Precaution 1: 3proxy was not initially developed for high load and is positioned as a SOHO product, the main reason is "one connection - one thread" model 3proxy uses. 3proxy is known to work with above 200,000 connections under proper configuration, but use it in production environment under high loads at your own risk and do not expect too much. -
Precaution 2: This documentation is incomplete and is not sufficient. High loads may require very specific system tuning including, but not limited to specific or cusomized kernels, builds, settings, sysctls, options, etc. All this is not covered by this documentation. +
Precaution 1: 3proxy was not initially developed for high load and is positioned as a SOHO product. The main reason is the "one connection - one thread" model 3proxy uses. 3proxy is known to work with over 200,000 connections under proper configuration, but use it in a production environment under high loads at your own risk and do not expect too much. +
Precaution 2: This documentation is incomplete and insufficient. High loads may require very specific system tuning including, but not limited to, specific or customized kernels, builds, settings, sysctls, options, etc. All of this is not covered by this documentation.
maxconn 1000 proxy -p3129 @@ -14,53 +14,53 @@ proxy -p3128 socksmaxconn for every service is 1000, and there are 3 services running -(2 proxy and 1 socks), so, for all services there can be up to 3000 -simulatineous connections to 3proxy. -
Avoid setting 'maxconn' to arbitrary high value, it should be carefully -choosen to protect system and proxy from resources exhaution. Setting maxconn -above resources available can lead to denial of service conditions. -
Avoid setting 'maxconn' to an arbitrarily high value; it should be carefully +chosen to protect the system and proxy from resource exhaustion. Setting maxconn +above available resources can lead to denial of service conditions. +
cat /proc/PID/limits-where PID is a pid of the process. -Validate ulimits match your expectation, especially if you run 3proxy under dedicated account -by adding e.g. +where PID is the process ID. +Validate that ulimits match your expectations, especially if you run 3proxy under a dedicated account +by adding, e.g.:
system "ulimit -Ha >>/tmp/3proxy.ulim.hard" system "ulimit -Sa >>/tmp/3proxy.ulim.soft"-in the beginning (before first service started) and the end of config file. -Make both hard restart (that is kill and start 3proxy process) and soft restart -by sending SIGUSR1 to 3proxy process, check ulimits recorded to files match your -expecation. In systemd based distros (e.g. latest Debian / Ubuntu) changing limits.conf -is not enough, limits must be ajusted in systemd configuration, e.g. by setting +at the beginning (before the first service is started) and at the end of the config file. +Perform both a hard restart (i.e., kill and start the 3proxy process) and a soft restart +by sending SIGUSR1 to the 3proxy process; check that the ulimits recorded to files match your +expectations. In systemd-based distros (e.g., latest Debian/Ubuntu), changing limits.conf +is not enough; limits must be adjusted in the systemd configuration, e.g., by setting:
DefaultLimitDATA=infinity DefaultLimitSTACK=infinity @@ -73,51 +73,51 @@ DefaultLimitMEMLOCK=infinityin user.conf / system.conf -
-To help with socket-based system-dependant settings, since 0.9-devel 3proxy supports different -socket options which can be set via -ol option for listening socket, -oc for proxy-to-client -socket and -os for proxy-to-server socket. Example: +To help with socket-based system-dependent settings, since 0.9-devel, 3proxy supports different +socket options which can be set via the -ol option for the listening socket, -oc for the proxy-to-client +socket, and -os for the proxy-to-server socket. Example:
proxy -olSO_REUSEADDR,SO_REUSEPORT -ocTCP_TIMESTAMPS,TCP_NODELAY -osTCP_NODELAY-available options are system dependant. +Available options are system-dependent. -
+If 3proxy is used in a VPS environment, there can be additional limitations. +For example, kernel resources, system CPU usage, and IOCTLs can be limited differently, and this can become a bottleneck. +Since 0.9-devel, 3proxy uses splice() by default on Linux. splice() prevents network traffic from being copied from +kernel space to the 3proxy process and generally increases throughput, especially in the case of high-volume traffic. This is especially +true for virtual environments (it can improve throughput up to 10 times) unless there are additional kernel limitations. +Since some work is moved to the kernel, it requires up to 2 times more kernel resources in terms of CPU, memory, and IOCTLs. +If your hosting additionally limits kernel resources (you can see this as nearly 100% CPU usage without any real CPU activity for +any application performing IOCTLs), use the -s0 option to disable splice() usage for a given service, e.g.: +for Linux or Cygwin, Makefile.Solaris* (depending on compiler version) for Solaris -and Makefile.unix for different Unix-like OS. On BSD derivered systems make -sure to use GNU make, sometimes it's called gmake instead of make. -socks -s0-Extending ephemeral port range
+Extending the Ephemeral Port Range
-Check ephemeral port range for your system and extend it to the number of the +Check the ephemeral port range for your system and extend it to the number of ports required. -Ephimeral range is always limited to maximum number of ports (64K). To extend the -number of outgoing connections above this limit, extending ephemeral port range -is not enough, you need additional actions: +The ephemeral range is always limited to the maximum number of ports (64K). To extend the +number of outgoing connections above this limit, extending the ephemeral port range +is not enough; you need additional actions:-
- Configure multiple outgoing IPs -
- Make sure 3proxy is configured to use different outgoing IP by either setting -external IP via RADIUS +
- Make sure 3proxy is configured to use a different outgoing IP by either setting +the external IP via RADIUS:
radius secret 1.2.3.4 auth radius proxyor by using multiple services with different external -interfaces, example: +interfaces, for example:allow user1,user11,user111 proxy -p1111 -e1.1.1.1 @@ -133,7 +133,7 @@ proxy -p4444 -e4.4.4.4 flushor via "parent extip" rotation, -e.g. +e.g.:allow user1,user11,user111 parent 1000 extip 1.1.1.1 0 @@ -156,8 +156,8 @@ socks-Under latest Linux version you can also start multiple services with different -external addresses on the single port with SO_REUSEPORT on listening socket to +Under the latest Linux versions, you can also start multiple services with different +external addresses on a single port with SO_REUSEPORT on the listening socket to evenly distribute incoming connections between outgoing interfaces:socks -olSO_REUSEPORT -p3128 -e 1.1.1.1 @@ -165,136 +165,136 @@ socks -olSO_REUSEPORT -p3128 -e 2.2.2.2 socks -olSO_REUSEPORT -p3128 -e 3.3.3.3 socks -olSO_REUSEPORT -p3128 -e 4.4.4.4-for Web browsing last two examples are not recommended, because same client can get -different external address for different requests, you should choose external +For web browsing, the last two examples are not recommended because the same client can get +a different external address for different requests; you should choose the external interface with user-based rules instead. -- You may need additional system dependant actions to use same port on different IPs, -usually by adding SO_REUSEADDR (SO_PORT_SCALABILITY for Windows) socket option to -external socket. This option can be set (since 0.9 devel) with -os option: +
- You may need additional system-dependent actions to use the same port on different IPs, +usually by adding the SO_REUSEADDR (SO_PORT_SCALABILITY for Windows) socket option to +the external socket. This option can be set (since 0.9-devel) with the -os option:
proxy -p3128 -e1.2.3.4 -osSO_REUSEADDR-Behavior for SO_REUSEADDR and SO_REUSEPORT is different between different system, -even between different kernel versions and can lead to unexpected results. -Specifics is described here. -Use this options only if actually required and if you fully understand possible -consiquences. E.g. SO_REUSEPORT can help to establish more connections than the -number of the client port available, but it can also lead to situation connections -are randomely fail due to ip+port pairs collision if remote or local system +The behavior for SO_REUSEADDR and SO_REUSEPORT is different between different systems, +even between different kernel versions, and can lead to unexpected results. +The specifics are described here. +Use these options only if actually required and if you fully understand the possible +consequences. For example, SO_REUSEPORT can help establish more connections than the +number of client ports available, but it can also lead to situations where connections +randomly fail due to IP+port pair collisions if the remote or local system doesn't support this trick.Setting stacksize
+Setting Stack Size
'stacksize' is a size added to all stack allocations and can be both positive and -negative. Stack is required in functions call. 3proxy itself doesn't require large +negative. Stack is required for function calls. 3proxy itself doesn't require a large stack, but it can be required if some -purely-written libc, 3rd party libraries or system functions called. There is known\ +poorly written libc, 3rd party libraries, or system functions are called. There is known dirty code in Unix ODBC -implementations, build-in DNS resolvers, especially in the case of IPv6 and large -number of interfaces. Under most 64-bit system extending stacksize will lead -to additional memory space usage, but do not require actual commited memory, -so you can inrease stacksize to relatively large value (e.g. 1024000) without -the need to add additional phisical memory, -but it's system/libc dependant and requires additional testing under your -installation. Don't forget about memory related ulimts. -For 32-bit systems address space can be a bottlneck you should consider. If -you're short of address space you can try to use negative stack size. +implementations and built-in DNS resolvers, especially in the case of IPv6 and a large +number of interfaces. Under most 64-bit systems, extending stacksize will lead +to additional memory space usage but does not require actual committed memory, +so you can increase stacksize to a relatively large value (e.g., 1024000) without +the need to add additional physical memory, +but it's system/libc dependent and requires additional testing under your +installation. Don't forget about memory-related ulimits. +
For 32-bit systems, address space can be a bottleneck you should consider. If +you're short on address space, you can try using a negative stack size. -
Known system issues
+Known System Issues
-There are known race condition issues in Linux / glibc resolver. The probability -of race condition arises under configuration with IPv6, large number of interfaces -or IP addresses or resolvers configured. In this case, install local recursor and -use 3proxy built-in resolver (nserver / nscache / nscache6). -Do not use public resolvers
