doc/html/faqe.html

@@ -1,2 +1,2 @@
 
-<H2><A href="howtoe.html">See HowTo:</a></H2>
+<H2><A href="hotoe.html">See HowTo:</a></H2>

doc/html/faqr.html

@@ -1,2 +1,2 @@
 
-<H2><A href="howtoe.html">См. HowTo</a></H2>
+<H2><A href="hotoe.html">См. HowTo</a></H2>

doc/html/highload.html

@@ -1,12 +1,12 @@
-<h3>Optimizing 3proxy for High Load</h3>
+<h3>Optimizing 3proxy for high load</h3>
-<p>Precaution 1: 3proxy was not initially developed for high load and is positioned as a SOHO product. The main reason is the "one connection - one thread" model 3proxy uses. 3proxy is known to work with over 200,000 connections under proper configuration, but use it in a production environment under high loads at your own risk and do not expect too much.
+<p>Precaution 1: 3proxy was not initially developed for high load and is positioned as a SOHO product, the main reason is "one connection - one thread" model 3proxy uses. 3proxy is known to work with above 200,000 connections under proper configuration, but use it in production environment under high loads at your own risk and do not expect too much.
-<p>Precaution 2: This documentation is incomplete and insufficient. High loads may require very specific system tuning including, but not limited to, specific or customized kernels, builds, settings, sysctls, options, etc. All of this is not covered by this documentation.
+<p>Precaution 2: This documentation is incomplete and is not sufficient. High loads may require very specific system tuning including, but not limited to specific or cusomized kernels, builds, settings, sysctls, options, etc. All this is not covered by this documentation.
 
 <h4>Configuring 'maxconn'</h4>
 
-The number of simultaneous connections per service is limited by the 'maxconn' option.
+A number of simulatineous connections per service is limited by 'maxconn' option.
-The default maxconn value since 3proxy 0.8 is 500. You may want to set 'maxconn'
+Default maxconn value since 3proxy 0.8 is 500. You may want to set 'maxconn'
-to a higher value. Under this configuration:
+to higher value. Under this configuration:
 <pre>
 maxconn 1000
 proxy -p3129
@@ -14,53 +14,53 @@ proxy -p3128
 socks
 </pre>
 maxconn for every service is 1000, and there are 3 services running
-(2 proxy and 1 socks), so for all services there can be up to 3000
+(2 proxy and 1 socks), so, for all services there can be up to 3000
-simultaneous connections to 3proxy.
+simulatineous connections to 3proxy.
-<p>Avoid setting 'maxconn' to an arbitrarily high value; it should be carefully
+<p>Avoid setting 'maxconn' to arbitrary high value, it should be carefully
-chosen to protect the system and proxy from resource exhaustion. Setting maxconn
+choosen to protect system and proxy from resources exhaution. Setting maxconn
-above available resources can lead to denial of service conditions.
+above resources available can lead to denial of service conditions.
-<h4>Understanding Resource Requirements</h4>
+<h4>Understanding resources requirements</h4>
-Each running service requires:
+Each running service require:
 <ul>
-<li>1 thread (process)
+<li>1*thread (process)
-<li>1 socket (file descriptor)
+<li>1*socket (file descriptor)
 <li>1 stack memory segment + some heap memory, ~64K-128K depending on the system
 </ul>
-Each connected client requires:
+Each connected client require:
 <ul>
-<li>1 thread (process)
+<li>1*thread (process)
-<li>2 sockets (file descriptors). For FTP, 4 sockets are required.
+<li>2*socket (file descriptor). For FTP 4 sockets are required. 
-<br>Under Linux since 0.9, splice() is used. It's much more efficient but requires
+<br>Under linux since 0.9 splice() is used. It's much more effective, but requires
-<br>2 sockets (file descriptors) + 2 pipes (file descriptors) = 4 file descriptors.
+<br>2*socket (file descriptor) + 2*pipe (file descriptors) = 4 file descriptors.
-<br>For FTP with splice(), 4 sockets and 2 pipes are required.
+<br>For FTP 4 sockets and 2 pipes are required with splice().
-<br>Up to 128K (up to 256K in the case of splice()) of kernel buffer memory. This is the theoretical maximum; actual numbers depend on connection quality and traffic amount.
+<br>Up to 128K (up to 256K in the case of splice()) of kernel buffers memory. This is theoretical maximum, actual numbers depend on connection quality and traffic amount.
 <br>1 additional socket (file descriptor) during name resolution for non-cached names
 <br>1 additional socket during authentication or logging for RADIUS authentication or logging.
-<li>1 ephemeral port (3 ephemeral ports for FTP connections).
+<li>1*ephemeral port (3*ephemeral ports for FTP connection).
-<li>1 stack memory segment of ~32K-128K depending on the system + at least 16K and up to a few MB (for 'proxy' and 'ftppr') of heap memory. If you are short on memory, prefer 'socks' over 'proxy' and 'ftppr'.
+<li>1 stack memory segment of ~32K-128K depending on the system + at least 16K and up to few MB (for 'proxy' and 'ftppr') of heap memory. If you are short of memory, prefer 'socks' to 'proxy' and 'ftppr'.
-<li>Many system buffers, especially in the case of slow network connections.
+<li>a lot of system buffers, specially in the case of slow network connections.
 </ul>
 Also, additional resources like system buffers are required for network activity.
 
 <h4>Setting ulimits</h4>
 
 Hard and soft ulimits must be set above calculated requirements. Under Linux, you can
-check the limits of a running process with
+check limits of running process with
 <pre>
 cat /proc/PID/limits
 </pre>
-where PID is the process ID.
+where PID is a pid of the process. 
-Validate that ulimits match your expectations, especially if you run 3proxy under a dedicated account
+Validate ulimits match your expectation, especially if you run 3proxy under dedicated account
-by adding, e.g.:
+by adding e.g.
 <pre>
 system "ulimit -Ha >>/tmp/3proxy.ulim.hard"
 system "ulimit -Sa >>/tmp/3proxy.ulim.soft"
 </pre>
-at the beginning (before the first service is started) and at the end of the config file.
+in the beginning (before first service started) and the end of config file.
-Perform both a hard restart (i.e., kill and start the 3proxy process) and a soft restart
+Make both hard restart (that is kill and start 3proxy process) and soft restart
-by sending SIGUSR1 to the 3proxy process; check that the ulimits recorded to files match your
+by sending SIGUSR1 to 3proxy process, check ulimits recorded to files match your
-expectations. In systemd-based distros (e.g., latest Debian/Ubuntu), changing limits.conf
+expecation. In systemd based distros (e.g. latest Debian / Ubuntu) changing limits.conf
-is not enough; limits must be adjusted in the systemd configuration, e.g., by setting:
+is not enough, limits must be ajusted in systemd configuration, e.g. by setting
 <pre>
 DefaultLimitDATA=infinity
 DefaultLimitSTACK=infinity
@@ -73,51 +73,51 @@ DefaultLimitMEMLOCK=infinity
 </pre>
 in user.conf / system.conf
 
-<h4>Extending System Limitations</h4>
+<h4>Extending system limitation</h4>
 
-Check the manuals/documentation for your system's limitations, e.g., the system-wide limit for the number of open files
+Check manuals / documentation for your system limitations e.g. system-wide limit for number of open files
 (fs.file-max in Linux). You may need to change sysctls or even rebuild the kernel from source.
 <p>
-To help with socket-based system-dependent settings, since 0.9-devel, 3proxy supports different
+To help with socket-based system-dependant settings, since 0.9-devel 3proxy supports different
-socket options which can be set via the -ol option for the listening socket, -oc for the proxy-to-client
+socket options which can be set via -ol option for listening socket, -oc for proxy-to-client
-socket, and -os for the proxy-to-server socket. Example:
+socket and -os for proxy-to-server socket. Example:
 <pre>
 proxy -olSO_REUSEADDR,SO_REUSEPORT -ocTCP_TIMESTAMPS,TCP_NODELAY -osTCP_NODELAY
 </pre>
-Available options are system-dependent.
+available options are system dependant.
 
