete
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A HREF="#COMPILE">Compilation</A>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A HREF="#MSVC">How to compile 3proxy with Visual C++</A>
|
|
|
|
|
|
<li><A HREF="#INTL">How to compile 3proxy with Intel C Compiler under Windows</A>
|
|
|
|
|
|
<li><A HREF="#GCCWIN">How to compile 3proxy with GCC under Windows</A>
|
|
|
|
|
|
<li><A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A>
|
|
|
|
|
|
<li><A HREF="#CCCUNIX">How to compile 3proxy with Compaq C Compiler under Unix/Linux</A>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<li><A HREF="#INSTALL">Proxy server installation and removal</A>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A HREF="#INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
|
|
|
|
|
|
<li><A HREF="#INST95">How to install/remove 3proxy under Windows 95/98/ME</A>
|
|
|
|
|
|
<li><A HREF="#INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<li><A HREF="#SERVER">Server configuration</A>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A HREF="#SAMPLE">Where to find configuration example</A>
|
|
|
|
|
|
<li><A HREF="#LOGGING">How to set up logging</A>
|
|
|
|
|
|
<li><A HREF="#LOGFORMAT">How to setup logging format</A>
|
|
|
|
|
|
<li><A HREF="#LOGANALIZERS">How to use log analizers with 3proxy</A>
|
|
|
|
|
|
<li><A HREF="#LAUNCH">How to start any of proxy services (HTTP, SOCKS etc)</A>
|
|
|
|
|
|
<li><A HREF="#BIND">How to bind service to specific interface and port?</A>
|
|
|
|
|
|
<li><A HREF="#AUTH">How to limit service access</A>
|
|
|
|
|
|
<li><A HREF="#USERS">How to create user list</A>
|
|
|
|
|
|
<li><A HREF="#ACL">How to limit user access to resources</A>
|
|
|
|
|
|
<li><A HREF="#REDIR">How to manage redirections</A>
|
|
|
|
|
|
<li><A HREF="#ROUNDROBIN">How to balance traffic between few external channgels?</A>
|
|
|
|
|
|
<li><A HREF="#CHAIN">How to manage proxy chains</A>
|
|
|
|
|
|
<li><A HREF="#BANDLIM">How to limit bandwidth</A>
|
|
|
|
|
|
<li><A HREF="#TRAFLIM">How to limit traffic amount</A>
|
|
|
|
|
|
<li><A HREF="#NETLIST">How to build network lists</A>
|
2016-01-15 06:24:08 +08:00
|
|
|
|
<li><a href="#NSCACHING">How to configure name resolution and DNS caching</a>
|
|
|
|
|
|
<li><a href="#IPv6">How to use IPv6</a>
|
2014-04-08 17:03:21 +08:00
|
|
|
|
</ul>
|
|
|
|
|
|
<li><A HREF="#CLIENT">Client configuration</A>
|
|
|
|
|
|
<li><A HREF="#ADMIN">Administering and information analisys</A>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A HREF="#NEWVERSION">How to obtain latest 3proxy version</A>
|
|
|
|
|
|
<li><A HREF="#NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</A>
|
|
|
|
|
|
<li><A HREF="#ERRORS">Log error codes reference</A>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<li><A HREF="#QUEST">How To ask quiestion not in How To?</A>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<br>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="COMPILE">Compilation</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A NAME="MSVC">How to compile 3proxy with Visual C++</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Extract source code files from 3proxy.tgz (with WinZip or another utility).
|
|
|
|
|
|
Use nmake /f Makefile.msvc command
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="INTL">How to compile 3proxy with Intel C Compiler under Windows</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
See <A HREF="#MSVC">How to compile 3proxy with Visual C++</A>
|
|
|
|
|
|
Use Makefile.intl instead of Makefile.msvc
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="GCCWIN">How to compile 3proxy with GCC under Windows</A></li>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Extract source files from 3proxy.tgz (for example with tar -xzf 3proxy.tgz command if you have tar installed)
|
|
|
|
|
|
Use make -f Makefile.win command.
|
|
|
|
|
|
If you want to use POSIX emulation Cygwin library (normally you shouldn't) - use make -f Makefile.unix instead.
|
|
|
|
|
|
Windows specific things (like installing as service) will not be available if compiled with Cygwin emulation.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A></li>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Use
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
make -f Makefile.Linux
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
for Linux or Cygwin, Makefile.Solaris* (depending on compiler version) for Solaris
|
|
|
|
|
|
and Makefile.unix for different Unix-like OS. On BSD derivered systems make
|
|
|
|
|
|
sure to use GNU make, sometimes it's called gmake instead of make.
|
|
|
|
|
|
<br>Compilation is tested under FreeBSD/i386, NetBSD/i386, OpenBSD/i386,
|
|
|
|
|
|
RH Linux/Alpha, Debian/i386, Gentoo/i386, Gentoo/PPC, Solaris/x86 but you
|
|
|
|
|
|
shouldn't have problems under different Solaris, BSD or linux compatible systems.
|
|
|
|
|
|
For different systems you may be required to patch Makefile or even source codes.
|
|
|
|
|
|
If you want to use ODBC support, make sure to install ODBC for unix, remove -DNOODBC
|
|
|
|
|
|
option from makefile compiler options and add ODBC library to linker variable.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="CCCUNIX">How to compile 3proxy with Compaq C Compiler under Unix/Linux</A></li>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
See <A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A>, use Makefile.ccc instead of Makefile.unix.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="INSTALL">Proxy server installation and removal</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A NAME="INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Unpack 3proxy.zip to any directory, for example
|
|
|
|
|
|
c:\Program Files\3proxy. If needed, create directory for storing log files,
|
|
|
|
|
|
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See <A HREF="#SERVER">Server configuration</A>).
|
|
|
|
|
|
If you use 3proxy before 0.6 Add
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
service
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
string into 3proxy.cfg. Now, start command prompt (cmd.exe).