-Public resolvers like ones from Google have ratelimits. For large number of -requests install local caching recursor (ISC bind named, PowerDNS recursor, etc). +There are known race condition issues in the Linux/glibc resolver. The probability +of a race condition arises under configuration with IPv6, a large number of interfaces +or IP addresses, or with resolvers configured. In this case, install a local recursor and +use 3proxy's built-in resolver (nserver / nscache / nscache6). +Do Not Use Public Resolvers
+Public resolvers like those from Google have rate limits. For a large number of +requests, install a local caching recursor (ISC bind named, PowerDNS recursor, etc). -Avoid large lists
+Avoid Large Lists
Currently, 3proxy is not optimized to use large ACLs, user lists, etc. All lists -are processed lineary. In devel version you can use RADIUS authentication to avoid -user lists and ACLs in 3proxy itself. Also, RADIUS allows to easily set outgoing IP -on per-user basis or more sophisicated logics. -RADIUS is a new beta feature, test it before using in production. +are processed linearly. In the devel version, you can use RADIUS authentication to avoid +user lists and ACLs in 3proxy itself. Also, RADIUS allows you to easily set an outgoing IP +on a per-user basis or implement more sophisticated logic. +RADIUS is a new beta feature; test it before using it in production. -Avoid changing configuration too often
+Avoid Changing Configuration Too Often
-Every configuration reload requires additional resources. Do not do frequent -changes, like users addition/deletaion via connfiguration, use alternative +Every configuration reload requires additional resources. Do not make frequent +changes, such as user addition/deletion via configuration; use alternative authentication methods instead, like RADIUS. -Consider using 'noforce'
+Consider Using 'noforce'
-'force' behaviour (default) re-authenticates all connections after -configuration reload, it may be resource consuming on large number of -connections. Consider adding 'noforce' command before services started -to prevent connections reauthentication. +The 'force' behavior (default) re-authenticates all connections after +configuration reload; it may be resource-consuming with a large number of +connections. Consider adding the 'noforce' command before services are started +to prevent connection re-authentication. -Do not monitor configuration files directly
+Do Not Monitor Configuration Files Directly
-Using configuration file directly in 'monitor' can lead to race condition where -configuration is reloaded while file is being written. +Using a configuration file directly in 'monitor' can lead to a race condition where +the configuration is reloaded while the file is being written. To avoid race conditions:-
- Update config files only if there is no lock file -
- Create lock file then 3proxy configuration is updated, e.g. with +
- Create a lock file when the 3proxy configuration is updated, e.g., with "touch /some/path/3proxy/3proxy.lck". If you generate config files -asynchronously, e.g. by user's request via web, you should consider -implementing existance checking and file creation as atomic operation. -
- add +asynchronously, e.g., by a user's request via web, you should consider +implementing existence checking and file creation as an atomic operation. +
- Add
system "rm /some/path/3proxy/3proxy.lck"-at the end of config file to remove it after configuration is successfully loaded -- Use a dedicated version file to monitor, e.g. +at the end of the config file to remove it after the configuration is successfully loaded +
- Use a dedicated version file to monitor, e.g.:
monitor "/some/path/3proxy/3proxy.ver"-- After config is updated, change version file for 3proxy to reload configuration, -e.g. with "touch /some/path/3proxy/3proxy.ver". +
- After the config is updated, change the version file for 3proxy to reload the configuration, +e.g., with "touch /some/path/3proxy/3proxy.ver".
Use TCP_NODELAY to speed-up connections with small amount of data
+Use TCP_NODELAY to Speed Up Connections with Small Amounts of Data
-If most requests require exchange with a small amount of data in a both ways -without the need for bandwidth, e.g. messengers or small web request, -you can eliminate Nagle's algorithm delay with TCP_NODELAY flag. Usage example: +If most requests require an exchange with a small amount of data in both directions +without the need for bandwidth, e.g., messengers or small web requests, +you can eliminate Nagle's algorithm delay with the TCP_NODELAY flag. Usage example:proxy -osTCP_NODELAY -ocTCP_NODELAYsets TCP_NODELAY for client (oc) and server (os) connections. -Do not use TCP_NODELAY on slow connections with high delays and then +
Do not use TCP_NODELAY on slow connections with high delays when connection bandwidth is a bottleneck. -
Use splice to speedup large data amount transfers
+Use Splice to Speed Up Large Data Amount Transfers
-splice() allows to copy data between connections without copying to process -addres space. It can speedup proxy on high bandwidth connections, if most +splice() allows copying data between connections without copying to the process +address space. It can speed up the proxy on high-bandwidth connections if most connections require large data transfers. Splice is enabled by default on Linux -since 0.9, "-s0" disables splice usage. Example: +since 0.9; "-s0" disables splice usage. Example:proxy -s0-Splice is only available on Linux. Splice requires more system buffers and file descriptors, +Splice is only available on Linux. Splice requires more system buffers and file descriptors and produces more IOCTLs but reduces process memory and overall CPU usage. -Disable splice if there is a lot of short-living connections with no bandwidth +Disable splice if there are a lot of short-lived connections with no bandwidth requirements. -Use splice only on high-speed connections (e.g. 10GBE), if processor, memory speed or +
Use splice only on high-speed connections (e.g., 10GbE) when the processor, memory speed, or system bus are bottlenecks. -
TCP_NODELAY and splice are not contrary to each over and should be combined on +
TCP_NODELAY and splice are not contrary to each other and should be combined on high-speed connections. -
Add grace delay to reduce system calls
+
Add Grace Delay to Reduce System Calls
proxy -g8000,3,10-First parameter is average read size we want to keep, second parameter is -minimal number of packets in the same direction to apply algorythm, -last value is delay added after polling and prior to reading data. -An example above adds 10 millisecond delay before reading data if average -polling size is below 8000 bytes and 3 read operations are made in the same -direction. It's specially usefule with splice.logdump 1 1is useful -to see how grace delays work, choose delay value to avoid filling the read -pipe/buffer (typically 64K) but keep the request sizes close to chosen average -on large file upload/download. +The first parameter is the average read size we want to keep, the second parameter is +the minimal number of packets in the same direction to apply the algorithm, +and the last value is the delay added after polling and prior to reading data. +The example above adds a 10-millisecond delay before reading data if the average +polling size is below 8000 bytes and 3 read operations have been made in the same +direction. It's especially useful with splice.logdump 1 1is useful +to see how grace delays work; choose a delay value to avoid filling the read +pipe/buffer (typically 64K) but keep the request sizes close to the chosen average +on large file uploads/downloads. diff --git a/doc/html/howtoe.html b/doc/html/howtoe.html index 5921ccf..6cd0969 100644 --- a/doc/html/howtoe.html +++ b/doc/html/howtoe.html @@ -1,5 +1,5 @@-
- 3APA3A 3proxy tiny proxy server HowTo +
- 3APA3A 3proxy Tiny Proxy Server HowTo
Under construction, very incomplete
- Compilation @@ -18,27 +18,27 @@
- Server configuration
- How to make 3proxy start
-- How to make limitation (access, bandwidth, traffic, connections) work
-- How to make 3proxy to run as a service
+- How to make limitations (access, bandwidth, traffic, connections) work
+- How to make 3proxy run as a service
- How to understand internal and external
- How to make ODBC logging work?
- How to make IPv6 work
- How to fix 3proxy crashes
-- Where to find configuration example +
- Where to find a configuration example
- How to set up logging -
- How to setup logging format -
- How to use log analizers with 3proxy -
- How to start any of proxy services (HTTP, SOCKS etc) -
- How to bind service to specific interface or port +
- How to set up logging format +
- How to use log analyzers with 3proxy +
- How to start any of the proxy services (HTTP, SOCKS, etc.) +
- How to bind a service to a specific interface or port
- How to resolve names through a parent proxy
-- How to setup FTP proxy
-- How to setup SNI proxy (tlspr)
+- How to set up an FTP proxy
+- How to set up an SNI proxy (tlspr)
- How to limit service access -
- How to create user list +
- How to create a user list
- How to limit user access to resources
- How to manage redirections
- How to manage local redirections -
- How to balance traffic between few external channgels? +
- How to balance traffic between multiple external channels?
- How to manage proxy chains
- How to limit bandwidth
- How to limit traffic amount @@ -49,13 +49,13 @@
- How to use connect back
- Client configuration -
- Administering and information analisys +
- Administering and information analysis -
- How To ask quiestion not in How To? +
- How to ask a question not in How To?
@@ -87,14 +87,14 @@ Use make -f Makefile.Linux
Unpack 3proxy.zip to any directory, for example -c:\Program Files\3proxy. If needed, create directory for storing log files, -ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See Server configuration). -If you use 3proxy before 0.6 Add +c:\Program Files\3proxy. If needed, create a directory for storing log files, +ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see Server configuration). +If you use 3proxy before version 0.6, add the
service-string into 3proxy.cfg. Now, start command prompt (cmd.exe). -Change directory to 3proxy installation and run 3proxy.exe --install: +string into 3proxy.cfg. Now, start a command prompt (cmd.exe). +Change to the 3proxy installation directory and run 3proxy.exe --install:
D:\>C: C:\>cd C:\Program Files\3proxy C:\Program Files\3proxy>3proxy.exe --install-Now, you should have 3proxy service installed and running. If service is not -started, remove "service" string from 3proxy.cfg, run 3proxy.exe manually +Now, you should have the 3proxy service installed and running. If the service is not +started, remove the "service" string from 3proxy.cfg, run 3proxy.exe manually and correct all errors.
-To remove 3proxy run 3proxy --remove: +To remove 3proxy, run 3proxy --remove:
D:\>C: C:\>cd C:\Program Files\3proxy C:\Program Files\3proxy>net stop 3proxy C:\Program Files\3proxy>3proxy.exe --remove-Now you can simply remove 3proxy installation directory. +Now you can simply remove the 3proxy installation directory.