-<h4>Using 3proxy in a Virtual Environment</h4>
+<h4>Using 3proxy in virtual environment</h4>
 
-If 3proxy is used in a VPS environment, there can be additional limitations.
+If 3proxy is used in VPS environment, there can be additional limitations. 
-For example, kernel resources, system CPU usage, and IOCTLs can be limited differently, and this can become a bottleneck.
+For example, kernel resources / system CPU usage / IOCTLs can be limited in a different way, and this can become a bottleneck. 
-Since 0.9-devel, 3proxy uses splice() by default on Linux. splice() prevents network traffic from being copied from
+Since 0.9 devel, 3proxy uses splice() by default on Linux, splice() prevents network traffic from being copied from
-kernel space to the 3proxy process and generally increases throughput, especially in the case of high-volume traffic. This is especially
+kernel space to 3proxy process and generally increases throughput, epecially in the case of high volume traffic. It especially
-true for virtual environments (it can improve throughput up to 10 times) unless there are additional kernel limitations.
+true for virtual environment (it can improve thoughput up to 10 times) unless there are additional kernel limitations.
-Since some work is moved to the kernel, it requires up to 2 times more kernel resources in terms of CPU, memory, and IOCTLs.
+Since some work is moved to kernel, it requires up to 2 times more kernel resources in terms of CPU, memory and IOCTLs.
-If your hosting additionally limits kernel resources (you can see this as nearly 100% CPU usage without any real CPU activity for
+If your hosting additionally limits kernel resources (you can see it as nearly 100% CPU usage without any real CPU activity for
-any application performing IOCTLs), use the -s0 option to disable splice() usage for a given service, e.g.:
+any application which performs IOCTLS), use -s0 option to disable splice() usage for given service e.g.
 <pre> 
 socks -s0
 </pre>
 
-<h4>Extending the Ephemeral Port Range</h4>
+<h4>Extending ephemeral port range</h4>
 
-Check the ephemeral port range for your system and extend it to the number of
+Check ephemeral port range for your system and extend it to the number of the
 ports required.
-The ephemeral range is always limited to the maximum number of ports (64K). To extend the
+Ephimeral range is always limited to maximum number of ports (64K). To extend the
-number of outgoing connections above this limit, extending the ephemeral port range
+number of outgoing connections above this limit, extending ephemeral port range
-is not enough; you need additional actions:
+is not enough, you need additional actions:
 <ol>
 <li> Configure multiple outgoing IPs
-<li> Make sure 3proxy is configured to use a different outgoing IP by either setting
+<li> Make sure 3proxy is configured to use different outgoing IP by either setting
-the external IP via RADIUS:
+external IP via RADIUS
 <pre>
 radius secret 1.2.3.4
 auth radius
 proxy
 </pre>
 or by using multiple services with different external
-interfaces, for example:
+interfaces, example:
 <pre>
 allow user1,user11,user111
 proxy -p1111 -e1.1.1.1
@@ -133,7 +133,7 @@ proxy -p4444 -e4.4.4.4
 flush
 </pre>
 or via "parent extip" rotation,
-e.g.:
+e.g.
 <pre>
 allow user1,user11,user111
 parent 1000 extip 1.1.1.1 0
@@ -156,8 +156,8 @@ socks
 </pre>
 <pre>
 </pre>
-Under the latest Linux versions, you can also start multiple services with different
+Under latest Linux version you can also start multiple services with different
-external addresses on a single port with SO_REUSEPORT on the listening socket to
+external addresses on the single port with SO_REUSEPORT on listening socket to
 evenly distribute incoming connections between outgoing interfaces:
 <pre>
 socks -olSO_REUSEPORT -p3128 -e 1.1.1.1
@@ -165,136 +165,136 @@ socks -olSO_REUSEPORT -p3128 -e 2.2.2.2
 socks -olSO_REUSEPORT -p3128 -e 3.3.3.3
 socks -olSO_REUSEPORT -p3128 -e 4.4.4.4
 </pre>
-For web browsing, the last two examples are not recommended because the same client can get
+for Web browsing last two examples are not recommended, because same client can get
-a different external address for different requests; you should choose the external
+different external address for different requests, you should choose external
 interface with user-based rules instead.
-<li> You may need additional system-dependent actions to use the same port on different IPs,
+<li> You may need additional system dependant actions to use same port on different IPs,
-usually by adding the SO_REUSEADDR (SO_PORT_SCALABILITY for Windows) socket option to
+usually by adding SO_REUSEADDR (SO_PORT_SCALABILITY for Windows) socket option to
-the external socket. This option can be set (since 0.9-devel) with the -os option:
+external socket. This option can be set (since 0.9 devel) with -os option:
 <pre>
 proxy -p3128 -e1.2.3.4 -osSO_REUSEADDR
 </pre>
-The behavior for SO_REUSEADDR and SO_REUSEPORT is different between different systems,
+Behavior for SO_REUSEADDR and SO_REUSEPORT is different between different system,
-even between different kernel versions, and can lead to unexpected results.
+even between different kernel versions and can lead to unexpected results.
-The specifics are described <a href="https://stackoverflow.com/questions/14388706/socket-options-so-reuseaddr-and-so-reuseport-how-do-they-differ-do-they-mean-t">here</a>.
+Specifics is described <a href="https://stackoverflow.com/questions/14388706/socket-options-so-reuseaddr-and-so-reuseport-how-do-they-differ-do-they-mean-t">here</a>.
-Use these options only if actually required and if you fully understand the possible
+Use this options only if actually required and if you fully understand possible
-consequences. For example, SO_REUSEPORT can help establish more connections than the
+consiquences. E.g. SO_REUSEPORT can help to establish more connections than the
-number of client ports available, but it can also lead to situations where connections
+number of the client port available, but it can also lead to situation connections
-randomly fail due to IP+port pair collisions if the remote or local system
+are randomely fail due to ip+port pairs collision if remote or local system 
 doesn't support this trick.
 </ol>
 
-<h4>Setting Stack Size</h4>
+<h4>Setting stacksize</h4>
 
 'stacksize' is a size added to all stack allocations and can be both positive and
-negative. Stack is required for function calls. 3proxy itself doesn't require a large
+negative. Stack is required in functions call. 3proxy itself doesn't require large
 stack, but it can be required if some
-poorly written libc, 3rd party libraries, or system functions are called. There is known
+purely-written libc, 3rd party libraries or system functions called. There is known\
 dirty code in Unix ODBC
-implementations and built-in DNS resolvers, especially in the case of IPv6 and a large
+implementations, build-in DNS resolvers, especially in the case of IPv6 and large
-number of interfaces. Under most 64-bit systems, extending stacksize will lead
+number of interfaces. Under most 64-bit system extending stacksize will lead
-to additional memory space usage but does not require actual committed memory,
+to additional memory space usage, but do not require actual commited memory,
-so you can increase stacksize to a relatively large value (e.g., 1024000) without
+so you can inrease stacksize to relatively large value (e.g. 1024000) without
-the need to add additional physical memory,
+the need to add additional phisical memory,
-but it's system/libc dependent and requires additional testing under your
+but it's system/libc dependant and requires additional testing under your
-installation. Don't forget about memory-related ulimits.
+installation. Don't forget about memory related ulimts.
-<p>For 32-bit systems, address space can be a bottleneck you should consider. If
+<p>For 32-bit systems address space can be a bottlneck you should consider. If
-you're short on address space, you can try using a negative stack size.
+you're short of address space you can try to use negative stack size.
 
-<h4>Known System Issues</h4>
+<h4>Known system issues</h4>
 
-There are known race condition issues in the Linux/glibc resolver. The probability
+There are known race condition issues in Linux / glibc resolver. The probability
-of a race condition arises under configuration with IPv6, a large number of interfaces
+of race condition arises under configuration with IPv6, large number of interfaces
-or IP addresses, or with resolvers configured. In this case, install a local recursor and
+or IP addresses or resolvers configured. In this case, install local recursor and
-use 3proxy's built-in resolver (nserver / nscache / nscache6).
+use 3proxy built-in resolver (nserver / nscache / nscache6).
-<h4>Do Not Use Public Resolvers</h4>
+<h4>Do not use public resolvers</h4>
-Public resolvers like those from Google have rate limits. For a large number of
+Public resolvers like ones from Google have ratelimits. For large number of
-requests, install a local caching recursor (ISC bind named, PowerDNS recursor, etc).
+requests install local caching recursor (ISC bind named, PowerDNS recursor, etc).
 
-<h4>Avoid Large Lists</h4>
+<h4>Avoid large lists</h4>
 
 Currently, 3proxy is not optimized to use large ACLs, user lists, etc. All lists
-are processed linearly. In the devel version, you can use RADIUS authentication to avoid
+are processed lineary. In devel version you can use RADIUS authentication to avoid
-user lists and ACLs in 3proxy itself. Also, RADIUS allows you to easily set an outgoing IP
+user lists and ACLs in 3proxy itself. Also, RADIUS allows to easily set outgoing IP
-on a per-user basis or implement more sophisticated logic.
+on per-user basis or more sophisicated logics.
-RADIUS is a new beta feature; test it before using it in production.
+RADIUS is a new beta feature, test it before using in production.
 
-<h4>Avoid Changing Configuration Too Often</h4>
+<h4>Avoid changing configuration too often</h4>
 
-Every configuration reload requires additional resources. Do not make frequent
+Every configuration reload requires additional resources. Do not do frequent
-changes, such as user addition/deletion via configuration; use alternative
+changes, like users addition/deletaion via connfiguration, use alternative
 authentication methods instead, like RADIUS.
 
-<h4>Consider Using 'noforce'</h4>
+<h4>Consider using 'noforce'</h4>
 
-The 'force' behavior (default) re-authenticates all connections after
+'force' behaviour (default) re-authenticates all connections after
-configuration reload; it may be resource-consuming with a large number of
+configuration reload, it may be resource consuming on large number of
-connections. Consider adding the 'noforce' command before services are started
+connections. Consider adding 'noforce' command before services started
-to prevent connection re-authentication.
+to prevent connections reauthentication.
 