|
|
|
|
|
|
Change directory to 3proxy installation and run 3proxy.exe --install:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
D:\>C:
|
|
|
|
|
|
C:\>cd C:\Program Files\3proxy
|
|
|
|
|
|
C:\Program Files\3proxy>3proxy.exe --install
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Now, you should have 3proxy service installed and running. If service is not
|
|
|
|
|
|
started, remove "service" string from 3proxy.cfg, run 3proxy.exe manually
|
|
|
|
|
|
and correct all errors.
|
|
|
|
|
|
</p><p>
|
|
|
|
|
|
To remove 3proxy run 3proxy --remove:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
D:\>C:
|
|
|
|
|
|
C:\>cd C:\Program Files\3proxy
|
|
|
|
|
|
C:\Program Files\3proxy>net stop 3proxy
|
|
|
|
|
|
C:\Program Files\3proxy>3proxy.exe --remove
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Now you can simply remove 3proxy installation directory.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="INST95">How to install/remove 3proxy under Windows 95/98/ME</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Unpack 3proxy.zip to any directory, for example
|
|
|
|
|
|
c:\Program Files\3proxy. If needed, create directory for storing log files,
|
|
|
|
|
|
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See <A HREF="#SERVER">Server configuration</A>).
|
|
|
|
|
|
Remove string
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
service
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
from 3proxy.cfg and add
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
daemon
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
if you want 3proxy to run in background.
|
|
|
|
|
|
Create shortcut for 3proxy.exe and place it in autostart or add
|
|
|
|
|
|
to registry with regedit.exe:
|
|
|
|
|
|
<br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run</br>
|
|
|
|
|
|
Type: String
|
|
|
|
|
|
<br>3proxy = "c:\Program Files\3proxy.exe" "C:\Program Files\3proxy.cfg"<br>
|
|
|
|
|
|
You must use quotes if path contains space. If neccessary, restart Windows.
|
|
|
|
|
|
If service is not started, check log. Remove "daemon" command from 3proxy.cfg,
|
|
|
|
|
|
start 3proxy.exe manually and correct all errors.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Complie 3proxy (see <A HREF="#COMPILE">Compilation</A>). Copy
|
|
|
|
|
|
executables to any appropriate location (for example /usr/local/3proxy/sbin
|
|
|
|
|
|
for servers and /usr/local/3proxy/bin for utilities).
|
|
|
|
|
|
Create /usr/local/etc/3proxy.cfg.
|
|
|
|
|
|
(see <A HREF="#SERVER">Server configuration</A>).
|
|
|
|
|
|
You can change default configuration file location by specifing configuration file
|
|
|
|
|
|
in 3proxy command line.
|
|
|
|
|
|
Add 3proxy to system startup scripts.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="SERVER">Server configuration</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A NAME="SAMPLE">Where to find configuration example</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Server configuration example 3proxy.cfg.sample is in any 3proxy distribution.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="LOGGING">How to set up logging</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
3proxy can log to stdout, file, ODBC datasource and
|
|
|
|
|
|
syslog (Unix/Linux/Cygwin only). For using ODBC under Unix/Linux you must
|
|
|
|
|
|
compile 3proxy with Unix ODBC libraries, see <A HREF="#COMPILE">Compilation</A>.
|
|
|
|
|
|
You can control logging from 3proxy.cfg for all services or you can control
|
|
|
|
|
|
logging of individual service, for example
|
|
|
|
|
|
/usr/local/sbin/socks -l/var/log/socks.log starts SOCKS proxy with logging to file.
|
|
|
|
|
|
For universal proxy (3proxy) log file rotation and archiving is supported.
|
|
|
|
|
|
Log type is defined with "log" configuration file command or with
|
|
|
|
|
|
-l switch on individual service invokation. log or -l is stdout logging.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
log filename
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
and
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
-lfilename
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
specify filename for logging
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
log @ident
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
and
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
-l@ident
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
specify ident for syslog logging. If filename within "log" command contains
|
|
|
|
|
|
'%' characters, it's processes as format specificator (see "logformat"). E.g.
|
|
|
|
|
|
log c:\3proxy\logs\%y%m%d.log D creates file like c:\3proxy\logs\060729.log,
|
|
|
|
|
|
date is generated based on local time.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
log &connstring
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
|
|
|
|
|
|
specifies ODBC connection string, connstring is in format
|
|
|
|
|
|
datasource,username,password (2 last are optional of
|
|
|
|
|
|
datasource does not require or already has authentication information).
|
|
|
|
|
|
Also, you must specify logformat to build SQL query, to insert recod into
|
|
|
|
|
|
log, see <A HREF="#LOGFORMAT">How to setup logging format</A>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Rotation and archiving may be set up with log, rotate <20> archiver commands
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
log filename LOGTYPE
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
sets rotation type. LOGTYPE may be:
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li>M, monthely
|
|
|
|
|
|
<li>W, weekly
|
|
|
|
|
|
<li>D, daily
|
|
|
|
|
|
<li>H, hourly
|
|
|
|
|
|
<li><EFBFBD>, minutely
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
rotate NUMBER
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
specifies number of files in rotation (that is how many files to keep).