Unpack 3proxy.zip to any directory, for example -c:\Program Files\3proxy. If needed, create directory for storing log files, -ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See Server configuration). -Remove string +c:\Program Files\3proxy. If needed, create a directory for storing log files, +ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see Server configuration). +Remove the string
service@@ -143,26 +143,26 @@ from 3proxy.cfg and add
daemon-if you want 3proxy to run in background. -Create shortcut for 3proxy.exe and place it in autostart or add -to registry with regedit.exe: +if you want 3proxy to run in the background. +Create a shortcut for 3proxy.exe and place it in the autostart folder or add +it to the registry with regedit.exe:
-Complie 3proxy (see Compilation). Copy -executables to any appropriate location (for example /usr/local/3proxy/sbin +Compile 3proxy (see Compilation). Copy +executables to any appropriate location (for example, /usr/local/3proxy/sbin for servers and /usr/local/3proxy/bin for utilities). -Create /usr/local/etc/3proxy.cfg. +Create /usr/local/etc/3proxy.cfg. (see Server configuration). -You can change default configuration file location by specifing configuration file -in 3proxy command line. -Add 3proxy to system startup scripts. +You can change the default configuration file location by specifying the configuration file +in the 3proxy command line. +Add 3proxy to the system startup scripts.
Valid configuration file is required. +
A valid configuration file is required. -
Most probable reasons for non-working limitations: 'auth none' or no auth is used. For any ACL based feature one of 'iponly', 'nbname' or 'strong' auths required. Sequence of commands may be invalid. Commands are executed one-by-one and 'proxy', 'tcppm', 'socks' or another service commands must follow valid configuration. Invalid sequence of ACLs. First matching ACL is used (except of internal redirections, see below). If ACL contains at least one records last record is assumed to be 'deny *'. +
The most probable reasons for non-working limitations: 'auth none' or no auth is used. For any ACL-based feature, one of 'iponly', 'nbname', or 'strong' auth is required. The sequence of commands may be invalid. Commands are executed one-by-one, and 'proxy', 'tcppm', 'socks', or another service commands must follow a valid configuration. An invalid sequence of ACLs. The first matching ACL is used (except for internal redirections, see below). If an ACL contains at least one record, the last record is assumed to be 'deny *'. -
Possible reasons for 3proxy starts manually but fails to start as a service: +
Possible reasons for 3proxy starting manually but failing to start as a service:
3proxy --install full_path_to_configuration_file-
How to understant internal and external +
How to understand internal and external
Both internal and external IPs are IPs of the host running 3proxy itself. -This configuration option is usefull in situation 3proxy is running on the -border host with 2 (or more) connections: e.g. LAN and WAN with different IPs +This configuration option is useful in situations where 3proxy is running on a +border host with 2 (or more) connections: e.g., LAN and WAN with different IPs
LAN connection +-------------+ Internet connection
LAN <-------------->| 3proxy host |<-------------------> INTERNET
@@ -207,60 +207,60 @@ LAN <-------------->| 3proxy host |<-------------------> INTERNET
| |
Internal IP External IP
-If 3proxy is used on the host with single connection, both internal and
-external are usually same IP.
--Check you use system DSN. -Check SQL request is valid. -The best way to check is to make file or stdout logging, get SQL request from log file or console and execute this request manually. -Under Unix, you may also want to adjust 'stacksize' parameter. +Check that you are using a system DSN. +Check that the SQL request is valid. +The best way to check is to use file or stdout logging, get the SQL request from the log file or console, and execute this request manually. +Under Unix, you may also want to adjust the 'stacksize' parameter.
Proxy can not access destination directly over IPv6 if client requests IPv4 address. -To access IPv6 destination, either IPv6 address or hostname must be used in request. -Best solution is to enable option to resolve hostnames via proxy on client side. +
The proxy cannot access a destination directly over IPv6 if the client requests an IPv4 address. +To access an IPv6 destination, either an IPv6 address or a hostname must be used in the request. +The best solution is to enable the option to resolve hostnames via the proxy on the client side.
default stacksize may be insufficient, if some non-default plugins - are used (e.g. PAM and ODBC on Linux) or if compiled on some platforms with - invalid system defined values (few versionds of FreeBSD on amd64). - Problem can be resolved with 'stacksize' command or '-S' option starting 3proxy 0.8.4. +
The default stacksize may be insufficient if some non-default plugins + are used (e.g., PAM and ODBC on Linux) or if compiled on some platforms with + invalid system-defined values (a few versions of FreeBSD on amd64). + The problem can be resolved with the 'stacksize' command or '-S' option starting with 3proxy 0.8.4. -
-Server configuration example 3proxy.cfg.sample is in any 3proxy distribution. +A server configuration example, 3proxy.cfg.sample, is included in every 3proxy distribution.
-3proxy can log to stdout, file, ODBC datasource and -syslog (Unix/Linux/Cygwin only). For using ODBC under Unix/Linux you must -compile 3proxy with Unix ODBC libraries, see Compilation. -You can control logging from 3proxy.cfg for all services or you can control -logging of individual service, for example -/usr/local/sbin/socks -l/var/log/socks.log starts SOCKS proxy with logging to file. -For universal proxy (3proxy) log file rotation and archiving is supported. -Log type is defined with "log" configuration file command or with --l switch on individual service invokation. log or -l is stdout logging. +3proxy can log to stdout, a file, an ODBC datasource, or +syslog (Unix/Linux/Cygwin only). To use ODBC under Unix/Linux, you must +compile 3proxy with Unix ODBC libraries; see Compilation. +You can control logging from 3proxy.cfg for all services, or you can control +logging for an individual service. For example, +/usr/local/sbin/socks -l/var/log/socks.log starts a SOCKS proxy with logging to a file. +For the universal proxy (3proxy), log file rotation and archiving are supported. +The log type is defined with the "log" configuration file command or with the +-l switch on individual service invocation. log or -l with no argument is stdout logging.
log filename@@ -268,7 +268,7 @@ and
-lfilename-specify filename for logging +specify a filename for logging.
log @ident@@ -276,28 +276,28 @@ and
-l@ident-specify ident for syslog logging. If filename within "log" command contains -'%' characters, it's processes as format specificator (see "logformat"). E.g. -log c:\3proxy\logs\%y%m%d.log D creates file like c:\3proxy\logs\060729.log, -date is generated based on local time. +specify an ident for syslog logging. If the filename within the "log" command contains +'%' characters, it is processed as a format specifier (see "logformat"). E.g., +log c:\3proxy\logs\%y%m%d.log D creates a file like c:\3proxy\logs\060729.log; +the date is generated based on local time.
log &connstring-specifies ODBC connection string, connstring is in format -datasource,username,password (2 last are optional of -datasource does not require or already has authentication information). -Also, you must specify logformat to build SQL query, to insert recod into -log, see How to setup logging format +specifies an ODBC connection string; connstring is in the format +datasource,username,password (the last two are optional if the +datasource does not require or already has authentication information). +Also, you must specify logformat to build the SQL query to insert a record into +the log; see How to set up logging format
-Rotation and archiving may be set up with log, rotate archiver commands +Rotation and archiving may be set up with log, rotate, and archiver commands.
log filename LOGTYPE-sets rotation type. LOGTYPE may be: +sets the rotation type. LOGTYPE may be:
rotate NUMBER- specifies number of files in rotation (that is how many files to keep). + specifies the number of files in rotation (i.e., how many files to keep).
archiver EXT COMMAND PARAMETERS- Sets external archiver. EXT is extention of archived files - (for example zip, gz, Z, rar etc) COMMAND and PARAMETERS are command - to execute and command line PARAMETERS. Originale file is not deleted by - 3proxy, this work is left for archiver. - You can pass original filename to archiver with %F macro and archive filename with %A. + Sets an external archiver. EXT is the extension of archived files + (for example, zip, gz, Z, rar, etc.). COMMAND and PARAMETERS are the command + to execute and its command-line parameters. The original file is not deleted by + 3proxy; this work is left for the archiver. + You can pass the original filename to the archiver with the %F macro and the archive filename with %A. Examples are located in 3proxy.cfg.sample -
- Since 0.3 version log format may be set with "logformat" command. - First symbol of log format specifies format of date and time and - should be L (LOCAL) or G (GMT - Grinwitch Meridian Time). Format - string may contains some macro substitutions: + Since version 0.3, the log format may be set with the "logformat" command. + The first symbol of the log format specifies the format of the date and time and + should be L (LOCAL) or G (GMT - Greenwich Meridian Time). The format + string may contain some macro substitutions:
@@ -367,23 +367,23 @@ logformat "L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"
(no line breaks)- If ODBC used, logformat should specify SQL command, - to insert record into log, for example + If ODBC is used, logformat should specify the SQL command + to insert a record into the log, for example:
logformat "-\'+_GINSERT INTO proxystat VALUES (%t, '%c', '%U', %I)"
(no line breaks)
-\'+_ instructs to replace characters \ and ' with _ -
-Just make format of 3proxy logs compatible with format supported by your
-favourite log analizer. Examples of compatible logformats are:
+Just make the format of 3proxy logs compatible with a format supported by your
+favorite log analyzer. Examples of compatible logformats are:
For Squid access.log:
"- +_G%t.%. %D %C TCP_MISS/200 %I %1-1T %2-2T %U DIRECT/%R application/unknown"
-or, more compatible format without %D +or, a more compatible format without %D:"- +_G%t.%. 1 %C TCP_MISS/200 %I %1-1T %2-2T %U DIRECT/%R application/unknown" @@ -413,30 +413,30 @@ HTTPD standard log (Apache and others):"-""+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] ""%T"" %E %I"
-or more compatible without error code +or a more compatible format without the error code:"-""+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] ""%T"" 200 %I"
-
3proxy is distributed in 2 variants: as a set of standalone modules (proxy,
-socks, pop3p, tcppm, udppm) and as universal proxy server. These services are
-absolutely independant, and if you use 3proxy you needn't any of standalone
+socks, pop3p, tcppm, udppm) and as a universal proxy server. These services are
+absolutely independent, and if you use 3proxy, you don't need any of the standalone
modules.