-<h4>Do Not Monitor Configuration Files Directly</h4>
+<h4>Do not monitor configuration files directly</h4>
 
-Using a configuration file directly in 'monitor' can lead to a race condition where
+Using configuration file directly in 'monitor' can lead to race condition where
-the configuration is reloaded while the file is being written.
+configuration is reloaded while file is being written.
 To avoid race conditions:
 <ol>
 <li> Update config files only if there is no lock file
-<li> Create a lock file when the 3proxy configuration is updated, e.g., with
+<li> Create lock file then 3proxy configuration is updated, e.g. with
 "touch /some/path/3proxy/3proxy.lck". If you generate config files
-asynchronously, e.g., by a user's request via web, you should consider
+asynchronously, e.g. by user's request via web, you should consider
-implementing existence checking and file creation as an atomic operation.
+implementing existance checking and file creation as atomic operation.
-<li> Add
+<li>add
 <pre>
 system "rm /some/path/3proxy/3proxy.lck"
 </pre>
-at the end of the config file to remove it after the configuration is successfully loaded
+at the end of config file to remove it after configuration is successfully loaded
-<li> Use a dedicated version file to monitor, e.g.:
+<li> Use a dedicated version file to monitor, e.g.
 <pre>
 monitor "/some/path/3proxy/3proxy.ver"
 </pre>
-<li> After the config is updated, change the version file for 3proxy to reload the configuration,
+<li> After config is updated, change version file for 3proxy to reload configuration,
-e.g., with "touch /some/path/3proxy/3proxy.ver".
+e.g. with "touch /some/path/3proxy/3proxy.ver".
 </ol>
 
-<h4>Use TCP_NODELAY to Speed Up Connections with Small Amounts of Data</h4>
+<h4>Use TCP_NODELAY to speed-up connections with small amount of data</h4>
 
-If most requests require an exchange with a small amount of data in both directions
+If most requests require exchange with a small amount of data in a both ways
-without the need for bandwidth, e.g., messengers or small web requests,
+without the need for bandwidth, e.g. messengers or small web request,
-you can eliminate Nagle's algorithm delay with the TCP_NODELAY flag. Usage example:
+you can eliminate Nagle's algorithm delay with TCP_NODELAY flag. Usage example:
 <pre>
 proxy -osTCP_NODELAY -ocTCP_NODELAY
 </pre>
 sets TCP_NODELAY for client (oc) and server (os) connections.
-<p>Do not use TCP_NODELAY on slow connections with high delays when
+<p>Do not use TCP_NODELAY on slow connections with high delays and then
 connection bandwidth is a bottleneck.
 
-<h4>Use Splice to Speed Up Large Data Amount Transfers</h4>
+<h4>Use splice to speedup large data amount transfers</h4>
 
-splice() allows copying data between connections without copying to the process
+splice() allows to copy data between connections without copying to process
-address space. It can speed up the proxy on high-bandwidth connections if most
+addres space. It can speedup proxy on high bandwidth connections, if most
 connections require large data transfers. Splice is enabled by default on Linux
-since 0.9; "-s0" disables splice usage. Example:
+since 0.9, "-s0" disables splice usage. Example:
 <pre>
 proxy -s0
 </pre>
-Splice is only available on Linux. Splice requires more system buffers and file descriptors
+Splice is only available on Linux. Splice requires more system buffers and file descriptors,
 and produces more IOCTLs but reduces process memory and overall CPU usage.
-Disable splice if there are a lot of short-lived connections with no bandwidth
+Disable splice if there is a lot of short-living connections with no bandwidth
 requirements.
-<p>Use splice only on high-speed connections (e.g., 10GbE) when the processor, memory speed, or
+<p>Use splice only on high-speed connections (e.g. 10GBE), if processor, memory speed or
 system bus are bottlenecks.
-<p>TCP_NODELAY and splice are not contrary to each other and should be combined on
+<p>TCP_NODELAY and splice are not contrary to each over and should be combined on
 high-speed connections.
 
-<h4>Add Grace Delay to Reduce System Calls</h4>
+<h4>Add grace delay to reduce system calls<h4>
 
 <pre>proxy -g8000,3,10</pre>
-The first parameter is the average read size we want to keep, the second parameter is
+First parameter is average read size we want to keep, second parameter is
-the minimal number of packets in the same direction to apply the algorithm,
+minimal number of packets in the same direction to apply algorythm,
-and the last value is the delay added after polling and prior to reading data.
+last value is delay added after polling and prior to reading data.
-The example above adds a 10-millisecond delay before reading data if the average
+An example above adds 10 millisecond delay before reading data if average
-polling size is below 8000 bytes and 3 read operations have been made in the same
+polling size is below 8000 bytes and 3 read operations are made in the same
-direction. It's especially useful with splice. <pre>logdump 1 1</pre> is useful
+direction. It's specially usefule with splice. <pre>logdump 1 1</pre> is useful
-to see how grace delays work; choose a delay value to avoid filling the read
+to see how grace delays work, choose delay value to avoid filling the read
-pipe/buffer (typically 64K) but keep the request sizes close to the chosen average
+pipe/buffer (typically 64K) but keep the request sizes close to chosen average
-on large file uploads/downloads.
+on large file upload/download.

doc/html/howtor.html

@@ -219,7 +219,7 @@
     <li>Служба уже установлена или запущена
   </ul>
   </p>
-  <li><a name="INTEXT">Как разобраться с internal и external</a></li>
+  <li><a name="INTEXT">Как разобраться с internal и external</a></li></li>
   <p>
   Убедитесь, что выправильно понимаете что такое internal и external адреса.
   Оба адреса - это адреса, принадлежищие хосту, на котором установлен 3proxy.

doc/html/index.html

@@ -3,7 +3,7 @@
 <a href="highload.html">Optimizing 3proxy for high loads</a><br> 
 <a href="howtoe.html">How To (English, very incomplete)</a><br> 
 <a href="howtor.html">How To (Russian)</a><br> 
-<h3>Man pages:</h3>
+<h3>Man pages:</h> 
 <br><A HREF="man8/3proxy.8.html">3proxy.8</A> 
 <br><A HREF="man8/ftppr.8.html">ftppr.8</A> 
 <br><A HREF="man8/pop3p.8.html">pop3p.8</A> 

doc/html/plugins/PCREPlugin.html

@@ -1,9 +1,9 @@
 
-<h3>3proxy Perl Compatible Regular Expressions (PCRE) Plugin</h3>
+<h3>3proxy Perl Compatible Regular Expressions (PCRE) plugin</h3>
 
-This filtering plugin can be used to create matching and replacement
+This filtering plugin can be used to create matching and replace
-rules with regular expressions for client requests, client and
+rules with regular expressions for client's request, client and
-server headers, and client and server data. It adds 3 additional
+servers header and client and server data. It adds 3 additional
 configuration commands:
 
 <pre>
@@ -12,11 +12,11 @@ pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE]
 pcre_extend FILTER_ACTION [ACE]
 pcre_options OPTION1 [...]
 </pre>
-pcre - allows applying a rule for matching
+pcre - allows to apply some rule for matching
-<br>pcre_rewrite - in addition to 'pcre', allows substituting substrings
+<br>pcre_rewrite - in addition to 'pcre' allows to substitute substrings
-<br>pcre_extend - extends the ACL of the last pcre or pcre_rewrite command by
+<br>pcre_extend - extends ACL of the last pcre or pcre_rewrite comand by
-adding an additional ACE (like with allow/deny configuration commands).
+adding additional ACE (like with allow/deny configuration commands).
-<br>pcre_options - allows setting matching options. Available options are:
+<br>pcre_options - allows to set matching options. Awailable options are:
 PCRE_CASELESS,
 PCRE_MULTILINE,
 PCRE_DOTALL,
@@ -47,31 +47,32 @@ PCRE_BSR_UNICODE
 
 <ul>
 <li>TYPE - type of filtered data. May contain one or more
-(comma-delimited list) values:
+(comma delimited list) values:
  <ul>
- <li>request - content of the client's request, e.g., the HTTP GET request string.
+ <li>request - content of client's request e.g. HTTP GET request string.
-(known problem: changing the request string doesn't change the IP of the host to connect to)
+(known problem: changing request string doesn't change IP of the host to connect)
- <li>cliheader - content of the client request headers, e.g., HTTP request headers.
+ <li>cliheader - content of client request headers,  e.g. HTTP request header.
- <li>srvheader - content of the server's reply headers, e.g., HTTP status and headers.
+ <li>srvheader - content of server's reply headers, e.g. HTTP status and headers.
- <li>clidata - data received from the client, e.g., HTTP POST request data
+ <li>clidata - data received from client, e.g. HTTP POST request data
- <li>srvdata - data received from the server, e.g., an HTML page
+ <li>srvdata - data received from server, e.g. HTML page
  </ul>
 <li>FILTER_ACTION - action on match
- <ul><li>allow - allow this request without checking the rest of the rules for the given type
+ <ul>allow - allow this request without checking rest of the given type
- <li>deny - deny this request without checking the rest of the rules
+of the rules
- <li>dunno - continue with the rest of the rules (useful with pcre_rewrite)
+ <li>deny - deny this request without checking rest of the rules
+ <li>dunno - continue with the rest of rules (useful with pcre_rewrite) 
  </ul>
-<li>REGEXP - PCRE (Perl) regular expression. Use * if no regexp matching
+<li>REGEXP - PCRE (perl) regular expression. Use * if no regexp matching
-is required.
+required.
-<li>REWRITE_EXPRESSION - substitution string. May contain Perl-style
+<li>REWRITE_EXPRESSION - substitution string. May contain perl-style
 substrings
-(not tested) $1, $2. $0 means the whole matched string. \r and \n may be used
+(not tested) $1, $2. $0 - means whole matched string. \r and \n may be used
-to insert new strings; the string may be empty ("").
+to insert new strings, string may be empty ("").
 <li>ACE - access control entry (user names, source IPs, destination IPs,
-ports, etc.), absolutely identical to allow/deny/bandlimin commands.
+ports, etc), absolutely identical to allow/deny/bandlimin commands.
-The regular expression is only matched if the ACL matches the connection data.
+Regular expression is only matched if ACL matches connection data.
 Warning:
-Regular expressions don't require authentication and cannot replace
+reqular expression doesn't require authentication and can not replace
 authentication and/or allow/deny ACLs.
 </ul>
 