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
archiver EXT COMMAND PARAMETERS
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Sets external archiver. EXT is extention of archived files
|
|
|
|
|
|
(for example zip, gz, Z, rar etc) COMMAND and PARAMETERS are command
|
|
|
|
|
|
to execute and command line PARAMETERS. Originale file is not deleted by
|
|
|
|
|
|
3proxy, this work is left for archiver.
|
|
|
|
|
|
You can pass original filename to archiver with %F macro and archive filename with %A.
|
|
|
|
|
|
Examples are located in
|
|
|
|
|
|
3proxy.cfg.sample
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="LOGFORMAT">How to setup logging format</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Since 0.3 version log format may be set with "logformat" command.
|
|
|
|
|
|
First symbol of log format specifies format of date and time and
|
|
|
|
|
|
should be L (LOCAL) or G (GMT - Grinwitch Meridian Time). Format
|
|
|
|
|
|
string may contains some macro substitutions:
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li> %y - Year (2 digits)
|
|
|
|
|
|
<li> %Y - Year (4 digits)
|
|
|
|
|
|
<li> %m - Month (2 digits)
|
|
|
|
|
|
<li> %o - mOnth (3 letter abbriviation)
|
|
|
|
|
|
<li> %d - Day (2 digits)
|
|
|
|
|
|
<li> %H - Hour (2 digits)
|
|
|
|
|
|
<li> %M - Minute (2 digits)
|
|
|
|
|
|
<li> %S - Second (2 digits)
|
|
|
|
|
|
<li> %t - Timestamp (seconds since January, 1 1970 00:00:00 GMT)
|
|
|
|
|
|
<li> %. - Milliseconds
|
|
|
|
|
|
<li> %z - Timezone in mail format (from GMT, '+' east, '-' west HHMM), For example Moscow winter time is +0300.
|
|
|
|
|
|
<li> %U - Username ('-' if unknown).
|
|
|
|
|
|
<li> %N - Service name (PROXY, SOCKS, POP3P, etc)
|
|
|
|
|
|
<li> %p - Service port
|
|
|
|
|
|
<li> %E - Error code (see. <A HREF="#ERRORS">Log error codes reference</A>)
|
|
|
|
|
|
<li> %C - client IP
|
|
|
|
|
|
<li> %c - client port
|
|
|
|
|
|
<li> %R - target IP
|
|
|
|
|
|
<li> %r - target port
|
|
|
|
|
|
<li> %e - external IP address used to establish connection
|
|
|
|
|
|
<li> %Q - requested IP
|
|
|
|
|
|
<li> %q - requested port
|
|
|
|
|
|
<li> %I - bytes received from target
|
|
|
|
|
|
<li> %O - bytes sent to target
|
|
|
|
|
|
<li> %n - host name from request
|
|
|
|
|
|
<li> %h - hops before target (if redirection or chaning is used).
|
|
|
|
|
|
see <A HREF="#CHAIN">How to use chains and parent proxies</A>)
|
|
|
|
|
|
<li> %T - service specific text (for example URL requested). %X-YT
|
|
|
|
|
|
where X and Y are positive numbers, only displays fields
|
|
|
|
|
|
(space delimited) X to Y of the text. An example is %1-2T.
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
Example:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
logformat "L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
generates something like
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
1042454727.0296 SOCK4.1080 000 3APA3A 127.0.0.1:4739 195.122.226.28:4739 505 18735 1 GET http://3proxy.ru/ HTTP/1.1
|
|
|
|
|
|
</font>
|
|
|
|
|
|
<br>(no line breaks)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
If ODBC used, logformat should specify SQL command,
|
|
|
|
|
|
to insert record into log, for example
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
logformat "GINSERT INTO proxystat VALUES (%t, '%c', '%U', %I)"
|
|
|
|
|
|
</font>
|
|
|
|
|
|
<br>(no line breaks)
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="LOGANALIZERS">How to use log analizers with 3proxy</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Just make format of 3proxy logs compatible with format supported by your
|
|
|
|
|
|
favourite log analizer. Examples of compatible logformats are:
|
|
|
|
|
|
<br>
|
|
|
|
|
|
For Squid access.log:
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
"- +_G%t.%. %D %C TCP_MISS/200 %I %1-1T %2-2T %U DIRECT/%R application/unknown"
|
|
|
|
|
|
</p>
|
|
|
|
|
|
or, more compatible format without %D
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
"- +_G%t.%. 1 %C TCP_MISS/200 %I %1-1T %2-2T %U
|
|
|
|
|
|
DIRECT/%R application/unknown"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
ISA 2000 proxy WEBEXTD.LOG (fields are TAB-delimited):
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
"- + L%C %U Unknown Y %Y-%m-%d %H:%M:%S
|
|
|
|
|
|
w3proxy 3PROXY - %n %R %r %D
|
|
|
|
|
|
%O %I http TCP %1-1T %2-2T - -
|
|
|
|
|
|
%E - - -"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
ISA 2004 proxy WEB.w3c (fields are TAB-delimited):
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
"- + L%C %U Unknown %Y-%m-%d %H:%M:%S
|
|
|
|
|
|
3PROXY - %n %R %r %D %O
|
|
|
|
|
|
%I http %1-1T %2-2T - %E -
|
|
|
|
|
|
- Internal External 0x0 Allowed"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
ISA 2000/2004 firewall FWSEXTD.log (fields are TAB-delimited):
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
"- + L%C %U unnknown:0:0.0 N %Y-%m-%d
|
|
|
|
|
|
%H:%M:%S fwsrv 3PROXY - %n %R %r
|
|
|
|
|
|
%D %O %I %r TCP Connect - -
|
|
|
|
|
|
- %E - - - - -"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
HTTPD standard log (Apache and others):
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
"-""+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] ""%T"" %E %I"
|
|
|
|
|
|
</p>
|
|
|
|
|
|
or more compatible without error code
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
"-""+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] ""%T"" 200 %I"
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="LAUNCH">How to start any of proxy services (HTTP, SOCKS etc)</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
3proxy is distributed in 2 variants: as a set of standalone modules (proxy,
|
|
|
|
|
|
socks, pop3p, tcppm, udppm) and as universal proxy server. These services are
|
|
|
|
|
|
absolutely independant, and if you use 3proxy you needn't any of standalone
|
|
|
|
|
|
modules.
|
|
|
|
|
|
<br>Standalone modules are only configurable via command line interface while
|
|
|
|
|
|
3proxy uses configuration file. Many functions, such as ODBC logging, log
|
|
|
|
|
|
rotation, access control, etc are only available in 3proxy, not in standalone
|
|
|
|
|
|
proxies.