-
Standalone modules are only configurable via command line interface while
-3proxy uses configuration file. Many functions, such as ODBC logging, log
-rotation, access control, etc are only available in 3proxy, not in standalone
+
Standalone modules are only configurable via the command line interface, while
+3proxy uses a configuration file. Many functions, such as ODBC logging, log
+rotation, access control, etc., are only available in 3proxy, not in standalone
proxies.
-Standalone module may be started from command line, for example:
+A standalone module may be started from the command line, for example:
$/sbin/socks -l/var/log/socks.log -i127.0.0.1-Starts SOCKS server binded to localhost ip, port 1080 with logging to +Starts a SOCKS server bound to localhost IP, port 1080, with logging to /var/log/socks.log. -You can get help for any standalone service with -? command line option. +You can get help for any standalone service with the -? command line option.
-If 3proxy is used you should start all services in 3proxy.cfg file. 3proxy.cfg -is executed by 3proxy as a batch file. Example of 3proxy.cfg and command syntaxys +If 3proxy is used, you should start all services in the 3proxy.cfg file. 3proxy.cfg +is executed by 3proxy as a batch file. An example of 3proxy.cfg and command syntax can be found in 3proxy.cfg.sample.
@@ -446,19 +446,19 @@ internal 127.0.0.1 external 192.168.1.1 proxy socks -p3129 -pop3p +pop3p-Starts 3 services: HTTP PROXY, SOCKS and POP3 PROXY. Each listens localhost -interface with default port (3128 for HTTP, 1080 for SOCKS and 110 for POP3P) -except socks started with port 3129. -All logs are in file /var/log/3proxy.log (with daily date modification and -rotation). 30 last files are stored. +Starts 3 services: HTTP PROXY, SOCKS, and POP3 PROXY. Each listens on the localhost +interface with the default port (3128 for HTTP, 1080 for SOCKS, and 110 for POP3P) +except socks, which is started with port 3129. +All logs are in the file /var/log/3proxy.log (with daily date modification and +rotation). The 30 most recent files are stored. -
--i options specifies internal interface, -p - listening port. No space are -allowed. To bind 'proxy' service to port 8080 on interfaces 192.168.1.1 -and 192.168.2.1 use +The -i option specifies the internal interface; -p specifies the listening port. No spaces are +allowed. To bind the 'proxy' service to port 8080 on interfaces 192.168.1.1 +and 192.168.2.1, use:
proxy -p8080 -i192.168.1.1 proxy -p8080 -i192.168.2.1 @@ -466,41 +466,41 @@ proxy -p8080 -i192.168.2.1
- A: Use one of proxy, connect+, socks4+ or socks5+ as a parent type. 3proxy - itself still performs a name resolution, it's required e.g. to ACLs matching. - So, if no name resolution must be performed by 3proxy itself add a command + A: Use one of proxy, connect+, socks4+, or socks5+ as the parent type. 3proxy + itself still performs name resolution; it's required, e.g., for ACL matching. + So, if no name resolution must be performed by 3proxy itself, add the command
fakeresolve- this command resolves any name to 127.0.0.2 address. + This command resolves any name to the 127.0.0.2 address. -
- There is FTP over HTTP (what is called FTP proxy in browsers) and FTP over FTP ப - (what is called FTP proxy in file managers and FTP clients). For browsers, there is no need to start additional - proxy service, 'proxy' supports FTP over HTTP, configure 'proxy' port as an FTP proxy. For ftp clients and file - managers use ftppr. FTP proxy supports both active and passive mode with client, but always use passive mode with FTP servers. + There is FTP over HTTP (what is called FTP proxy in browsers) and FTP over FTP + (what is called FTP proxy in file managers and FTP clients). For browsers, there is no need to start an additional + proxy service; 'proxy' supports FTP over HTTP. Configure the 'proxy' port as an FTP proxy. For FTP clients and file + managers, use ftppr. The FTP proxy supports both active and passive mode with the client but always uses passive mode with FTP servers.
-- SNI proxy can be used to transparently redirect any TLS traffic with external router or local redirection rules. It can also be used - to extract hostnames from TLS to use in ACLs in combination with SOCKS or HTTP(s) proxy and/or Transparent plugin. It can also be used to require TLS or mTLS between services. TLS hadshake contains no - port information, if tlspr is used as a standalone service, destination port may be either detected with Transparent plugin or configured with -P option (default 443). -
- -c option is used to specify level of TLS check: + An SNI proxy can be used to transparently redirect any TLS traffic with an external router or via local redirection rules. It can also be used + to extract hostnames from TLS to use in ACLs in combination with SOCKS or HTTP(s) proxy and/or the Transparent plugin. It can also be used to require TLS or mTLS between services. The TLS handshake contains no + port information; if tlspr is used as a standalone service, the destination port may be either detected with the Transparent plugin or configured with the -P option (default 443). +
+ The -c option is used to specify the level of TLS check:
0 (default) - allow non-TLS traffic 1 - require TLS, only check client HELLO packet 2 - require TLS, check both client and server HELLO -3 - require TLS, check server send certificate (not compatible with TLS 1.3) -4 - require mutual TLS, check server send certificate request and client sends certificate (not compatible with TLS 1.3) +3 - require TLS, check that the server sends a certificate (not compatible with TLS 1.3) +4 - require mutual TLS, check that the server sends a certificate request and the client sends a certificate (not compatible with TLS 1.3)
-configuration examples: -1. port 1443 may be used to redirect traffic to destination port 143). SNI is used to find destination host +Configuration examples: +1. Port 1443 may be used to redirect traffic to destination port 143. SNI is used to find the destination host.
tlspr -p1443 -P443 -c1-2. used as parent tls to detect destination hostname from TLS in socks +2. Used as a parent TLS proxy to detect the destination hostname from TLS in socks:
allow * * * 80 parent 1000 http 0.0.0.0 0 @@ -513,36 +513,36 @@ socks
-First, always specify internal interface to accept incoming connection with +First, always specify the internal interface to accept incoming connections with the 'internal' configuration command or '-i' service command. (See -How to start any of proxy services (HTTP, SOCKS etc)). If -no internal interface is specified your proxy will act as open one. -
It's also important to specify external interface to prevent access to +How to start any of the proxy services (HTTP, SOCKS, etc.)). If +no internal interface is specified, your proxy will act as an open proxy. +
It's also important to specify the external interface to prevent access to the internal network with 'external' or -e. -
3proxy with configuration files allows to use authentication and -authorization for user's access. Authentication is possible by -username/password or user's NetBIOS name. Authentication type is specified by -'auth' command. +
3proxy with configuration files allows you to use authentication and +authorization for user access. Authentication is possible by +username/password or the user's NetBIOS name. The authentication type is specified by the +'auth' command.
auth none-Disables both authentication and authorization. You can not use ACLs. +Disables both authentication and authorization. You cannot use ACLs.
auth iponly-Specifies no authentication, ACLs authorization is used. +Specifies no authentication; ACL-based authorization is used.
auth nbname-Authentication by NetBIOS name + ACLs. NetBIOS name of 'messenger' service -is obrained before ACL validation. If no name is obtained it's assumed to be -empty. Messenger is started by default in Windows NT/2000/XP. For Win9x -WinPopUP need to be launched. This type of authentication may be spoofed -by privileged local user. +Authentication by NetBIOS name + ACLs. The NetBIOS name of the 'messenger' service +is obtained before ACL validation. If no name is obtained, it's assumed to be +empty. Messenger is started by default in Windows NT/2000/XP. For Win9x, +WinPopUP needs to be launched. This type of authentication may be spoofed +by a privileged local user.
auth strong-Authentication by username/password. If user is not registered his +Authentication by username/password. If the user is not registered, their access is denied regardless of ACLs.
Different services can have different authentication levels. @@ -556,30 +556,30 @@ socks It's possible to authorize access by client IP address, IP address or requested resource, -target port, time, etc after authentication. +target port, time, etc., after authentication. (See How to limit resource access). -
Since 0.6 version double authentication is possible, e.g. +
Since version 0.6, double authentication is possible, e.g.:
auth iponly strong allow * * 192.168.0.0/16 allow user1,user2 proxy-strong authentication will only be used if ACL requires username to deside if -access must be granted. That is, in example, strong username authentication -is not required to access 192.168.0.0/16 -
0.6 version introduces authentication (username) caching to increase -productivity. It's recommended to use authentication caching with resource -or time consuming authentication types, such as nbname or external plugins +Strong authentication will only be used if the ACL requires a username to decide if +access must be granted. That is, in the example, strong username authentication +is not required to access 192.168.0.0/16. +
Version 0.6 introduces authentication (username) caching to increase +performance. It's recommended to use authentication caching with resource- +or time-consuming authentication types, such as nbname or external plugins (WindowsAuthentication). -Caching can be set with 'authcache' command with 2 parameters: caching type -and caching time (in seconds). Caching type defines the type of cached access: -'ip' - after successful authentication all connections during caching time -from same IP are assigned to the same user, username is not requested. -"ip,user" - username is requested and all connections from the same IP are +Caching can be set with the 'authcache' command with 2 parameters: caching type +and caching time (in seconds). The caching type defines the type of cached access: +'ip' - after successful authentication, all connections during the caching time +from the same IP are assigned to the same user; the username is not requested. +"ip,user" - the username is requested, and all connections from the same IP are assigned to the same user without actual authentication. "user" - same as above, but IP is not checked. "user,password" - username and password are checked -against cached ones. For authentication special authentication type 'cache' +against cached ones. For authentication, the special authentication type 'cache' must be used. Example:
@@ -588,42 +588,42 @@ auth cache strong windows proxy -n-Please note, that caching affects security. Never use caching for access to +Please note that caching affects security. Never use caching for access to critical resources, such as web administration. -
authcache can be used to bind user's sessions to ip with 'limit' option, with +
authcache can be used to bind a user's sessions to an IP with the 'limit' option. With
- autchcache ip,user,pass,limit 120 + authcache ip,user,pass,limit 120 auth cache strong- user will not be able to use more than a single IP during cache time (120 sec). + the user will not be able to use more than a single IP during the cache time (120 sec). -
-Userslist is created with 'users' command. +The user list is created with the 'users' command.
