transparent
+[auto|netfilter|pf|socket]
+Take the destination of a connection, both address and port,
+from the packet filter that redirected it, instead of from
+the request. It applies to services declared after it, and
+notransparent turns it off again for the services
+after that. Built into the binary since 1.0.1, and
+previously the separate TransparentPlugin.
+On Linux the kernel is asked, so iptables or
+nftables redirection is enough. On the BSDs pf is
+asked through /dev/pf, which 3proxy must be able to
+read, so rdr rules work; a redirection that leaves
+the destination on the socket is used where there is one, as
+divert-to on OpenBSD and ipfw fwd on FreeBSD
+do. macOS ships no header for pf and has neither of those,
+so the commands exist in a macOS build but cannot be used.
+
+The mechanism is chosen automatically. The optional argument
+pins it for an installation that has more than one:
+auto is the default, netfilter asks the Linux
+kernel, pf looks the connection up in the packet
+filter, and socket reads the address off the socket.
+A mode the build has no code for is refused rather than
+ignored.
+A connection that reaches a socket mode service
+without having been redirected is refused: its destination
+is the address the service listens on, and using that would
+send the service to itself.
+A redirected connection carries no destination of its own,
+so without this the service uses whatever it would use
+otherwise: the Host header for an HTTP request, or
+the address a port mapper was configured with. tlspr
+receives nothing at all unless traffic is redirected to it
+or the clients resolve names to it, and with a redirection
+it has the address as well as the name from the handshake,
+which is what allows access rules to be written with host
+names. With it, every service reaches the address the client
+was trying to reach, and access rules, parents, limits and
+logging apply to it as usual.
+The redirection rules must not match the connections the
+proxy itself makes to those destinations, or the traffic
+returns to the proxy and loops. Give the service an outgoing
+address with -e and exclude that address in the
+rules, or run 3proxy as its own user and exclude that user.
+See the TRANSPARENT PROXYING section of the
+documentation for rules per platform.
+notransparent
+Stop taking the destination from the packet filter for the
+services declared after it.
flush
empty the active access list. The access list must be