|
|
|
|
|
|
Standalone module may be started from command line, for example:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
$/sbin/socks -l/var/log/socks.log -i127.0.0.1
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Starts SOCKS server binded to localhost ip, port 1080 with logging to
|
|
|
|
|
|
/var/log/socks.log.
|
|
|
|
|
|
You can get help for any standalone service with -? command line option.
|
|
|
|
|
|
</p><p>
|
|
|
|
|
|
If 3proxy is used you should start all services in 3proxy.cfg file. 3proxy.cfg
|
|
|
|
|
|
is executed by 3proxy as a batch file. Example of 3proxy.cfg and command syntaxys
|
|
|
|
|
|
can be found in
|
|
|
|
|
|
3proxy.cfg.sample.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
log /var/log/3proxy.log D
|
|
|
|
|
|
rotate 30
|
|
|
|
|
|
internal 127.0.0.1
|
|
|
|
|
|
external 192.168.1.1
|
|
|
|
|
|
proxy
|
|
|
|
|
|
socks -p3129
|
|
|
|
|
|
pop3p
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Starts 3 services: HTTP PROXY, SOCKS and POP3 PROXY. Each listens localhost
|
|
|
|
|
|
interface with default port (3128 for HTTP, 1080 for SOCKS and 110 for POP3P)
|
|
|
|
|
|
except socks started with port 3129.
|
|
|
|
|
|
All logs are in file /var/log/3proxy.log (with daily date modification and
|
|
|
|
|
|
rotation). 30 last files are stored.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="BIND">How to bind service to specific interface and port?</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
-i options specifies internal interface, -p - listening port. No space are
|
|
|
|
|
|
allowed. To bind 'proxy' service to port 8080 on interfaces 192.168.1.1
|
|
|
|
|
|
and 192.168.2.1 use
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
proxy -p8080 -i192.168.1.1
|
|
|
|
|
|
proxy -p8080 -i192.168.2.1
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="AUTH">How to limit service access</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
First, always specify internal interface to accept incoming connection with
|
|
|
|
|
|
'internal' configuration command or '-i' service command. (See
|
|
|
|
|
|
<A HREF="#LAUNCH">How to start any of proxy services (HTTP, SOCKS etc)</A>). If
|
|
|
|
|
|
no internal interface is specified your proxy will act as open one.
|
|
|
|
|
|
<p>It's also important to specify external interface to prevent access to
|
|
|
|
|
|
internal network with 'external' or -e.
|
|
|
|
|
|
<p>3proxy with configuration files allows to use authentication and
|
|
|
|
|
|
authorization for user's access. Authentication is possible by
|
|
|
|
|
|
username/password or user's NetBIOS name. Authentication type is specified by
|
|
|
|
|
|
'auth' command.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth none
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Disables both authentication and authorization. You can not use ACLs.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth iponly
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Specifies no authentication, ACLs authorization is used.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth nbname
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Authentication by NetBIOS name + ACLs. NetBIOS name of 'messenger' service
|
|
|
|
|
|
is obrained before ACL validation. If no name is obtained it's assumed to be
|
|
|
|
|
|
empty. Messenger is started by default in Windows NT/2000/XP. For Win9x
|
|
|
|
|
|
WinPopUP need to be launched. This type of authentication may be spoofed
|
|
|
|
|
|
by privileged local user.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth strong
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Authentication by username/password. If user is not registered his
|
|
|
|
|
|
access is denied regardless of ACLs.
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Different services can have different authentication levels.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth none
|
|
|
|
|
|
pop3p
|
|
|
|
|
|
auth iponly
|
|
|
|
|
|
proxy
|
|
|
|
|
|
auth strong
|
|
|
|
|
|
socks
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
|
|
|
|
|
|
It's possible to authorize access by client IP address, IP address or requested resource,
|
|
|
|
|
|
target port, time, etc after authentication.
|
|
|
|
|
|
(See <A HREF="#ACL">How to limit resource access</A>).
|
|
|
|
|
|
</p><p>Since 0.6 version double authentication is possible, e.g.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth iponly strong
|
|
|
|
|
|
allow * * 192.168.0.0/16
|
|
|
|
|
|
allow user1,user2
|
|
|
|
|
|
proxy
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
strong authentication will only be used if ACL requires username to deside if
|
|
|
|
|
|
access must be granted. That is, in example, strong username authentication
|
|
|
|
|
|
is not required to access 192.168.0.0/16
|
|
|
|
|
|
</p><p>0.6 version introduces authentication (username) caching to increase
|
|
|
|
|
|
productivity. It's recommended to use authentication caching with resource
|
|
|
|
|
|
or time consuming authentication types, such as nbname or external plugins
|
|
|
|
|
|
(WindowsAuthentication).
|
|
|
|
|
|
Caching can be set with 'authcache' command with 2 parameters: caching type
|
|
|
|
|
|
and caching time (in seconds). Caching type defines the type of cached access:
|
|
|
|
|
|
'ip' - after successful authentication all connections during caching time
|
|
|
|
|
|
from same IP are assigned to the same user, username is not requested.
|
|
|
|
|
|
"ip,user" - username is requested and all connections from the same IP are
|
|
|
|
|
|
assigned to the same user without actual authentication. "user" - same as above,
|
|
|
|
|
|
but IP is not checked. "user,password" - username and password are checked
|
|
|
|
|
|
against cached ones. For authentication special authentication type 'cache'
|
|
|
|
|
|
must be used.
|
|
|
|
|
|
Example:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
authcache ip 60
|
|
|
|
|
|
auth cache strong windows
|
|
|
|
|
|
proxy -n
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
Please note, that caching affects security. Never use caching for access to
|
|
|
|
|
|
critical resources, such as web administration.
|
|
|
|
|
|
|
|
|
|
|
|
<li><A NAME="USERS">How to create user list</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Userslist is created with 'users' command.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
users USERDESC ...