users USERDESC ...-With a single command it's possible to define few users, or you -can use few 'users' commands. USERDESC is user description. Description -consists of three semicolon delimited parts - login, password type and +With a single command, it's possible to define a few users, or you +can use multiple 'users' commands. USERDESC is a user description. The description +consists of three semicolon-delimited parts - login, password type, and
users admin:CL:bigsecret test:CL:password test1:CL:password1 users "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49." users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63-Please note the usage of quotation sign: it's required to comment out $ sign -overwise used as a file inclusion macro. -Next password types are available: +Please note the usage of quotation marks: they're required to escape the $ sign, +which is otherwise used as a file inclusion macro. +The following password types are available:
users $/etc/.3proxypasswd@@ -631,48 +631,48 @@ or
users $"c:\Program Files\3proxy\passwords"-It's possible to create NT and crypt passwords with mycrypt utility included -in distribution. -
-Commands allow, deny and flush are used to manage ACLs: +The commands allow, deny, and flush are used to manage ACLs:
allow <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist> <weekdaylist> <timeperiodlist>
-
deny <userlist> <sourcelist> <targetlist> <weekdaylist> <timeperiodlist>
+
deny <userlist> <sourcelist> <targetlist> <weekdaylist> <timeperiodlist>
flush
-
-Redirections are usefull to e.g. forward requests from specific clients
-to different servers or proxy server. Additionally, redirections are usefull
-to convert proxy interface from ont format to another, e.g. requests from
-SOCKS proxy can be redirected to parent HTTP proxy, or SOCKSv5 client can be
-redirected to SOCKSv4 proxy.
-
Because 3proxy understand "transparent" web request, it can be used as an
-intermediate software between HTTP proxy and NAT server for transparent HTTP
-forwarding, because it can convert "Web server" request issued by client to
-"proxy request" required by proxy server. A simplest redirection is:
+Redirections are useful to, e.g., forward requests from specific clients
+to different servers or proxy servers. Additionally, redirections are useful
+to convert the proxy interface from one format to another, e.g., requests from
+a SOCKS proxy can be redirected to a parent HTTP proxy, or a SOCKSv5 client can be
+redirected to a SOCKSv4 proxy.
+
Because 3proxy understands "transparent" web requests, it can be used as an
+intermediate software between an HTTP proxy and a NAT server for transparent HTTP
+forwarding, because it can convert a "Web server" request issued by a client to a
+"proxy request" required by a proxy server. A simple redirection is:
auth iponly allow * parent 1000 http 192.168.1.1 3128 proxy-All trafiic of HTTP proxy is redirected to parent proxy 192.168.1.1 port 3128. -
auth iponly @@ -730,25 +730,25 @@ allow * * * 110 parent 1000 pop3 0.0.0.0 0 socks-In this case all SOCKS traffic with destination port 80 is forwarded to local -'proxy' service, destination port 21 to 'ftppr' and 110 to 'pop3pr'. There is -no need to run these services expicitly. Local redirections are usefull if -you want to see and control via ACLs protocol specific parameters, e.g. -filenames requests thorugh FTP while clients are using SOCKS. +In this case, all SOCKS traffic with destination port 80 is forwarded to the local +'proxy' service, destination port 21 to 'ftppr', and 110 to 'pop3pr'. There is +no need to run these services explicitly. Local redirections are useful if +you want to see and control via ACLs protocol-specific parameters, e.g., +filenames requested through FTP while clients are using SOCKS. -
Q: What is it for?
-A: To have control based on request and to have URLs and another protocol specific parameters to be logged. +A: To have control based on the request and to have URLs and other protocol-specific parameters logged. -Q: What are restrictions?
-A: It's hard to redirect services for non-default ports; Internet Explorer supports only SOCKSv4 with no password authentication (Internet Explorer sends username, but not password), for SOCKSv5 only cleartext password authentication is supported. +Q: What are the restrictions?
+A: It's hard to redirect services for non-default ports; Internet Explorer supports only SOCKSv4 with no password authentication (Internet Explorer sends the username, but not the password); for SOCKSv5, only cleartext password authentication is supported. -Q: What are advantages?
-A: You need only to setup SOCKS proxy in browser settings. You can use socksifier, i.e. FreeCAP or SocksCAP with application which is not proxy aware. +Q: What are the advantages?
+A: You only need to set up a SOCKS proxy in browser settings. You can use a socksifier, e.g., FreeCAP or SocksCAP, with an application that is not proxy-aware. -Q: How to setup?
-A: You should specify parent proxy with IP of 0.0.0.0 and port 0. Examples: +Q: How to set it up?
+A: You should specify a parent proxy with an IP of 0.0.0.0 and port 0. Examples:auth iponly allow * * * 80,8080-8088 @@ -761,19 +761,19 @@ allow * * * 80,8080-8088 allow * * * 21,2121 parent 1000 ftp 0.0.0.0 0 allow * * * 21,2121 -#redirect ports 21 and 2121 to local +#redirect ports 21 and 2121 to local #ftp proxy allow * -#allow rest of connections directly +#allow the rest of connections directly socks -#now let socks server to start +#now let the socks server start-
Q: How it affects different ACL rules
-A: After local redirections rules are applied again to protocol-level request. Redirection rule itself is skipped. It makes it possible to redirect request again on the external proxy depending on request itself. +Q: How does it affect different ACL rules?
+A: After local redirections, rules are applied again to the protocol-level request. The redirection rule itself is skipped. This makes it possible to redirect the request again to an external proxy depending on the request itself.allow * * * 80,8080-8088 parent 1000 http 0.0.0.0 0 @@ -783,33 +783,32 @@ allow * * $c:\3proxy\local.nets 80,8080-8088 #allow direct access to local.nets networks allow * * * 80,8080-8088 parent 1000 http proxy.3proxy.org 3128 -#use parent caching proxy for rest of the networks +#use parent caching proxy for the rest of the networks allow * -#allow direct connections for rest of socks +#allow direct connections for the rest of socks #requests-
-Proxy itself doesn't manage network level routing. The only way to control -outgoing channel is to select external interface. It's possible to make -external interface (what is usually selected with 'external' command or -'-e' option) random by using local redirection with external port 0. +The proxy itself doesn't manage network-level routing. The only way to control +the outgoing channel is to select the external interface. It's possible to make +the external interface (what is usually selected with the 'external' command or +'-e' option) random by using local redirection with an external port of 0.
auth iponly allow * parent 500 http 10.1.1.101 0 parent 500 http 10.2.1.102 0-Now external interface is randomly selected with 0.5 probability between +Now the external interface is randomly selected with 0.5 probability between 10.1.1.101 and 10.2.1.102. To work as expected, different default routes -must between 2 interfaces. -used +must be used between the 2 interfaces.
-If both interface addresses are in same network, e.g. 10.1.1.101 and 10.1.1.102 -and you want to select random gateway between 10.1.1.1 and 10.1.1.2, you must -control it by using routing table, in case there is no default gateway route +If both interface addresses are in the same network, e.g., 10.1.1.101 and 10.1.1.102, +and you want to select a random gateway between 10.1.1.1 and 10.1.1.2, you must +control it by using the routing table, in case there is no default gateway route for Windows:
route add -p 10.1.1.1 10.1.1.101 @@ -817,33 +816,33 @@ for Windows: route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.1 route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.2-If you have no second address yet, just add it. Under Linux/Unix it's better +If you don't have a second address yet, just add it. Under Linux/Unix, it's better to use source routing.
-parent command may also be used to build a proxy chains. In this case -few 'parent' commands are used for single 'allow' rule with different -weights (first argument of parent command). Chain may contain any number -of proxy servers, but it should be noted that every hope significantly -reduces productivity. It's possible to mix different types of proxy within -single chain: HTTPS (HTTP connect), SOCKS4, SOCKS5. Weight different from -1000 is used to build random chains. if weight W is below 1000, this proxy -will be used as a next chain hop with probability of W/1000. That is, if -the weight is 250 probability this proxy will be used for the next hope is -25%. 'parent' records with common weight of 1000 establish a group, one of -these record will be used for the hop with probability according to weight. -Warning: each group must have a weight even of 1000. As follows, common -weight of all 'parent' records must also be even of 1000. If common weight -of 'parent' records in te chain is 3000, chain has 3 hops and must be formed +The parent command may also be used to build proxy chains. In this case, +multiple 'parent' commands are used for a single 'allow' rule with different +weights (the first argument of the parent command). A chain may contain any number +of proxy servers, but it should be noted that every hop significantly +reduces performance. It's possible to mix different types of proxies within a +single chain: HTTPS (HTTP connect), SOCKS4, SOCKS5. A weight different from +1000 is used to build random chains. If weight W is below 1000, this proxy +will be used as the next chain hop with a probability of W/1000. That is, if +the weight is 250, the probability that this proxy will be used for the next hop is +25%. 'parent' records with a combined weight of 1000 establish a group; one of +these records will be used for the hop with a probability according to the weight. +Warning: each group must have a weight that is a multiple of 1000. As follows, the combined +weight of all 'parent' records must also be a multiple of 1000. If the combined weight +of 'parent' records in the chain is 3000, the chain has 3 hops and must be formed of 3 groups. Example:
allow * parent 500 socks5 192.168.1.1 1080 parent 500 connect 192.168.10.1 3128-In this case we have 1 parent proxy (1 hop) which is randomely choosen between -2 hosts: 192.168.1.1 and 192.168.10.1. 2 records form a single group. +In this case, we have 1 parent proxy (1 hop) which is randomly chosen between +2 hosts: 192.168.1.1 and 192.168.10.1. The 2 records form a single group.
allow * * * 80 parent 1000 socks5 192.168.10.1 1080 @@ -851,33 +850,33 @@ parent 1000 connect 192.168.20.1 3128 parent 300 socks4 192.168.30.1 1080 parent 700 socks5 192.168.40.1 1080-In this case we have 3 groups (3 hops in the chain). First hop is 192.168.10.1, -second hop is 192.168.20.1 and 3rd one is either 192.168.30.1 with probability -of 30% or 192.168.40.1 with probability of 70%. +In this case, we have 3 groups (3 hops in the chain). The first hop is 192.168.10.1, +the second hop is 192.168.20.1, and the 3rd one is either 192.168.30.1 with a probability +of 30% or 192.168.40.1 with a probability of 70%.