@@ -87,7 +88,7 @@ pcre_extend deny * 192.168.0.1/16
 
 <h4>Download:</h4>
 <ul>
- <li>Plugin is included in the 3proxy 0.6 binary and source distribution
+ <li>Plugin is included into 3proxy 0.6 binary and source distribution
  <li>Example configuration (by Dennis Garber): <A HREF="NoPornLitest.cfg.txt">NoPornLitest.cfg</A>
-</li></ul>
+</ul>
 

doc/html/plugins/PCREPlugin.ru.html

@@ -56,7 +56,7 @@ PCRE_BSR_UNICODE
  <li>srvdata - данные полученные от сервера, например содержимое HTML-страницы
  </ul>
 <li>FILTER_ACTION - действие при совпадении. Может принимать значение
- <ul><li>allow - разрешить данный запрос без просмотра дальнейших правил
+ <ul>allow - разрешить данный запрос без просмотра дальнейших правил
  <li>deny - запретить данный запрос без просмотра дальнейших правил
  <li>dunno - продолжить анализ правил (полезно для pcre_rewrite) 
  </ul>
@@ -87,4 +87,4 @@ pcre_extend deny * 192.168.0.1/16
 <ul>
  <li>Плагин включен в дистрибутив 3proxy 0.6
  <li>Пример конфигурации (by Dennis Garber): <A HREF="NoPornLitest.cfg.txt">NoPornLitest.cfg</A>
-</li></ul>
+</ul>

doc/html/plugins/SSLPlugin.html

@@ -1,61 +1,45 @@
-<h3>3proxy SSL/TLS Plugin</h3>
+<h3>3proxy SSL/TLS plugin</h3>
 
-This plugin can be used to transparently decrypt SSL/TLS data, provide TLS encryption for proxy traffic, and authenticate using client certificates.
+Plugin can be used to transparently decypher SSL/TLS data and TLS encryption for  proxy traffic.
 
-<h4>For transparent certificate spoofing (MITM):</h4>
+
+
+<h4>For transparent certificate spoofing:</h4>
 
 <br>ssl_mitm - spoof certificates for services started below. Usage without ssl_client_verify is insecure.
 <br>ssl_nomitm - do not spoof certificates for services started below
 
-<h4>To protect traffic to the server (https:// proxy):</h4>
+<h4>To protect traffic to server (https:// proxy) - since 0.9.5 version</h4>
+ssl_serv - require TLS connection for services below
+<br>ssl_noserv - do not require TLS connection for services below
 
-ssl_serv (or ssl_server) - require TLS connection from clients for services below
+Parameters:
-<br>ssl_noserv (or ssl_noserver) - do not require TLS connection from clients for services below
+<br>ssl_server_cert /path/to/cert - Server certificate (should not be selfsigned and must contain Alternative name) for ssl_serv
-
+<br>ssl_server_key /path/to/key - Server ceritifacte key for ssl_server_cert or generated mitm certificate
-<h4>To use TLS for upstream connections:</h4>
+<br>ssl_client_ciphersuites ciphersuites_list - TLS client ciphers for TLS 1.3, e.g. ssl_client_ciphersuites TLS_AES_128_GCM_SHA256
-
+<br>ssl_server_ciphersuites ciphersuites_list - TLS server ciphers for TLS 1.3
-ssl_cli (or ssl_client) - establish TLS connection to upstream server for services below
+<br>ssl_client_cipher_list ciphersuites_list - TLS client ciphers for TLS 1.2 and below , e.g. ssl_client_cipher_list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
-<br>ssl_nocli (or ssl_noclient) - do not establish TLS connection to upstream server for services below
+<br>ssl_server_cipher_list ciphersuites_list - TLS server ciphers for TLS 1.2 and below
-
+<br>ssl_client_min_proto_version tls_version - TLS client min TLS version (e.g. TLSv1.2)
-<h4>Parameters:</h4>
+<br>ssl_server_min_proto_version tls_version - TLS server min TLS version (e.g. TLSv1.2)
-
+<br>ssl_client_max_proto_version tls_version - TLS client max TLS version (e.g. TLSv1.2)
-<br><b>ssl_server_cert</b> /path/to/cert - Server certificate (should not be self-signed and must contain an Alternative Name) for ssl_serv
+<br>ssl_server_max_proto_version tls_version - TLS server max TLS version (e.g. TLSv1.2)
-<br><b>ssl_server_key</b> /path/to/key - Server certificate key for ssl_server_cert or generated MITM certificate
+<br>ssl_client_verify - verify certificate for upstream server in TLS client functionality (used with ssl_mitm)
-<br><b>ssl_client_cert</b> /path/to/cert - Client certificate for authentication on upstream server (used with ssl_cli)
+<br>ssl_client_no_verify - do not verify certificate for upstream server in TLS client functionality (default)
-<br><b>ssl_client_key</b> /path/to/key - Client certificate key for ssl_client_cert
+<br>ssl_server_ca_file /path/to/cafile - CA certificate file for mitm
-<br><b>ssl_client_ciphersuites</b> ciphersuites_list - TLS client ciphers for TLS 1.3, e.g., ssl_client_ciphersuites TLS_AES_128_GCM_SHA256
+<br>ssl_server_ca_key /path/to/cakey - key for ssl_server_ca_file mitm CA
-<br><b>ssl_server_ciphersuites</b> ciphersuites_list - TLS server ciphers for TLS 1.3
+<br>ssl_client_ca_file, ssl_client_ca_dir, ssl_client_ca_store - locations for root CAs used with ssl_client_verify for TLS client
-<br><b>ssl_client_cipher_list</b> ciphers_list - TLS client ciphers for TLS 1.2 and below, e.g., ssl_client_cipher_list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+<br>ssl_certcache /path/to/cache/ - location for generated mitm certificates cache, optional, if ssl_server_ca_file / ssl_server_ca_key are configured.
-<br><b>ssl_server_cipher_list</b> ciphers_list - TLS server ciphers for TLS 1.2 and below
+Cache may contain 3 files: 3proxy.pem - public
-<br><b>ssl_client_min_proto_version</b> tls_version - TLS client minimum TLS version (e.g., TLSv1.2)
-<br><b>ssl_server_min_proto_version</b> tls_version - TLS server minimum TLS version (e.g., TLSv1.2)
-<br><b>ssl_client_max_proto_version</b> tls_version - TLS client maximum TLS version (e.g., TLSv1.2)
-<br><b>ssl_server_max_proto_version</b> tls_version - TLS server maximum TLS version (e.g., TLSv1.2)
-<br><b>ssl_client_verify</b> - verify the certificate for the upstream server in TLS client functionality (used with ssl_mitm or ssl_cli)
-<br><b>ssl_client_no_verify</b> - do not verify the certificate for the upstream server in TLS client functionality (default)
-<br><b>ssl_server_verify</b> - require client certificate authentication (mTLS) for ssl_serv
-<br><b>ssl_server_no_verify</b> - do not require client certificate (default)
-<br><b>ssl_server_ca_file</b> /path/to/cafile - CA certificate file for MITM
-<br><b>ssl_server_ca_key</b> /path/to/cakey - key for ssl_server_ca_file MITM CA
-<br><b>ssl_server_ca_dir</b> /path/to/cadir - CA directory for ssl_server_verify
-<br><b>ssl_server_ca_store</b> /path/to/castore - CA store for ssl_server_verify (OpenSSL 3.0+)
-<br><b>ssl_client_ca_file</b> /path/to/cafile - CA file for ssl_client_verify
-<br><b>ssl_client_ca_dir</b> /path/to/cadir - CA directory for ssl_client_verify
-<br><b>ssl_client_ca_store</b> /path/to/castore - CA store for ssl_client_verify (OpenSSL 3.0+)
-<br><b>ssl_client_sni</b> hostname - SNI hostname to send to upstream server (overrides the requested hostname)
-<br><b>ssl_client_alpn</b> protocol1 protocol2 ... - ALPN protocols to negotiate with upstream server (e.g., ssl_client_alpn h2 http/1.1)
-<br><b>ssl_client_mode</b> mode - when to establish TLS connection: 0 - on connect (default), 1 - after authentication, 2 - before data
-<br><b>ssl_certcache</b> /path/to/cache/ - location for the generated MITM certificates cache, optional if ssl_server_ca_file / ssl_server_ca_key are configured.
-The cache may contain 3 files: 3proxy.pem - public
 self-signed certificates (used if ssl_server_ca_file is not configured), 
-3proxy.key - key for public certificates, used if ssl_server_ca_key is not configured, server.key - this key is used if ssl_server_key is not configured to generate
+3proxy.key - key for public certificates, used if ssl_server_ca_keyserver.key is not configured, server.key - this key is used if ssl_server_key is not configured to generates
 spoofed certificates. If server.key is absent, 3proxy.key is used to generate certificates.
-Generated certificates are placed in the same path.
+Generated certificates are placed to the same path.
 