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
With a single command it's possible to define few users, or you
|
|
|
|
|
|
can use few 'users' commands. USERDESC is user description. Description
|
|
|
|
|
|
consists of three semicolon delimited parts - login, password type and
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
users admin:CL:bigsecret test:CL:password test1:CL:password1
|
|
|
|
|
|
users "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
|
|
|
|
|
|
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Please note the usage of quotation sign: it's required to comment out $ sign
|
|
|
|
|
|
overwise used as a file inclusion macro.
|
|
|
|
|
|
Next password types are available:
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li>No password type: use system authentication.
|
|
|
|
|
|
<li>CL - cleartext password
|
|
|
|
|
|
<li>CR - crypt password, only MD5 crypt passwords are supported
|
|
|
|
|
|
<li>NT - NT-hashed (MD4) passwords in hex, as used in pwdump or SAMBA
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
NT and crypt passwords can be used to import accounts from Windows/SAMBA or
|
|
|
|
|
|
Unix. For Windows you can use pwdump family of utilities.
|
|
|
|
|
|
It's convenient to store accounts apart and include account file with $ macro.
|
|
|
|
|
|
Because for included files newlines are treated as a space, it's possible to
|
|
|
|
|
|
use atandard passwd file format:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
users $/etc/.3proxypasswd
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
or
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
users $"c:\Program Files\3proxy\passwords"
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
It's possible to create NT and crypt passwords with mycrypt utility included
|
|
|
|
|
|
in distribution.
|
|
|
|
|
|
<br>Userlist is system-wide. To manage user access to specific service use ACLs.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="ACL">How to limit user access to resources</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Commands allow, deny and flush are used to manage ACLs:
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
allow <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist> <weekdaylist> <timeperiodlist>
|
|
|
|
|
|
<br>deny <userlist> <sourcelist> <targetlist> <weekdaylist> <timeperiodlist>
|
|
|
|
|
|
<br>flush
|
|
|
|
|
|
</font>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
'flush' command is used to finish with existing ACL and to start new one.
|
|
|
|
|
|
It's required to have different ACLs for different services.
|
|
|
|
|
|
'allow' is used to allow connection and 'deny' to deny connection. 'allow'
|
|
|
|
|
|
command can be extended by 'parent' command to manage redirections (see <A NAME="REDIR">How to manage redirections</A>)). If ACL
|
|
|
|
|
|
is empty it allow everything. If ACL is not empty, first matching ACL entry
|
|
|
|
|
|
is searched for user request and ACL action (allow or deny) performed. If
|
|
|
|
|
|
no matching record found, connection is denied and user will be asked to
|
|
|
|
|
|
re-authenticate (requested for username/password). To prevent this request
|
|
|
|
|
|
add 'deny *' to the end of list.
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><userlist> - comma delimited list of users
|
|
|
|
|
|
<li><sourcelist> - comma delimited list of source (client) networks.
|
|
|
|
|
|
Networks can be defined as single IP address or in CIDR form
|
|
|
|
|
|
xxx.yyy.zzz.mmm/l, where l - is the length of network mask
|
|
|
|
|
|
(a number of non-zero bits). 192.168.1.0/24
|
|
|
|
|
|
means network with 255.255.255.0 mask.
|
|
|
|
|
|
<li><targetlist> - comma delimited list of target (server) networks.
|
|
|
|
|
|
In 3proxy 0.6 and above it's allowed to use hostnames with wildmasks
|
|
|
|
|
|
in targetlist. Wildmask may only present in the begginning or at the
|
|
|
|
|
|
end of the hostname, e.g.
|
|
|
|
|
|
192.168.0.0/16,www.example.com,*wrongsite.com,*wrongcontent*.
|
|
|
|
|
|
<li><targetportlist> - comma delimited list of ports. I
|
|
|
|
|
|
It's possible to define port ranges with -, e.g. 80,1024-65535
|
|
|
|
|
|
means port 80 and all unprivileged ports.
|
|
|
|
|
|
<li><commandlist> - the list of allowed actions
|
|
|
|
|
|
<br> CONNECT - establish outgoing TCP connection. e.g. POP3 or SOCKSv5
|
|
|
|
|
|
<br> BIND - allow incoming TCP connection (SOCKSv5)
|
|
|
|
|
|
<br> UDPASSOC - create UDP association (SOCKSv5)
|
|
|
|
|
|
<br> ICMPASSOC - create ICMP association (not implemented)
|
|
|
|
|
|
<br> HTTP_GET - HTTP GET request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP_PUT - HTTP PUT request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP_POST - HTTP POST request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP_HEAD - HTTP HEAD request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP_CONNECT - HTTP CONNECT, aka HTTPS request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP_OTHER - another HTTP request (HTTP proxy)
|
|
|
|
|
|
<br> HTTP - any HTTP request except HTTP_CONNECT (HTTP proxy)
|
|
|
|
|
|
<br> HTTPS - alias to HTTP_CONNECT (HTTP proxy)
|
|
|
|
|
|
<br> FTP_GET - FTP get request (http, ftp proxy)
|
|
|
|
|
|
<br> FTP_PUT - FTP put request (ftp proxy)
|
|
|
|
|
|
<br> FTP_LIST - FTP list request (http, ftp proxy)
|
|
|
|
|
|
<br> FTP - any FTP request
|
|
|
|
|
|
<br> ADMIN - administration interface access
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<li><weeksdays> - week days numbers or periods (0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday).
|
|
|
|
|
|
<li><timeperiodlists> - a list of time periods in HH:MM:SS-HH:MM:SS format. For example,
|
|
|
|
|
|
00:00:00-08:00:00,17:00:00-24:00:00 lists non-working hours.
|
|
|
|
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
* in ACL means "any".
|
|
|
|
|
|
Usage examples could be found in 3proxy.cfg.sample.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="REDIR">How to manage redirections</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Redirections are usefull to e.g. forward requests from specific clients
|
|
|
|
|
|
to different servers or proxy server. Additionally, redirections are usefull
|
|
|
|
|
|
to convert proxy interface from ont format to another, e.g. requests from
|
|
|
|
|
|
SOCKS proxy can be redirected to parent HTTP proxy, or SOCKSv5 client can be
|
|
|
|
|
|
redirected to SOCKSv4 proxy.