-3proxy supports bandwidth filters. To manage filters bandlimin/bandlimout and -nobandlimin/nobandlimout. 'in' means incoming and 'out' - outgoing traffic. +3proxy supports bandwidth filters. Use the bandlimin/bandlimout and +nobandlimin/nobandlimout commands to manage filters. 'in' means incoming and 'out' means outgoing traffic.
bandlimin <bitrate> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
nobandlimin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
bandlimin 57600 * 192.168.10.16 bandlimin 57600 * 192.168.10.17 bandlimin 57600 * 192.168.10.18 bandlimin 57600 * 192.168.10.19-Create 4 separete pipes for 4 client with emulation of modem connection. +Create 4 separate pipes for 4 clients with emulation of a modem connection.
bandlimin 57600 * 192.168.10.16/30-Create single pipe for all 4 clients. That is 4 clients share modem connection. +Create a single pipe for all 4 clients. That is, 4 clients share a modem connection. In this example:
nobandlimin * * * 110 @@ -889,7 +888,7 @@ limitation.
-counter <filename> <type> <reportpath>
+counter <filename> <type> <reportpath>
countin <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
nocountin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
countout <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
@@ -897,20 +896,20 @@ counter <filename> <type> <reportpath>
-You can set traffic limit per day (D), week (W), month (M), year (Y) or -absolute ('N'), as specified by 'type' argument of counterin command. -Traffic information is stored in binary file specified by 'filename' argument. -countersutil utility can be used to manage this file. -reportpath specifies location of text reports, type parameter of 'counter' -command controls how often text reports are created. amount is amount of -allowed traffic in Megabytes (MB). nocountin allows you to set exclusions. +You can set a traffic limit per day (D), week (W), month (M), year (Y), or +absolute ('N'), as specified by the 'type' argument of the counterin command. +Traffic information is stored in a binary file specified by the 'filename' argument. +The countersutil utility can be used to manage this file. +The reportpath specifies the location of text reports; the type parameter of the 'counter' +command controls how often text reports are created. The amount is the amount of +allowed traffic in megabytes (MB). nocountin allows you to set exclusions.
3proxy accounts protocol level traffic. Provider counts channel or IP-level traffic with network and transport headers. In additions, 3proxy doesn't counts DNS resolutions, pings, floods, scans, etc. It makes approx. 10% of difference. That's why you should have 15% reserve if you use 3proxy to limit your traffic. If difference with your provider is significantly above 10% you should look for traffic avoiding proxy server, for example connections through NAT, traffic originated from the host with proxy installed, traffic from server applications, etc. +
3proxy accounts for protocol-level traffic. Providers count channel- or IP-level traffic with network and transport headers. In addition, 3proxy does not count DNS resolutions, pings, floods, scans, etc. This accounts for approximately a 10% difference. That is why you should have a 15% reserve if you use 3proxy to limit your traffic. If the difference with your provider is significantly above 10%, you should look for traffic bypassing the proxy server, for example connections through NAT, traffic originating from the host with the proxy installed, traffic from server applications, etc.
- For name resolution and caching use commands nserver, nscache / nscache6 and nsrecord. + For name resolution and caching, use the commands nserver, nscache / nscache6, and nsrecord.
nserver 192.168.1.2 nserver 192.168.1.3:5353/tcp@@ -920,52 +919,52 @@ allowed traffic in Megabytes (MB). nocountin allows you to set exclusions.
nscache 65535 nscache6 65535- sets name cache size for IPv4 and IPv6. Name cache must be large enouth, if presents. - name cache is only used if nserver is configured. + sets name cache size for IPv4 and IPv6. The name cache must be large enough, if present. + The name cache is only used if nserver is configured.
nsrecord server.mycompany.example.com 192.168.1.1 nsrecord www.porno.com 127.0.0.2 ... deny * * 127.0.0.2- adds static nsrecords. Also, static nsrecords are used for dnspr, unless -s option is specified. - Since 0.8 version, parent proxy may be configured for dnspr. + adds static nsrecords. Also, static nsrecords are used for dnspr, unless the -s option is specified. + Since version 0.8, a parent proxy may be configured for dnspr.
- IPv6 is supported since 0.8. Please note, some proxy protolos, e.g. SOCKSv4,
- do not support IPv6. SOCKSv5 supports IPv6 with special request type (must be
- implemented by client).
+ IPv6 is supported since version 0.8. Please note that some proxy protocols, e.g., SOCKSv4,
+ do not support IPv6. SOCKSv5 supports IPv6 with a special request type (which must be
+ implemented by the client).
3proxy supports proxying from IPv4 and IPv6 networks to IPv4,
- IPv6 and mixed networks. IPv6 address may be used in
- internal, external, parent commands, ACLs, -i and -e options,etc.
- external command and -e options may be given twice for each service - once with IPv4
- and once with IPv6 address. internal can be given only once, to bind to all IPv4 and
- IPv6 addresses use [0:0:0:0:0:0:0:0] or [::].
+ IPv6, and mixed networks. An IPv6 address may be used in
+ internal, external, and parent commands, ACLs, -i and -e options, etc.
+ The external command and -e options may be given twice for each service—once with an IPv4
+ and once with an IPv6 address. internal can be given only once; to bind to all IPv4 and
+ IPv6 addresses, use [0:0:0:0:0:0:0:0] or [::].
- Any service may be configured with -4, -46, -64, -6 options to specify decied
- priority for name to IPv4/IPv6 address resolution (IPv4 only, IPv4 priority,
+ Any service may be configured with -4, -46, -64, or -6 options to specify the desired
+ priority for name-to-IPv4/IPv6 address resolution (IPv4 only, IPv4 priority,
IPv6 priority, IPv6 only).
- In example, users needs access from external network to proxy server located - on the host 192.168.1.2. This host can not be accessed from external network, - but it has access to external network with with external address 1.1.1.1. - Also, user has access to the host 2.2.2.2 (IP address may be dynamic) with - hostname host.dyndns.example.org via external network. User needs 2 instances - of 3proxy, first one on the host 192.168.1.2 with config + For example, a user needs access from an external network to a proxy server located + on the host 192.168.1.2. This host cannot be accessed from the external network, + but it has access to the external network with an external address 1.1.1.1. + Also, the user has access to the host 2.2.2.2 (IP address may be dynamic) with + hostname host.dyndns.example.org via the external network. The user needs 2 instances + of 3proxy, the first one on the host 192.168.1.2 with the config
users user:CL:password auth strong allow user proxy -rhost.dyndns.example.org:1234- second one on the host.dyndns.example.org (2.2.2.2) with config + and the second one on host.dyndns.example.org (2.2.2.2) with the config
auth iponly allow * * 1.1.1.1 tcppm -R0.0.0.0:1234 3128 1.1.1.1 3128- For browser settings proxy is host.dyndns.example.org:3128. + For browser settings, the proxy is host.dyndns.example.org:3128. @@ -973,26 +972,26 @@ allowed traffic in Megabytes (MB). nocountin allows you to set exclusions.
-Latest version of 3proxy may be obtained +The latest version of 3proxy may be obtained here. -New version may have changes and incompatibilities with previous one in files -format or commands. Please, read CHANGELOG file and another documentation -before installing new version. +A new version may have changes and incompatibilities with the previous one in file +formats or commands. Please read the CHANGELOG file and other documentation +before installing a new version.
-If installed as system service, 3proxy understands Windows service commands -for START, STOP, PAUSE and RESUME. If service is PAUSEd, no new connections -are accepted while older connections are processed. Currently there is no -support for dynamic configuration change, so, you have to restart service +If installed as a system service, 3proxy understands Windows service commands +for START, STOP, PAUSE, and RESUME. If the service is PAUSEd, no new connections +are accepted while older connections are processed. Currently, there is no +support for dynamic configuration changes, so you have to restart the service completely if you have changed any configuration. -You can control 3proxy service via "Services" administration ot via "net" command: +You can control the 3proxy service via "Services" administration or via the "net" command:
net start 3proxy net stop 3proxy @@ -1003,8 +1002,8 @@ You can control 3proxy service via "Services" administration ot via "net" comman
Ask it in Github. - Don't try to ask something before reading this document. + Please read this document before asking a question.
Убедитесь, что выправильно понимаете что такое internal и external адреса. Оба адреса - это адреса, принадлежищие хосту, на котором установлен 3proxy. diff --git a/doc/html/index.html b/doc/html/index.html index a5b0205..10277bd 100644 --- a/doc/html/index.html +++ b/doc/html/index.html @@ -1,17 +1,17 @@ -
@@ -12,11 +12,11 @@ pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] pcre_extend FILTER_ACTION [ACE] pcre_options OPTION1 [...]-pcre - allows to apply some rule for matching -
plugin /path/to/SslPlugin.dll ssl_plugin ssl_server_ca_file /path/to/cafile @@ -47,7 +47,7 @@ proxy -p3128 ssl_nomitm proxy -p3129-mitm's traffic with spoofed ceritifacate for port 3128 proxy. +MITM's traffic with a spoofed certificate for the port 3128 proxy.