 
-<h4>MITM example:</h4>
+<h4>mitm example:</h4>
 <pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
+plugin /path/to/SslPlugin.dll ssl_plugin
 ssl_server_ca_file /path/to/cafile
 ssl_server_ca_key /path/to/cakey
 ssl_mitm
@@ -63,7 +47,7 @@ proxy -p3128
 ssl_nomitm
 proxy -p3129
 </pre>
-MITM's traffic with a spoofed certificate for the port 3128 proxy.
+mitm's traffic with spoofed ceritifacate for port 3128 proxy.
 
 <h4>https:// proxy example:</h4>
 <pre>
@@ -75,30 +59,6 @@ proxy -p33128
 ssl_noserv
 proxy -p3128
 </pre>
-Creates an https:// proxy on port 33128 and an http:// proxy on port 3128
+creates https:// proxy on 33128 and http:// proxy on 3128
-
-<h4>TLS client example (connect to upstream via TLS):</h4>
-<pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
-ssl_client_cert /path/to/client.crt
-ssl_client_key /path/to/client.key
-ssl_client_verify
-ssl_client_ca_file /path/to/ca.crt
-ssl_cli
-proxy -p3128
-</pre>
-Creates an HTTP proxy that connects to upstream servers via TLS with client certificate authentication.
-
-<h4>mTLS example (require client certificate):</h4>
-<pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
-ssl_server_cert /path/to/server.crt
-ssl_server_key /path/to/server.key
-ssl_server_ca_file /path/to/ca.crt
-ssl_server_verify
-ssl_serv
-proxy -p3128
-</pre>
-Creates an https:// proxy that requires client certificate authentication.
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/SSLPlugin.ru.html

@@ -1,58 +1,41 @@
 <h3>3proxy SSL/TLS плагин</h3>
 
-Плагин можно использовать для перехвата и дешифровки SSL/TLS трафика, для шифрования трафика прокси-сервера и аутентификации с помощью клиентских сертификатов.
+Плагин можно использовать для перехвата и дешифровки SSL/TLS трафика и для шифрования трафика прокси-сервера
 
-<h4>Для прозрачного перехвата трафика (MITM):</h4>
+<h4>Для транспаретной перехватки трафика (mitm):</h4>
 
-<br>ssl_mitm - подменять сертификаты для сервисов, запущенных ниже. Использование без ssl_client_verify небезопасно.
+<br>ssl_mitm - подменять сертификаты для сервисов стартованных ниже. Не безопасно использовать без ssl_client_verify.
-<br>ssl_nomitm - не подменять сертификаты для сервисов, запущенных ниже.
+<br>ssl_nomitm - не подменять сертификаты для сервисов стартованных ниже.
 
-<h4>Для защиты трафика прокси-сервера (https:// proxy):</h4>
 
-ssl_serv (или ssl_server) - требовать TLS-соединение от клиентов для сервисов, запущенных ниже
+<h4>Для защиты трафика прокси-сервера (например https:// proxy) - начиная с 0.9.5</h4>
-<br>ssl_noserv (или ssl_noserver) - не требовать TLS-соединение от клиентов для сервисов, запущенных ниже
+ssl_serv - включает TLS для соединений к сервисам ниже
+<br>ssl_noserv - отключает TLS для соединений к сервисам ниже
 
-<h4>Для использования TLS при соединении к вышестоящему серверу:</h4>
+Параметры:
-
+<br>ssl_server_cert /path/to/cert - сертификат сервера, не должен быть самоподписаным, имя CN должно содержаться в альтернативных именах - используется для ssl_serv
-ssl_cli (или ssl_client) - устанавливать TLS-соединение к вышестоящему серверу для сервисов, запущенных ниже
+<br>ssl_server_key /path/to/key - ключ сертификата сервера для ssl_server_cert или сгенерированного сертификата ssl_mitm
-<br>ssl_nocli (или ssl_noclient) - не устанавливать TLS-соединение к вышестоящему серверу для сервисов, запущенных ниже
+<br>ssl_client_ciphersuites ciphersuites_list - наборы шифрова TLS для TLS 1.3, пример ssl_client_ciphersuites TLS_AES_128_GCM_SHA256
-
+<br>ssl_server_ciphersuites ciphersuites_list - наборы шифрова TLS для TLS 1.3
-<h4>Параметры:</h4>
+<br>ssl_client_cipher_list ciphersuites_list - наборы шифрова TLS для TLS 1.2 и ниже, пример ssl_client_cipher_list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
-
+<br>ssl_server_cipher_list ciphersuites_list - наборы шифрова TLS для TLS 1.2 и ниже
-<br><b>ssl_server_cert</b> /path/to/cert - сертификат сервера (не должен быть самоподписанным, должен содержать альтернативные имена) для ssl_serv
+<br>ssl_client_min_proto_version tls_version - минимальная версия TLS клиента (например ssl_client_min_proto_version TLSv1.2)
-<br><b>ssl_server_key</b> /path/to/key - ключ сертификата сервера для ssl_server_cert или сгенерированного MITM-сертификата
+<br>ssl_server_min_proto_version tls_version - минимальная версия TLS сервера
-<br><b>ssl_client_cert</b> /path/to/cert - клиентский сертификат для аутентификации на вышестоящем сервере (используется с ssl_cli)
+<br>ssl_client_max_proto_version tls_version - максимальная версия TLS клиента
-<br><b>ssl_client_key</b> /path/to/key - ключ клиентского сертификата для ssl_client_cert
+<br>ssl_server_max_proto_version tls_version - максимальная версия TLS сервера
-<br><b>ssl_client_ciphersuites</b> ciphersuites_list - наборы шифров TLS для TLS 1.3 (клиент), пример: ssl_client_ciphersuites TLS_AES_128_GCM_SHA256
+<br>ssl_client_verify - проверять сертификат сервера назначения (используется с ssl_mitm)
-<br><b>ssl_server_ciphersuites</b> ciphersuites_list - наборы шифров TLS для TLS 1.3 (сервер)
+<br>ssl_client_no_verify - не проверять сертификат сервера назначения
-<br><b>ssl_client_cipher_list</b> ciphers_list - наборы шифров TLS для TLS 1.2 и ниже (клиент), пример: ssl_client_cipher_list ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+<br>ssl_server_ca_file /path/to/cafile - CA сертификат для ssl_mitm
-<br><b>ssl_server_cipher_list</b> ciphers_list - наборы шифров TLS для TLS 1.2 и ниже (сервер)
+<br>ssl_server_ca_key /path/to/cakey - ключ CA сертификата  ssl_server_ca_file mitm
-<br><b>ssl_client_min_proto_version</b> tls_version - минимальная версия TLS клиента (например, ssl_client_min_proto_version TLSv1.2)
+<br>ssl_client_ca_file, ssl_client_ca_dir, ssl_client_ca_store - расположения корневых сертификатов ssl_client_verify
-<br><b>ssl_server_min_proto_version</b> tls_version - минимальная версия TLS сервера
+<br>ssl_certcache /path/to/cache/ - расположение кеша сгенерированных сертификатов ssl_mitm. Кеш может содержать
-<br><b>ssl_client_max_proto_version</b> tls_version - максимальная версия TLS клиента
+файлы 3proxy.pem, 3proxy.key server.key, которые используются как ssl_server_ca_file,
-<br><b>ssl_server_max_proto_version</b> tls_version - максимальная версия TLS сервера
+ssl_server_ca_key и ssl_server_key соответственно если они не заданы. Если server.key не задан,
-<br><b>ssl_client_verify</b> - проверять сертификат вышестоящего сервера (используется с ssl_mitm или ssl_cli)
-<br><b>ssl_client_no_verify</b> - не проверять сертификат вышестоящего сервера (по умолчанию)
-<br><b>ssl_server_verify</b> - требовать клиентский сертификат (mTLS) для ssl_serv
-<br><b>ssl_server_no_verify</b> - не требовать клиентский сертификат (по умолчанию)
-<br><b>ssl_server_ca_file</b> /path/to/cafile - файл CA-сертификата для MITM
-<br><b>ssl_server_ca_key</b> /path/to/cakey - ключ CA-сертификата ssl_server_ca_file для MITM
-<br><b>ssl_server_ca_dir</b> /path/to/cadir - директория CA-сертификатов для ssl_server_verify
-<br><b>ssl_server_ca_store</b> /path/to/castore - хранилище CA-сертификатов для ssl_server_verify (OpenSSL 3.0+)
-<br><b>ssl_client_ca_file</b> /path/to/cafile - файл CA-сертификатов для ssl_client_verify
-<br><b>ssl_client_ca_dir</b> /path/to/cadir - директория CA-сертификатов для ssl_client_verify
-<br><b>ssl_client_ca_store</b> /path/to/castore - хранилище CA-сертификатов для ssl_client_verify (OpenSSL 3.0+)
-<br><b>ssl_client_sni</b> hostname - SNI-имя хоста для отправки вышестоящему серверу (переопределяет запрошенное имя хоста)
-<br><b>ssl_client_alpn</b> протокол1 протокол2 ... - ALPN-протоколы для согласования с вышестоящим сервером (например, ssl_client_alpn h2 http/1.1)
-<br><b>ssl_client_mode</b> режим - когда устанавливать TLS-соединение: 0 - при подключении (по умолчанию), 1 - после аутентификации, 2 - перед передачей данных
-<br><b>ssl_certcache</b> /path/to/cache/ - расположение кеша сгенерированных MITM-сертификатов. Кеш может содержать
-файлы 3proxy.pem, 3proxy.key, server.key, которые используются как ssl_server_ca_file,
-ssl_server_ca_key и ssl_server_key соответственно, если они не заданы. Если server.key не задан,
 3proxy.key используется для генерации серверного сертификата.
 