|
|
|
|
|
|
<br>Because 3proxy understand "transparent" web request, it can be used as an
|
|
|
|
|
|
intermediate software between HTTP proxy and NAT server for transparent HTTP
|
|
|
|
|
|
forwarding, because it can convert "Web server" request issued by client to
|
|
|
|
|
|
"proxy request" required by proxy server. A simplest redirection is:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth iponly
|
|
|
|
|
|
allow *
|
|
|
|
|
|
parent 1000 http 192.168.1.1 3128
|
|
|
|
|
|
proxy
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
All trafiic of HTTP proxy is redirected to parent proxy 192.168.1.1 port 3128.
|
|
|
|
|
|
<br>If port number is '0', IP address from 'parent' is used as external address
|
|
|
|
|
|
for this connection (that is like -eIP, but only for connections matching
|
|
|
|
|
|
'allow').
|
|
|
|
|
|
<br>Special case of redirection are local redirections. In this case both IP is
|
|
|
|
|
|
0.0.0.0 and port is 0. It's only usseful with SOCKS service. In this case no
|
|
|
|
|
|
new connection is established, but request is parsed by corresponding local
|
|
|
|
|
|
service. E.g.:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth iponly
|
|
|
|
|
|
allow * * * 80
|
|
|
|
|
|
parent 1000 http 0.0.0.0 0
|
|
|
|
|
|
allow * * * 21
|
|
|
|
|
|
parent 1000 ftp 0.0.0.0 0
|
|
|
|
|
|
allow * * * 110
|
|
|
|
|
|
parent 1000 pop3 0.0.0.0 0
|
|
|
|
|
|
socks
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
In this case all SOCKS traffic with destination port 80 is forwarded to local
|
|
|
|
|
|
'proxy' service, destination port 21 to 'ftppr' and 110 to 'pop3pr'. There is
|
|
|
|
|
|
no need to run these services expicitly. Local redirections are usefull if
|
|
|
|
|
|
you want to see and control via ACLs protocol specific parameters, e.g.
|
|
|
|
|
|
filenames requests thorugh FTP while clients are using SOCKS.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="ROUNDROBIN">How to balance traffic between few external channgels?</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Proxy itself doesn't manage network level routing. The only way to control
|
|
|
|
|
|
outgoing channel is to select external interface. It's possible to make
|
|
|
|
|
|
external interface (what is usually selected with 'external' command or
|
|
|
|
|
|
'-e' option) random by using local redirection with external port 0.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
auth iponly
|
|
|
|
|
|
allow *
|
|
|
|
|
|
parent 500 http 10.1.1.101 0
|
|
|
|
|
|
parent 500 http 10.2.1.102 0
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Now external interface is randomly selected with 0.5 probability between
|
|
|
|
|
|
10.1.1.101 and 10.2.1.102. To work as expected, different default routes
|
|
|
|
|
|
must between 2 interfaces.
|
|
|
|
|
|
used
|
|
|
|
|
|
<p>
|
|
|
|
|
|
If both interface addresses are in same network, e.g. 10.1.1.101 and 10.1.1.102
|
|
|
|
|
|
and you want to select random gateway between 10.1.1.1 and 10.1.1.2, you must
|
|
|
|
|
|
control it by using routing table, in case there is no default gateway route
|
|
|
|
|
|
for Windows:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
route add -p 10.1.1.1 10.1.1.101
|
|
|
|
|
|
route add -p 10.1.1.2 10.1.1.102
|
|
|
|
|
|
route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.1
|
|
|
|
|
|
route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.2
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
If you have no second address yet, just add it. Under Linux/Unix it's better
|
|
|
|
|
|
to use source routing.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="CHAIN">How to manage proxy chains</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
parent command may also be used to build a proxy chains. In this case
|
|
|
|
|
|
few 'parent' commands are used for single 'allow' rule with different
|
|
|
|
|
|
weights (first argument of parent command). Chain may contain any number
|
|
|
|
|
|
of proxy servers, but it should be noted that every hope significantly
|
|
|
|
|
|
reduces productivity. It's possible to mix different types of proxy within
|
|
|
|
|
|
single chain: HTTPS (HTTP connect), SOCKS4, SOCKS5. Weight different from
|
|
|
|
|
|
1000 is used to build random chains. if weight W is below 1000, this proxy
|
|
|
|
|
|
will be used as a next chain hop with probability of W/1000. That is, if
|
|
|
|
|
|
the weight is 250 probability this proxy will be used for the next hope is
|
|
|
|
|
|
25%. 'parent' records with common weight of 1000 establish a group, one of
|
|
|
|
|
|
these record will be used for the hop with probability according to weight.
|
|
|
|
|
|
Warning: each group must have a weight even of 1000. As follows, common
|
|
|
|
|
|
weight of all 'parent' records must also be even of 1000. If common weight
|
|
|
|
|
|
of 'parent' records in te chain is 3000, chain has 3 hops and must be formed
|
|
|
|
|
|
of 3 groups. Example:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
allow *
|
|
|
|
|
|
parent 500 socks5 192.168.1.1 1080
|
|
|
|
|
|
parent 500 connect 192.168.10.1 3128
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
In this case we have 1 parent proxy (1 hop) which is randomely choosen between
|
|
|
|
|
|
2 hosts: 192.168.1.1 and 192.168.10.1. 2 records form a single group.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
allow * * * 80
|
|
|
|
|
|
parent 1000 socks5 192.168.10.1 1080
|
|
|
|
|
|
parent 1000 connect 192.168.20.1 3128
|
|
|
|
|
|
parent 300 socks4 192.168.30.1 1080
|
|
|
|
|
|
parent 700 socks5 192.168.40.1 1080
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
In this case we have 3 groups (3 hops in the chain). First hop is 192.168.10.1,
|
|
|
|
|
|
second hop is 192.168.20.1 and 3rd one is either 192.168.30.1 with probability
|
|
|
|
|
|
of 30% or 192.168.40.1 with probability of 70%.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
|
|
<li><A NAME="BANDLIM">How to limit bandwidth</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
3proxy supports bandwidth filters. To manage filters bandlimin/bandlimout and
|
|
|
|
|
|
nobandlimin/nobandlimout. 'in' means incoming and 'out' - outgoing traffic.