@@ -59,6 +59,6 @@ proxy -p33128 ssl_noserv proxy -p3128-creates https:// proxy on 33128 and http:// proxy on 3128 +Creates an https:// proxy on port 33128 and an http:// proxy on port 3128 © Vladimir Dubrovin, License: BSD style diff --git a/doc/html/plugins/StringsPlugin.html b/doc/html/plugins/StringsPlugin.html index f0f76cc..815ae17 100644 --- a/doc/html/plugins/StringsPlugin.html +++ b/doc/html/plugins/StringsPlugin.html @@ -1,16 +1,16 @@ -
plugin "StringsPlugin.dll" start c:\3proxy\bin\rus.3ps
-This plugin attempts to correct 3proxy computations to approximate network or -link level traffic by using either fixed coefficients by port number or -attempting to predict number and sizes of network packets. +This plugin attempts to correct 3proxy's computations to approximate network or +link-level traffic by using either fixed coefficients by port number or +by attempting to predict the number and sizes of network packets.
plugin TrafficPlugin.dll start
trafcorrect m <service> <target port> <coefficient>-where <service> - one of proxy, socks4, socks45, socks5, tcppm, udppm, pop3p, * matches "any". -
trafcorrect p <service> <tcp/udp> <target port> [empty packet size]-tcp ot udp - transport level protocol to apply rule +tcp or udp - transport-level protocol to apply the rule to
plugin "TrafficPlugin.dll" start trafcorrect m socks5 6112 4.5 trafcorrect m socks5 * 1.1-wrong usage: +Wrong usage:
trafcorrect m socks5 * 1.1 trafcorrect m socks5 6112 4.5-second rule will never be applied. +The second rule will never be applied.
@@ -66,4 +66,4 @@ trafcorrect m socks5 6112 4.5Загрузить:
plugin /path/to/TransparentPlugin.ld.so transparent_plugin @@ -19,13 +19,13 @@ notransparent proxyNow, any TCP traffic transparently redirected to port 12345 will be routed via -parent SOCKSv5 proxy and logged, all URLs for web requests are visible in logs. -Paremeters '127.0.0.1 11111' in this case are not used and are overwritten by -destination IP:port for each transparent connection. +the parent SOCKSv5 proxy and logged; all URLs for web requests are visible in logs. +The parameters '127.0.0.1 11111' in this case are not used and are overwritten by +the destination IP:port for each transparent connection.
plugin "WindowsAuthentication.dll" WindowsAuthentication "3ProxyAllowedGroup"
authcache user,pass 900 auth cache windows-
diff --git a/doc/ru/example1.txt b/doc/ru/example1.txt
index 7c426a8..5b34c4e 100644
--- a/doc/ru/example1.txt
+++ b/doc/ru/example1.txt
@@ -3,26 +3,26 @@ KOI8-R
Kirill Lopuchov, lopuchov at mail ru
<3proxy>
- Internet- ( , Internet-). , Internet- proxy-, NAT ( ) IP .
+Довольно часто перед системным администратором встает задача предоставить доступ к Internet-ресурсам группе пользователей (небольшой офис, Internet-кафе). Данную задачу можно решить, настроив на Internet-шлюзе proxy-сервер, службу NAT (трансляция сетевых адресов) или раздать каждому пользователю реальный IP адрес.
- - proxy-. proxy Squid, :), squid SOCKS4/5-, TCP/UP -. PROXY-, "3proxy" (http://3proxy.ru/), . . . , Win9x/2000/XP Linux FreeBSD.
+Давайте рассмотрим самый простой способ подключения - установку proxy-сервера. Традиционно для этих целей применяется популярный proxy Squid, но не всегда бывает необходимость в столь тяжеловатой программе :), да и в squid отсутствуют такие иногда необходимые вещи как SOCKS4/5-сервер, TCP/UP порт-маппинг. Поэтому вторым номером хочется представить вашему вниманию PROXY-сервер, под названием "3proxy" (http://3proxy.ru/), разработанный нашим программистом из г. Нижний Новгород. Одним из главных его достоинств является компактность и высокая переносимость. Код сервера написан так, что легко компилируется как для Win9x/2000/XP так и для Linux и FreeBSD.
- :
+Сервер поддерживает следующие возможности:
HTTP(S) proxy;
FTP over HTTP proxy;
SOCKS4/5 proxy;
POP3 proxy;
-TCP & UDP ;
- ;
- ( , :) );
- , ;
- proxy- ip ;
- ODBC (-, proxy) syslog . .
+TCP & UDP маппинг портов;
+листы доступа к различным службам и адресам;
+ограничение пропускной способности канала каждого пользователя (чтобы пользователь не съел весь канал, качая кучу файлов в несколько потоков :) );
+ограничение трафика пользователя на день, неделю и месяц;
+авторизацию пользователей ко всем proxy-службам по имени и паролю или по ip адресам;
+ведение журналов через ODBC (по-моему, такого нет ни в одном proxy) и syslog и т. д.
- :-|. Inernet- ( ) - 25% . , , 2- wwwoffle , 3proxy :)
+К недостаткам можно отнести отсутствие кэширования информации :-|. Но в последнее время Inernet-контент становится все более динамичным (то есть не поддающийся кэшированию) и может быть для кого-то экономия в 25% трафика за счет его кэширования не будет столь критична. Для тех пользователей, кому она может оказаться критичной, автор предлагает использовать цепочку из 2-х серверов и в качестве кэша такие сервера как wwwoffle или им подобные, либо ждать появления поддержки кеша в 3proxy :)
-
+Установка
# wget http://3proxy.ru/current/3proxy.tgz
# tar -xvzf 3proxy.tgz
@@ -35,64 +35,64 @@ TCP & UDP
# touch /usr/local/3proxy/3proxy.cfg
# chown -R nobody:nogroup /usr/local/3proxy
- 3proxy.cfg
-,
- 3proxy.cfg.sample
+Далее приведу небольшой пример конфигурационного файла 3proxy.cfg с
+комментариями, более подробную информацию по конфигурированию можно
+найти файле 3proxy.cfg.sample или в
HowTo http://3proxy.ru/howtor.asp
- FAQ http://3proxy.ru/faqr.asp
+и FAQ http://3proxy.ru/faqr.asp
-------------3proxy.cfg-------------
-# !!
-# !!
+# ВНИМАНИЕ !! не должны быть пробелов
+# перед любыми опциями конфигурации !!
-# ip- DNS-
+# ip-адрес DNS-сервера провайдера или локального
nserver 127.0.0.1
timeouts 1 5 30 60 180 1800 15 60
-# vasia, petia vova
-# 24555, 14656 45455
+# Создаем двух пользователей vasia, petia и vova
+# и назначаем им пароли 24555, 14656 и 45455 соответственно
users vasia:CL:24555
users petia:CL:14656
users vova:CL:45455
-# -
-#
+# Лог-файл со списком запросов пользователей
+# будет создаваться каждый день новый
log /usr/local/3proxy/logs/3proxy.log D
logformat "%d-%m-%Y %H:%M:%S %U %C:%c %R:%r %O %I %T"
-# ,
-#
+# Внешний интерфейс,
+# через который будут уходить запросы от сервера
external 10.1.1.1
-# ip- ,
-#
+# ip-адрес интерфейса, на котором будут приниматься
+# запросы от клиентов
internal 192.168.1.1
-#
+# Устанавливаем тип авторизации по имени и паролю
auth strong
-# 80,8080-8088
+# Разрешаем доступ к портам 80,8080-8088
allow * * * 80,8080-8088
-# parent,
-# ip, ,
+# Расскоментировать секцию parent, если у вас есть прокси верхнего
+# уровня и заменить ip, порт, имя пользователя и пароль на свои значения
# parent 1000 http 192.168.0.1 8080 username passwd
# allow *
-# HTTP-proxy (3128)
-# (-n) c NTLM-)
+# Запускаем службу HTTP-proxy на порту (3128) и
+# (-n) c отключенной NTLM-авторизацией)
proxy -p3128 -n
-#
-# vasia petia 20000 bps,
-# vova 10000 bps
+# Ограничиваем толшину канала для пользователей
+# vasia и petia в 20000 bps,
+# а для vova 10000 bps
bandlimin 20000 vasia,petia
bandlimin 10000 vova
-# nobody
-# ( uid gid nobody
-# . id nobody)
+# Запускаем сервер от пользователя nobody
+# (возможно в вашей ОС uid и gid пользователя nobody
+# будут другими. Для их определения воспользуйтесь коммандой id nobody)
setgid 65534
setuid 65534
------------------------------------
- , 3proxy :
+После того как мы создали конфигурационный файл сервера, запускаем 3proxy командой:
/usr/local/3proxy/3proxy /usr/local/3proxy/3proxy.cfg
diff --git a/doc/ru/iodbc.txt b/doc/ru/iodbc.txt
index 627bb3e..4b39521 100644
--- a/doc/ru/iodbc.txt
+++ b/doc/ru/iodbc.txt
@@ -2,9 +2,9 @@ KOI8-R
Kirill Lopuchov, lopuchov at mail ru
- SQL- . 3proxy ODBC- , ODBC-. - Windows, , , Unix. FreeBSD SQLite. , ( mysql postgresql odbc-)
+Ведение логов сервера в SQL-базе имеет свои приемущества перед обычными текстовыми файлами. 3proxy поддерживает ведение логов через ODBC-менеджер в любой базе данных, имеющих ODBC-драйвер. Этот менеджер стал стандартом де-факто в среде Windows, чего, к сожалению, не скажешь про Unix. Поэтому далее рассмотрим на примере FreeBSD настройку ведения логов в базе SQLite. Эта база данных выбрана в качестве примера потому, что она проста в установке и настроке (в принципе настройка ведения логов в любой другой базе mysql или postgresql отличается только настройкой его odbc-драйвера)
- SQLite
+ Устанавливаем SQLite
wget http://www.sqlite.org/sqlite-2.8.14.tar.gz
tar -xvzf sqlite-2.8.14.tar.gz
cd sqlite
@@ -12,7 +12,7 @@ cd sqlite
gmake
gmake install
- iODBC
+ Устанавливаем iODBC менеджер
wget http://www.iodbc.org/libiodbc-3.51.2.tar.gz
tar -xvzf libiodbc-3.51.2.tar.gz
cd libiodbc-3.51.2
@@ -20,24 +20,24 @@ cd libiodbc-3.51.2
make
make install
- odbc SQLite
+ Устанавливаем odbc драйвер SQLite
wget http://www.ch-werner.de/sqliteodbc/sqliteodbc-0.62.tar.gz
tar -xvzf sqliteodbc-0.62.tar.gz
cd sqliteodbc-0.62
./configure
- configure :
+ Если у вас скрипт configure выдал ошибку :
(configure: error: SQLite library too old)
- , (SQLITE_COMPILE=1
- . 5092 if endif) configure
+ то ее можно попробовать обойти, вставив (SQLITE_COMPILE=1
+ в стр. 5092 после условия if endif) в файле configure
make
make install
- iODBC
- /etc/odbcinst.ini /etc/odbc.ini
+ Далее настраиваем записи для iODBC менеджера в
+файлах /etc/odbcinst.ini и /etc/odbc.ini
- odbc
+Настраиваем odbc драйвер
--------------/etc/odbcinst.ini-------------
[ODBC Drivers]
SQLite=Installed
@@ -46,8 +46,8 @@ SQLite=Installed
Driver=/usr/local/lib/libsqliteodbc.so
---------------------------------------
- DSN c "sqlite",
- : /usr/local/3proxy/logs.db
+Создаем DSN для базы c именем "sqlite", которая будет
+располагаться в каталоге: /usr/local/3proxy/logs.db
--------------/etc/odbc.ini----------------
[ODBC Data Sources]
@@ -61,8 +61,8 @@ Database=/usr/local/3proxy/logs.db
Timeout=2000
---------------------------------------
- (logformat
-. 3proxy.cfg.sample )
+Создаем базу для логов и таблицу в формате (logformat
+см. описание в 3proxy.cfg.sample )
sqlite /usr/local/3proxy/logs.db
@@ -79,7 +79,7 @@ sqlite>create table log (
...>);
- 3proxy.cfg
+Добавляем следующие записи в конфигурационный файл 3proxy.cfg
---------------3proxy.cfg-----------------
log &sqlite
@@ -88,12 +88,12 @@ l_descr)
values ('%d-%m-%Y', '%H:%M:%S', '%U', '%N', %I, %O, '%T')"
------------------------------------------
-C 3proxy c iODBC, Makefile.unix
+Cобрать 3proxy c поддрежкой iODBC, для этого в Makefile.unix поменять
CFLAGS = -Wall -O2 -c -pthread -D_THREAD_SAFE -D_REENTRANT -DWITH_STD_MALLOC -I/usr/local/include
LIBS = -L /usr/local/lib -lodbc
-
+и дать команды
make clean
make -f Makefile.unix
diff --git a/doc/ru/odbc.txt b/doc/ru/odbc.txt
index d0ca46a..31027d4 100644
--- a/doc/ru/odbc.txt
+++ b/doc/ru/odbc.txt
@@ -1,6 +1,6 @@
Eugene: Re: 3proxy 0.6 + iODBC + PostgreSQL 22.11.2007 19:04:23
- - .