-<h4>Пример MITM:</h4>
+<h4>Пример mitm:</h4>
 <pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
+plugin /path/to/SslPlugin.dll ssl_plugin
 ssl_server_ca_file /path/to/cafile
 ssl_server_ca_key /path/to/cakey
 ssl_mitm
@@ -60,9 +43,9 @@ proxy -p3128
 ssl_nomitm
 proxy -p3129
 </pre>
-Перехватывается трафик в прокси на порту 3128.
+Перехватывается трафик в прокси на порту 3128
 
-<h4>Пример конфигурации https:// прокси:</h4>
+<h4>Пример конфигурации https:// прокси (curl -x https://...):</h4>
 <pre>
 plugin /path/to/SSLPlugin.so ssl_plugin
 ssl_server_cert path_to_cert
@@ -72,30 +55,7 @@ proxy -p33128
 ssl_noserv
 proxy -p3128
 </pre>
-На порту 33128 создается https:// прокси, на порту 3128 - http:// прокси.
+На порту 33128 создается https:// прокси (не путать с CONNECT прокси aka HTTPS over HTTP прокси), на порту 3128
-
+создается http:// прокси (может пропуска в т.ч. и HTTPS коннекты)
-<h4>Пример TLS-клиента (соединение к вышестоящему серверу через TLS):</h4>
-<pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
-ssl_client_cert /path/to/client.crt
-ssl_client_key /path/to/client.key
-ssl_client_verify
-ssl_client_ca_file /path/to/ca.crt
-ssl_cli
-proxy -p3128
-</pre>
-Создается HTTP-прокси, который соединяется с вышестоящими серверами через TLS с аутентификацией по клиентскому сертификату.
-
-<h4>Пример mTLS (требование клиентского сертификата):</h4>
-<pre>
-plugin /path/to/SSLPlugin.so ssl_plugin
-ssl_server_cert /path/to/server.crt
-ssl_server_key /path/to/server.key
-ssl_server_ca_file /path/to/ca.crt
-ssl_server_verify
-ssl_serv
-proxy -p3128
-</pre>
-Создается https:// прокси, требующий аутентификацию по клиентскому сертификату.
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/StringsPlugin.html

@@ -1,16 +1,16 @@
 
-<h3>3proxy Strings Substitution Plugin</h3>
+<h3>3proxy strings substitution plugin</h3>
-This may be used to make the interface more attractive or to translate proxy server
+May be used to make interface more pretty or to translate proxy server
-messages to a different language. All messages are taken from proxy.c and
+messages to different language. All messages are taken from proxy.c and
-moved to an external text file (e.g., rus.3ps). At the time of
+moved to external text file (e.g. rus.3ps). On the moment of
-writing, there are 15 sections. Sections are delimited with "[end]".
+writing there are 15 sections. Sections are delimited with "[end]".
 <h4>Example:</h4>
 <pre>plugin "StringsPlugin.dll" start c:\3proxy\bin\rus.3ps
 </pre>
 
 <h4>Download:</h4>
 <ul>
- <li>Plugin is included in the 3proxy 0.6 binary and source distribution
+ <li>Plugin is included into 3proxy 0.6 binary and source distribution
 </li></ul>
 
-&copy; Kirill Lopuchov
+©Kirill Lopuchov

doc/html/plugins/StringsPlugin.ru.html

@@ -15,4 +15,4 @@ plugin "StringsPlugin.dll" start c:\3proxy\bin\rus-win1251.3ps
 <h4>Загрузить:</h4>
 <ul>
  <li>Плагин включен в дистрибутив 3proxy 0.6
-</li></ul>
+</ul>

doc/html/plugins/TrafficPlugin.html

@@ -1,15 +1,15 @@
-<h3>3proxy Traffic Correction Plugin</h3>
+<h3>3proxy traffic correction plugin</h3>
-3proxy logs and counts traffic at the application level, while providers usually do
+3proxy logs and counts traffic on application level, while provider usually does
-so at the network or link level. This is significant if you use 3proxy for billing,
+it on network or link level. It's significant if you use 3proxy for billing,
-especially in cases where network packets are small, e.g., online games.
+especially in case where network packets are small, e.g. network games.
 <p>
-This plugin attempts to correct 3proxy's computations to approximate network or
+This plugin attempts to correct 3proxy computations to approximate network or
-link-level traffic by using either fixed coefficients by port number or
+link level traffic by using either fixed coefficients by port number or
-by attempting to predict the number and sizes of network packets.
+attempting to predict number and sizes of network packets.
 </p><h4>Usage:</h4>
 <ol>
- <li>Extract TrafficPlugin.dll to the same folder as the 3proxy executable.
+ <li>Extract TrafficPlugin.dll to the same folder with 3proxy executable.
- </li><li>Start the plugin in 3proxy.cfg with:
+ </li><li>Start plugin in 3proxy.cfg with 
 <pre>plugin TrafficPlugin.dll start
 </pre>
  </li><li>Add correction rules:
@@ -17,36 +17,36 @@ by attempting to predict the number and sizes of network packets.
 FOR FIXED COEFFICIENTS MODE:
 <pre>trafcorrect m &lt;service&gt; &lt;target port&gt; &lt;coefficient&gt;
 </pre>
-where &lt;service&gt; - one of proxy, socks4, socks45, socks5, tcppm, udppm, pop3p; * matches "any".
+where &lt;service&gt; - one of proxy, socks4, socks45, socks5, tcppm, udppm, pop3p, * matches "any".
-<br> &lt;target port&gt; - target port; * matches any
+<br> &lt;target port&gt; - target port, * matches any
 <br> &lt;coefficient&gt; - coefficient to multiply traffic for this port.
 <br>
-FOR PACKET HEADER PREDICTION MODE:
+FOR PACKET HEADER PREDICTION MODE
 <pre>trafcorrect p &lt;service&gt; &lt;tcp/udp&gt; &lt;target port&gt; [empty packet size]
 </pre>
-tcp or udp - transport-level protocol to apply the rule to
+tcp ot udp - transport level protocol to apply rule
 <br>
-empty packet size - average size of an "empty" packet, i.e., the sum of average network/transport headers.
+empty packet size - average size of "empty" packet, that is sum of average network/transport headers.
-You can use a network sniffer such as Ethereal to discover it. Usually, the packet size
+You can use network sniffer, such is Ethereal to discover it. Usually packet size
 is 42 for UDP and 
 <br>Modes can be mixed.
-<br>The plugin creates a list of rules; the first matching rule will be applied.
+<br>Plugin creates a list of rules, first matching rule will be applied.
 </li></ol>
-For any mode, the plugin approximates traffic; the logged or counted amount is not exact.
+For any mode plugin approximates traffic, logged or counted amount is not exact.
 <h4>Example:</h4>
 <pre>plugin "TrafficPlugin.dll" start
 trafcorrect m socks5 6112 4.5
 trafcorrect m socks5 * 1.1
 </pre>
-Wrong usage:
+wrong usage:
 <pre>trafcorrect m socks5 * 1.1
 trafcorrect m socks5 6112 4.5
 </pre>
-The second rule will never be applied.
+second rule will never be applied.
 <h4>Download:</h4>
 <ul>
- <li>Plugin is included in the 3proxy 0.6 binary and source distribution
+ <li>Plugin is included into 3proxy 0.6 binary and source distribution
 </li></ul>
 
-&copy; Maslov Michael aka Flexx(rus)
+©Maslov Michael aka Flexx(rus)
 	

doc/html/plugins/TrafficPlugin.ru.html

@@ -46,7 +46,7 @@ trafcorrect p <сервис> <tcp/udp> <исходящий пор
 Когда происходит окончание соединения выполняется первое подходящее правило.
 </ol>
 Подсчет трафика в любом режиме не является точным, это некоторая аппроксимация
-позволяющая подсчитать трафик с точностью до нескольких процентов.
+позволяющаяподсчитать трафик с точностью до нескольких процентов.
 