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
bandlimin <bitrate> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
<br>nobandlimin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
</font>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
Commands are applied to all services. Imagine bandwidth filters as a series of
|
|
|
|
|
|
pipes. Bitrate is a pipe's width and ACLs controls the flow thorugh this pipe.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.16
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.17
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.18
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.19
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Create 4 separete pipes for 4 client with emulation of modem connection.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.16/30
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
Create single pipe for all 4 clients. That is 4 clients share modem connection.
|
|
|
|
|
|
In this example:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
nobandlimin * * * 110
|
|
|
|
|
|
bandlimin 57600 * 192.168.10.16/32
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
mail traffic from POP3 servers bypasses the pipe and has no bandwidth
|
|
|
|
|
|
limitation.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="TRAFLIM">How to limit traffic amount</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<p><font face="courier">
|
|
|
|
|
|
counter <filename> <type> <reportpath>
|
|
|
|
|
|
<br>countin <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
<br>nocountin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
<br>countout <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
<br>nocountout <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
|
|
|
|
|
|
</font>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
You can set traffic limit per day (D), week (W), month (M), year (Y) or
|
|
|
|
|
|
absolute ('N'), as specified by 'type' argument of counterin command.
|
|
|
|
|
|
Traffic information is stored in binary file specified by 'filename' argument.
|
|
|
|
|
|
countersutil utility can be used to manage this file.
|
|
|
|
|
|
reportpath specifies location of text reports, type parameter of 'counter'
|
|
|
|
|
|
command controls how often text reports are created. amount is amount of
|
|
|
|
|
|
allowed traffic in Megabytes (MB). nocountin allows you to set exclusions.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="NETLIST">How to build network lists</A>
|
|
|
|
|
|
<p>Networks or users lists are often very huge. 3proxy doesn't currently
|
|
|
|
|
|
supports user groups, but ones can be created by the means of include files.
|
|
|
|
|
|
You can store comma-delimited lists of networks or users in the separate
|
|
|
|
|
|
file and use $ macro to insert this list into 3proxy.cfg.
|
|
|
|
|
|
3proxy comes with 'dighosts'
|
|
|
|
|
|
utility. This utility helps to grab the list of the network from HTTP page.
|
|
|
|
|
|
It may be usefull to e.g. obtain a regullary updated list of local networks
|
|
|
|
|
|
from ISP's server. A network list can be either in form of NETWORK MASK,
|
|
|
|
|
|
e.g. 192.168.1.0 255.255.255.0 or NETWORK/LENGTH, e.g. 192.168.1.0/24. You can
|
|
|
|
|
|
launch dighosts from 3proxy.cfg to be executed on every 3proxy startup or
|
|
|
|
|
|
configuration reload:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
system "dighosts http://provider/network.html local.networks"
|
|
|
|
|
|
allow * * $local.networks
|
|
|
|
|
|
allow *
|
|
|
|
|
|
parent 1000 proxy.provider 3128 *
|
|
|
|
|
|
proxy
|
|
|
|
|
|
flush
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
In this example we obtain list of local networks from provider's page to
|
|
|
|
|
|
local.networks file, allow direct access to these networks and redirect all
|
|
|
|
|
|
connection to external networks to provider's proxy.
|
|
|
|
|
|
</p>
|
2016-01-15 06:24:08 +08:00
|
|
|
|
<li><a name="NSCACHING"><i>How to configure name resolution and DNS caching</i></a>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
For name resolution and caching use commands nserver, nscache / nscache6 and nsrecord.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
nserver 192.168.1.2
|
|
|
|
|
|
nserver 192.168.1.3:5353/tcp</pre>
|
|
|
|
|
|
sets DNS resolvers. 192.168.1.3 will be used via TCP/5353 (instead of default UDP/53)
|
|
|
|
|
|
only if 192.168.1.2 fails. Up to 5 nservers may be specified.
|
|
|
|
|
|
If no nserver is configured, default system name resolution functions are used.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
nscache 65535
|
|
|
|
|
|
nscache6 65535</pre>
|
|
|
|
|
|
sets name cache size for IPv4 and IPv6. Name cache must be large enouth, if presents.
|
|
|
|
|
|
name cache is only used if nserver is configured.
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
nsrecord server.mycompany.example.com 192.168.1.1
|
|
|
|
|
|
nsrecord www.porno.com 127.0.0.2
|
|
|
|
|
|
...
|
|
|
|
|
|
deny * * 127.0.0.2</pre>
|
|
|
|
|
|
adds static nsrecords. Also, static nsrecords are used for dnspr, unless -s option is specified.
|
|
|
|
|
|
Since 0.8 version, parent proxy may be configured for dnspr.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><a name="IPv6"><i>How to use IPv6</i></a>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
IPv6 is supported since 0.8. Please note, some proxy protolos, e.g. SOCKSv4,
|
|
|
|
|
|
do not support IPv6. SOCKSv5 supports IPv6 with special request type (must be
|
|
|
|
|
|
implemented by client).
|
|
|
|
|
|
<br>
|
|
|
|
|
|
3proxy supports proxying from IPv4 and IPv6 networks to IPv4,
|
|
|
|
|
|
IPv6 and mixed networks. IPv6 address may be used in
|
|
|
|
|
|
internal, external, parent commands, ACLs, -i and -e options,etc.