-1. unixODBC.
+ Наконец-то я разобрался и запустил.
+1. Я использовал пакет unixODBC.
2. /etc/unixODBC/odbc.ini
[proxy]
Description = PostgreSQL ODBC driver
@@ -12,7 +12,7 @@ ServerName = localhost
Description = PostgreSQL ODBC driver
Driver = /usr/local/lib/psqlodbcw.so
Setup = /usr/lib/libodbcpsqlS.so
-4. psqlodbc-08.02.0500, postgresql.org ( psqlodbcw.so).
+4. Собирал вручную psqlodbc-08.02.0500, слитый с postgresql.org (получился psqlodbcw.so).
5. 3proxy.conf
log &proxy,logger,123
logformat "LINSERT INTO logger (ldatetime,username,userip,trafin,trafout,service,host,port,
@@ -20,9 +20,9 @@ url) VALUES ('%Y-%m-%d %H:%M:%S','%U','%C',
'%I','%O','%N',
'%n','%r','%T');"
- odbc.ini - ODBC.
- libiodbc - libiodbc.so.
+То есть пароли и логины в odbc.ini прописывать не надо - система падает на драйвере ODBC.
+Использовать libiodbc тоже не надо - система падает на libiodbc.so.
- unixODBC + psqlodbc postgresql.org, -DSAFESQL, .
- myodbc + unixODBC .
-, ;)
\ No newline at end of file
+Все вышесказанное справедливо для unixODBC + psqlodbc производства postgresql.org, как с -DSAFESQL, так и без оного.
+С myodbc + unixODBC проблем не наблюдалось никаких.
+Шаманство, в общем ;)
\ No newline at end of file
diff --git a/man/3proxy.8 b/man/3proxy.8
index 66cd39e..fc13b94 100644
--- a/man/3proxy.8
+++ b/man/3proxy.8
@@ -14,18 +14,18 @@ server
.RI [ \-\-remove ]
.SH DESCRIPTION
.B 3proxy
-is universal proxy server. It can be used to provide internal users wuth
+is a universal proxy server. It can be used to provide internal users with
fully controllable access to external resources or to provide external
users with access to internal resources. 3proxy is not developed to replace
.BR squid (8),
-but it can extend functionality of existing cashing proxy.
+but it can extend the functionality of an existing caching proxy.
It can be used to route requests between different types of clients and proxy
servers. Think about it as application level
gateway with configuration like hardware router has for network layer.
It can establish multiple
gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4,
v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started
-from configuration file like independant service
+from the configuration file like an independent service
.BR proxy (8)
.BR socks (8)
.BR pop3p (8)
@@ -35,24 +35,24 @@ from configuration file like independant service
.BR dnspr
but
.BR 3proxy
-is not a kind of wrapper or superserver for this daemons. It just has same
+is not a kind of wrapper or superserver for these daemons. It just has the same
code compiled in, but provides much more functionality. SOCKSv5
-implementatation allows to use 3proxy with any UDP or TCP based client
+implementation allows you to use 3proxy with any UDP or TCP based client
applications designed without
proxy support (with
.IR SocksCAP ,
.I FreeCAP
-or another client-side redirector under Windows of with socksification library
-under Unix). So you can play your favourite games, listen music, exchange
-files and messages and even accept incoming connections behind proxy server.
+or another client-side redirector under Windows or with a socksification library
+under Unix). So you can play your favourite games, listen to music, exchange
+files and messages and even accept incoming connections behind a proxy server.
.PP
.I dnspr
-does not exist as independant service. It\' DNS caching proxy (it requires
+does not exist as an independent service. It's a DNS caching proxy (it requires
.I nscache
and
.I nserver
-to be set in configuration. Only A-records are cached. Please note, the
-this caching is mostly a 'hack' and has nothing to do with real
+to be set in the configuration. Only A-records are cached. Please note that
+this caching is mostly a 'hack' and has nothing to do with a real
DNS server, but it works perfectly for SOHO networks.
.PP
@@ -65,9 +65,9 @@ NetBIOS name for Windows clients (it\'s very like ident authentication).
Depending on ACL action request can be allowed, denied or redirected to another
host or to another proxy server or even to a chain of proxy servers.
.PP
-It supports different types of logging: to logfiles,
+It supports different types of logging: to logfiles,
.BR syslog (3)
-(only under Unix) or to ODBC database. Logging format is turnable to provide
+(only under Unix) or to an ODBC database. Logging format is tunable to provide
compatibility with existing log file parsers. It makes it possible to use
3proxy with IIS, ISA, Apache or Squid log parsers.
.SH OPTIONS
@@ -77,12 +77,12 @@ Name of config file. See
.BR 3proxy.cfg (3)
for configuration file format. Under Windows, if config_file is not specified,
.BR 3proxy
-looks for file named
+looks for a file named
.I 3proxy.cfg
-in the default location (in same directory with executable file and in current
+in the default location (in the same directory as the executable file and in the current
directory). Under Unix, if no config file is specified, 3proxy reads
-configuration from stdin. It makes it possible to use 3proxy.cfg file as
-executable script just by setting +x mode and adding
+configuration from stdin. It makes it possible to use the 3proxy.cfg file as
+an executable script just by setting +x mode and adding
.br
#!/usr/local/3proxy/3proxy
.br
@@ -98,28 +98,28 @@ as a system service
.BR 3proxy
from system services
.SH SIGNALS
-Under Unix there are few signals
+Under Unix there are a few signals
.BR 3proxy
catches. See
.BR kill (1).
.TP
.B SIGTERM
-cleanup connections and exit
+clean up connections and exit
.TP
.B SIGPAUSE
-stop to accept new connections, on second signal - start and re-read
+stop accepting new connections, on second signal - start and re-read
configuration
.TP
.B SIGCONT
-start to accept new conenctions
+start to accept new connections
.TP
.B SIGUSR1
reload configuration
.PP
Under Windows, if
.BR 3proxy
-is installed as service you can standard service management to start, stop,
-pause and continue 3proxy service, for example:
+is installed as a service you can use standard service management to start, stop,
+pause and continue the 3proxy service, for example:
.br
.BR "net start 3proxy"
.br
diff --git a/man/3proxy.cfg.3 b/man/3proxy.cfg.3
index 042da67..212db94 100644
--- a/man/3proxy.cfg.3
+++ b/man/3proxy.cfg.3
@@ -6,9 +6,9 @@
Common structure:
.br
Configuration file is a text file 3proxy reads configuration from. Each line
-of the file is a command executed immediately, as it was given from
-console. Sequence of commands is important. Configuration file as actually a
-script for 3proxy executable.
+of the file is a command executed immediately, as if it were given from the
+console. The sequence of commands is important. The configuration file is actually a
+script for the 3proxy executable.
Each line of the file is treated as a blank (space or tab) separated
command line. Additional space characters are ignored.
Think about 3proxy as "application level router" with console interface.
@@ -16,16 +16,16 @@ Think about 3proxy as "application level router" with console interface.
.br
Comments:
.br
- Any string beginning with space character or \'#\' character is comment. It\'s
-ignored.