 <h4>Пример:</h4>
 <pre>
@@ -66,4 +66,4 @@ trafcorrect m socks5 6112 4.5
 <h4>Загрузить:</h4>
 <ul>
  <li>Плагин включен в дистрибутив 3proxy 0.6
-</li></ul>
+</ul>

doc/html/plugins/TransparentPlugin.html

@@ -1,9 +1,9 @@
-<h3>3proxy TransparentPlugin (Linux/BSD only)</h3>
+<h3>3proxy TransparentPlugin plugin (Linux/BSD only)</h3>
 
-This plugin can turn 3proxy into a transparent proxy for virtually any TCP-based protocol
+Plugin can turn 3proxy into transparent proxy for virtually any TCP-based protocol
 and use all 3proxy features - redirections, parent proxies, ACLs, traffic limitations,
-etc. The TransparentPlugin takes the destination IP:port from Linux and uses this
+etc. TransparentPlugin plugin takes destination IP:port from Linux and uses this
-information as the target IP in the proxy. An example usage:
+information as a target IP in proxy. An example of usage:
 
 <pre>
 plugin /path/to/TransparentPlugin.ld.so transparent_plugin
@@ -19,13 +19,13 @@ notransparent
 proxy
 </pre>
 Now, any TCP traffic transparently redirected to port 12345 will be routed via
-the parent SOCKSv5 proxy and logged; all URLs for web requests are visible in logs.
+parent SOCKSv5 proxy and logged, all URLs for web requests are visible in logs.
-The parameters '127.0.0.1 11111' in this case are not used and are overwritten by
+Paremeters '127.0.0.1 11111' in this case are not used and are overwritten by
-the destination IP:port for each transparent connection.
+destination IP:port for each transparent connection.
 
 <h4>Download:</h4>
 <ul>
- <li>Plugin is included in 3proxy 0.8
+ <li>Plugin included into 3proxy 0.8
-</li></ul>
+</ul>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/TransparentPlugin.ru.html

@@ -28,6 +28,6 @@ HTTP-запросов по порту TCP/80 будут видны параме
 <h4>Загрузить:</h4>
 <ul>
  <li>Плагин включен в дистрибутив 3proxy 0.8
-</li></ul>
+</ul>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/WindowsAuthentication.html

@@ -1,33 +1,33 @@
 
-<h3>3proxy Windows Authentication Plugin</h3>
+<h3>3proxy Windows Authentication plugin</h3>
-Support for cleartext authentication against a Windows domain or local Windows account.
+Support for cleartext authentication against Windows domain or local Windows account.
 <h4>Usage:</h4>
 <ol>
- <li>Extract WindowsAuthentication.dll to the same folder as the 3proxy executable.
+ <li>Extract WindowsAuthentication.dll to the same folder with 3proxy executable.
- <li>Create 3ProxyAllowedGroup - a Windows system group allowed to use the proxy.
+ <li>Create 3ProxyAllowedGroup - Windows system group allowed to use proxy.
- You can choose a different group name. The group can be either local or
+ You can choose different group name. Group can be either local or
  Active Directory. Every account allowed to use 3proxy must be included in this
  group either directly or through group nesting.
- <li>Configure the plugin with the 'plugin' command in 3proxy.cfg, e.g.:
+ <li>Configure plugin with 'plugin' command in 3proxy.cfg, e.g.:
 <pre><code>
 plugin &quot;WindowsAuthentication.dll&quot; WindowsAuthentication &quot;3ProxyAllowedGroup&quot;
 </code></pre>
-<br>WindowsAuthentication.dll - location of the DLL; if the DLL is located in a different folder
+<br>WindowsAuthentication.dll - location of DLL, if DLL is located in different folder
-from 3proxy.exe, you must specify the complete path to the DLL here. 3ProxyAllowedGroup - the Windows
+from 3proxy.exe you must specify complete path to DLL here. 3ProxyAllowedGroup - Windows
 system group allowed to use 3proxy.
-After the plugin is loaded, the 'windows' authentication type is supported.
+After plugin is loaded, 'windows' authentication type is supported.
 
  <li>Configure 'auth windows' for services that require Windows authentication.
- <li>It is recommended that you also configure authentication caching (see 'authcache')
+ <li>It's recommended you also configure authentication caching (see 'authcache'),
- to prevent excessive workload on the domain controller. Example:
+ to prevent excessive workload for domain controller. Example:
 <pre>
  authcache user,pass 900
  auth cache windows
 </pre>
 
- <li>NTLM authentication is not currently supported for plugins; you should use the proxy -n switch to disable it.
+ <li>NTLM authentication is not currently supported for plugins, you should use proxy -n key to disable it.
 </ol>
 <h4>Download:</h4>
 <ul>
- <li>Plugin is included in the 3proxy 0.6 binary and source distribution
+ <li>Plugin is included into 3proxy 0.6 binary and source distribution
-</li></ul>
+</ul>

doc/html/plugins/WindowsAuthentication.ru.html

@@ -31,5 +31,5 @@ auth windows
 <h4>Загрузить:</h4>
 <ul>
  <li>Плагин включен в дистрибутив 3proxy 0.6
-</li></ul>
+</ul>
 

doc/html/securityen.html

@@ -1,33 +1,35 @@
-<h3>3proxy Security Considerations</h3>
+<h3>3proxy security considirations</h3>
-<ul>
-<li>Never install 3proxy suid. If you need it to run suid, write a
-wrapper with a fixed configuration file.
-<li>Make the configuration file accessible only to the account 3proxy starts with.
-<li>Under Windows, if 3proxy is used as a service, create a new
-unprivileged local account without "logon locally" rights. Assign this account
-to the 3proxy service.
-<li>Under Unix, use chroot to jail 3proxy (make sure files included in
-the configuration file after the 'chroot' command, if any, are available from within the jail).
-<li>Under Unix, either start 3proxy with an unprivileged account or, if you need
-some privileged ports to be used by 3proxy, use setgid/setuid commands inside
-3proxy.cfg immediately after the last occurrence of a service bound to a
-privileged port in the configuration file (setgid must precede setuid).
-<li>Always use full paths in the configuration file.
-<li>Try to avoid 'strong' authentication, because only cleartext
-authentication is currently available.
-<li>Always specify internal and external interfaces.
-<li>Always limit connections to the internal network and localhost (to 127.0.0.1 and
-all interfaces) with ACLs. Be careful, because the BIND command in SOCKS requires the
-BIND method with the external interface IP address to be allowed.
-<li>Before 3proxy 0.8, always use nserver and nscache under Unix; otherwise, a DoS attack is possible
-with an unreachable DNS server (because gethostbyname will block other threads).
-<li>Keep logs in a secure location, because some confidential information from
-user requests can be logged.
-<li>Use -xyz+A character filtering sequences for 'logformat', especially with
-ODBC logging, to prevent SQL and log record injections.
-<li>Immediately report all service crashes to the developers.
-<li>Participate in code audit :)
 </ul>
+<ul>
+<li>Never install 3proxy suid. If you need it to run suid write some
+wrapper with fixed configuration file.
+<li>Make configuration file only available to account 3proxy starts with.
+<li>Under Windows if 3proxy is used as service create new
+unprivileged local account without "logon locally" right. Assign this account
+to 3proxy service.
+<li>Under unix use chroot to jail 3proxy (make sure files included in
+configuration file after 'chroot' command, if any, are available from jail)
+<li>Under Unix, either start 3proxy with unprivileged account or, if you need
+some privileged ports to be used by 3proxy, use setgid/setuid commands inside
+3proxy.cfg immediately after last occurance of service binded to
+privileged port in configuration file (setgid must preceed setuid).
+<li>Allways use full paths in configuration file
+<li>Try to avoid 'strong' authentication, because only cleartext
+authentication method is currently available.
+<li>Always specify internal and external interfaces.
+<li>Always limit connections to internal network and localhost (to 127.0.0.1 and
+all interfaces) with ACLs. Be carefull, because BIND command in SOCKS requies
+BIND method with external interface IP address to be allowed.
+<li> Before 3proxy 0.8 always use nserver and nscache under Unix, overwise DoS attack is possible
+with unreachable DNS server (because gethostbyname will block over threads).
+<li>Keep logs in secure location, because some confidential information from
+user's request can be logged.
+<li>Use -xyz+A character filtering sequences for 'logformat', especially with
+ODBC logging to prevent SQL and log record injections. 
+<li>Immediately report all service crashes to developers
+<li>Participate in code audit :)
+</ol>
  
+</ul>
 <p>
 

doc/ru/example1.txt

@@ -3,26 +3,26 @@ KOI8-R
 Kirill Lopuchov, lopuchov at mail ru
 
 <3proxy>
-Довольно часто перед системным администратором встает задача предоставить доступ к Internet-ресурсам группе пользователей (небольшой офис, Internet-кафе). Данную задачу можно решить, настроив на Internet-шлюзе proxy-сервер, службу NAT (трансляция сетевых адресов) или раздать каждому пользователю реальный IP адрес.
+Довольно часто перед системным администратором встает задача предоставить доступ к Internet-ресурсам группе пользователей (небольшой офис, Internet-кафе). Данную задачу можно решить, настроив на Internet-шлюзе proxy-сервер, службу NAT (трансляция сетевых адресов) или раздать каждому пользователю реальный IP адрес.
 