|
|
|
|
|
|
external command and -e options may be given twice for each service - once with IPv4
|
|
|
|
|
|
and once with IPv6 address. internal can be given only once, to bind to all IPv4 and
|
|
|
|
|
|
IPv6 addresses use [0:0:0:0:0:0:0:0] or [::].
|
|
|
|
|
|
<br>
|
|
|
|
|
|
Any service may be configured with -4, -46, -64, -6 options to specify decied
|
|
|
|
|
|
priority for name to IPv4/IPv6 address resolution (IPv4 only, IPv4 priority,
|
|
|
|
|
|
IPv6 priority, IPv6 only).
|
|
|
|
|
|
</p>
|
2014-04-08 17:03:21 +08:00
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="CLIENT">Client configuration</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="ADMIN">Administering and information analisys</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li><A NAME="NEWVERSION">How to obtain latest 3proxy version</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Latest version of 3proxy may be obtained
|
|
|
|
|
|
<A HREF="http://3proxy.ru/">here</A>.
|
|
|
|
|
|
New version may have changes and incompatibilities with previous one in files
|
|
|
|
|
|
format or commands. Please, read CHANGELOG file and another documentation
|
|
|
|
|
|
before installing new version.
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
If installed as system service, 3proxy understands Windows service commands
|
|
|
|
|
|
for START, STOP, PAUSE and RESUME. If service is PAUSEd, no new connections
|
|
|
|
|
|
are accepted while older connections are processed. Currently there is no
|
|
|
|
|
|
support for dynamic configuration change, so, you have to restart service
|
|
|
|
|
|
completely if you have changed any configuration.
|
|
|
|
|
|
|
|
|
|
|
|
You can control 3proxy service via "Services" administration ot via "net" command:
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
net start 3proxy
|
|
|
|
|
|
net stop 3proxy
|
|
|
|
|
|
net pause 3proxy
|
|
|
|
|
|
net continue 3proxy
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<li><A NAME="ERRORS">Log error codes reference</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
<ul>
|
|
|
|
|
|
<li>0 - Operation successfully complited (connection
|
|
|
|
|
|
was closed by one of peers)
|
|
|
|
|
|
<li>1-9 - AUTHENTICATION ERRORS
|
|
|
|
|
|
<li>1 - Access denied by ACL (deny)
|
|
|
|
|
|
<li>2 - Redirection (should not appear)
|
|
|
|
|
|
<li>3 - No ACL found, denied by default
|
|
|
|
|
|
<li>4 - auth=strong and no username in request
|
|
|
|
|
|
<li>5 - auth=strong and no matching username in configuration
|
|
|
|
|
|
<li>6 - User found, wrong password (cleartext)
|
|
|
|
|
|
<li>7 - User found, wrong password (crypt)
|
|
|
|
|
|
<li>8 - User found, wrong password (NT)
|
|
|
|
|
|
<li>9 - Redirection data not found (should not appear)
|
|
|
|
|
|
<li>10 - Traffic limit exceeded
|
|
|
|
|
|
<li>11-19 - CONNECTION ERRORS
|
|
|
|
|
|
<li>11 - failed to create socket()
|
|
|
|
|
|
<li>12 - failed to bind()
|
|
|
|
|
|
<li>13 - failed to connect()
|
|
|
|
|
|
<li>14 - failed to getpeername()
|
|
|
|
|
|
<li>20-29 - COMMON ERRORS
|
|
|
|
|
|
<li>21 - memory allocation failed
|
|
|
|
|
|
<li>30-39 - CONNECT PROXY REDIRECTION ERRORS
|
|
|
|
|
|
<li>31 - failed to request HTTP CONNECT proxy
|
|
|
|
|
|
<li>32 - CONNECT proxy connection timed out or wrong reply
|
|
|
|
|
|
<li>33 - CONNECT proxy fails to establish connection
|
|
|
|
|
|
<li>34 - CONNECT proxy timed out or closed connection
|
|
|
|
|
|
<li>40-49 - SOCKS4 PROXY REDIRECTION ERRORS
|
|
|
|
|
|
<li>50-69 - SOCKS5 PROXY REDIRECTION ERRORS
|
|
|
|
|
|
<li>70-79 PARENT PROXY CONNECTION ERRORS (identical to 1x)
|
|
|
|
|
|
<li>90-99 - established connection errors
|
|
|
|
|
|
<li>90 - socket error or connection broken
|
|
|
|
|
|
<li>91 - TCP/IP common failure
|
|
|
|
|
|
<li>92 - connection timed out
|
|
|
|
|
|
<li>93 - error on reading data from server
|
|
|
|
|
|
<li>94 - error on reading data from client
|
|
|
|
|
|
<li>95 - timeout from bandlimin/bandlimout limitations
|
|
|
|
|
|
<li>96 - error on sending data to client
|
|
|
|
|
|
<li>97 - error on sending data to server
|
|
|
|
|
|
<li>98 - server data limit (should not appear)
|
|
|
|
|
|
<li>99 - client data limit (should not appear)
|
|
|
|
|
|
<li>100 - HOST NOT FOUND
|
|
|
|
|
|
<li>200-299 - UDP portmapper specific bugs
|
|
|
|
|
|
<li>300-399 - TCP portmapper specific bugs
|
|
|
|
|
|
<li>400-499 - SOCKS proxy specific bugs
|
|
|
|
|
|
<li>500-599 - HTTP proxy specific bugs
|
|
|
|
|
|
<li>600-699 - POP3 proxy specific bugs
|
|
|
|
|
|
<li>999 - NOT IMPLEMENTED
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</p>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
<hr>
|
|
|
|
|
|
<li><A NAME="QUEST">How To ask quiestion not in How To?</A>
|
|
|
|
|
|
<p>
|
|
|
|
|
|
Ask it in <A HREF="http://3proxy.ru/board4.html">3proxy forum</A>.
|
|
|
|
|
|
Don't try to ask something before reading this document.
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