-Давайте рассмотрим самый простой способ подключения - установку proxy-сервера. Традиционно для этих целей применяется популярный proxy Squid, но не всегда бывает необходимость в столь тяжеловатой программе :), да и в squid отсутствуют такие иногда необходимые вещи как SOCKS4/5-сервер, TCP/UP порт-маппинг. Поэтому вторым номером хочется представить вашему вниманию PROXY-сервер, под названием "3proxy" (http://3proxy.ru/), разработанный нашим программистом из г. Нижний Новгород. Одним из главных его достоинств является компактность и высокая переносимость. Код сервера написан так, что легко компилируется как для Win9x/2000/XP так и для Linux и FreeBSD.
+Давайте рассмотрим самый простой способ подключения - установку proxy-сервера. Традиционно для этих целей применяется популярный proxy Squid, но не всегда бывает необходимость в столь тяжеловатой программе :), да и в squid отсутствуют такие иногда необходимые вещи как SOCKS4/5-сервер, TCP/UP порт-маппинг. Поэтому вторым номером хочется представить вашему вниманию PROXY-сервер, под названием "3proxy" (http://3proxy.ru/), разработанный нашим программистом из г. Нижний Новгород. Одним из главных его достоинств является компактность и высокая переносимость. Код сервера написан так, что легко компилируется как для Win9x/2000/XP так и для Linux и FreeBSD.
 
-Сервер поддерживает следующие возможности:
+Сервер поддерживает следующие возможности:
 
 HTTP(S) proxy;
 FTP over HTTP proxy;
 SOCKS4/5 proxy;
 POP3 proxy;
-TCP & UDP маппинг портов;
+TCP & UDP маппинг портов;
-листы доступа к различным службам и адресам;
+листы доступа к различным службам и адресам;
-ограничение пропускной способности канала каждого пользователя (чтобы пользователь не съел весь канал, качая кучу файлов в несколько потоков :) ); 
+ограничение пропускной способности канала каждого пользователя (чтобы пользователь не съел весь канал, качая кучу файлов в несколько потоков :) ); 
-ограничение трафика пользователя на день, неделю и месяц;
+ограничение трафика пользователя на день, неделю и месяц;
-авторизацию пользователей ко всем proxy-службам по имени и паролю или по ip адресам;
+авторизацию пользователей ко всем proxy-службам по имени и паролю или по ip адресам;
-ведение журналов через ODBC (по-моему, такого нет ни в одном proxy) и syslog и т. д. 
+ведение журналов через ODBC (по-моему, такого нет ни в одном proxy) и syslog и т. д. 
 
-К недостаткам можно отнести отсутствие кэширования информации :-|. Но в последнее время Inernet-контент становится все более динамичным (то есть не поддающийся кэшированию) и может быть для кого-то экономия в 25% трафика за счет его кэширования не будет столь критична. Для тех пользователей, кому она может оказаться критичной, автор предлагает использовать цепочку из 2-х серверов и в качестве кэша такие сервера как wwwoffle или им подобные, либо ждать появления поддержки кеша в 3proxy :)
+К недостаткам можно отнести отсутствие кэширования информации :-|. Но в последнее время Inernet-контент становится все более динамичным (то есть не поддающийся кэшированию) и может быть для кого-то экономия в 25% трафика за счет его кэширования не будет столь критична. Для тех пользователей, кому она может оказаться критичной, автор предлагает использовать цепочку из 2-х серверов и в качестве кэша такие сервера как wwwoffle или им подобные, либо ждать появления поддержки кеша в 3proxy :)
 
-Установка
+Установка
 
 # wget http://3proxy.ru/current/3proxy.tgz
 # tar -xvzf 3proxy.tgz
@@ -35,64 +35,64 @@ TCP & UDP маппинг портов;
 # touch /usr/local/3proxy/3proxy.cfg
 # chown -R nobody:nogroup /usr/local/3proxy 
 
-Далее приведу небольшой пример конфигурационного файла 3proxy.cfg с 
+Далее приведу небольшой пример конфигурационного файла 3proxy.cfg с 
-комментариями, более подробную информацию по конфигурированию можно 
+комментариями, более подробную информацию по конфигурированию можно 
-найти файле 3proxy.cfg.sample или в 
+найти файле 3proxy.cfg.sample или в 
 HowTo http://3proxy.ru/howtor.asp
-и FAQ http://3proxy.ru/faqr.asp
+и FAQ http://3proxy.ru/faqr.asp
 
 -------------3proxy.cfg-------------
-# ВНИМАНИЕ !! не должны быть пробелов
+# ВНИМАНИЕ !! не должны быть пробелов
-# перед любыми опциями конфигурации !!
+# перед любыми опциями конфигурации !!
 
-# ip-адрес DNS-сервера провайдера или локального
+# ip-адрес DNS-сервера провайдера или локального
 nserver 127.0.0.1
 timeouts 1 5 30 60 180 1800 15 60
 
-# Создаем двух пользователей vasia, petia и vova 
+# Создаем двух пользователей vasia, petia и vova 
-# и назначаем им пароли 24555, 14656 и 45455 соответственно
+# и назначаем им пароли 24555, 14656 и 45455 соответственно
 users vasia:CL:24555
 users petia:CL:14656
 users vova:CL:45455
 
-# Лог-файл со списком запросов пользователей 
+# Лог-файл со списком запросов пользователей 
-# будет создаваться каждый день новый
+# будет создаваться каждый день новый
 log /usr/local/3proxy/logs/3proxy.log D
 logformat "%d-%m-%Y %H:%M:%S %U %C:%c %R:%r %O %I %T"
 
-# Внешний интерфейс,
+# Внешний интерфейс,
-# через который будут уходить запросы от сервера
+# через который будут уходить запросы от сервера
 external 10.1.1.1
 
-# ip-адрес интерфейса, на котором будут приниматься 
+# ip-адрес интерфейса, на котором будут приниматься 
-# запросы от клиентов
+# запросы от клиентов
 internal 192.168.1.1
 
-# Устанавливаем тип авторизации по имени и паролю
+# Устанавливаем тип авторизации по имени и паролю
 auth strong
-# Разрешаем доступ к портам 80,8080-8088
+# Разрешаем доступ к портам 80,8080-8088
 allow * * * 80,8080-8088
-# Расскоментировать секцию parent, если у вас есть прокси верхнего 
+# Расскоментировать секцию parent, если у вас есть прокси верхнего 
-# уровня и заменить ip, порт, имя пользователя и пароль на свои значения 
+# уровня и заменить ip, порт, имя пользователя и пароль на свои значения 
 # parent 1000 http 192.168.0.1 8080 username passwd
 # allow *
-# Запускаем службу HTTP-proxy на порту (3128) и 
+# Запускаем службу HTTP-proxy на порту (3128) и 
-# (-n) c отключенной NTLM-авторизацией)
+# (-n) c отключенной NTLM-авторизацией)
 proxy -p3128 -n
 
-# Ограничиваем толшину канала для пользователей 
+# Ограничиваем толшину канала для пользователей 
-# vasia и petia в 20000 bps,
+# vasia и petia в 20000 bps,
-# а для vova 10000 bps
+# а для vova 10000 bps
 bandlimin 20000 vasia,petia
 bandlimin 10000 vova 
 
-# Запускаем сервер от пользователя nobody 
+# Запускаем сервер от пользователя nobody 
-# (возможно в вашей ОС uid и gid пользователя nobody
+# (возможно в вашей ОС uid и gid пользователя nobody
-# будут другими. Для их определения воспользуйтесь коммандой id nobody) 
+# будут другими. Для их определения воспользуйтесь коммандой id nobody) 
 setgid 65534
 setuid 65534
 ------------------------------------
 
-После того как мы создали конфигурационный файл сервера, запускаем 3proxy командой:
+После того как мы создали конфигурационный файл сервера, запускаем 3proxy командой:
 /usr/local/3proxy/3proxy /usr/local/3proxy/3proxy.cfg
 

doc/ru/iodbc.txt

@@ -2,9 +2,9 @@ KOI8-R
 
 Kirill Lopuchov, lopuchov at mail ru
 
-Ведение логов сервера в SQL-базе имеет свои приемущества перед обычными текстовыми файлами. 3proxy поддерживает ведение логов через ODBC-менеджер в любой базе данных, имеющих ODBC-драйвер. Этот менеджер стал стандартом де-факто в среде Windows, чего, к сожалению, не скажешь про Unix. Поэтому далее  рассмотрим на примере FreeBSD настройку ведения логов в базе SQLite. Эта  база данных выбрана в качестве примера потому,  что она проста в установке и настроке (в принципе настройка ведения логов в любой другой базе mysql или  postgresql отличается только настройкой его odbc-драйвера)
+Ведение логов сервера в SQL-базе имеет свои приемущества перед обычными текстовыми файлами. 3proxy поддерживает ведение логов через ODBC-менеджер в любой базе данных, имеющих ODBC-драйвер. Этот менеджер стал стандартом де-факто в среде Windows, чего, к сожалению, не скажешь про Unix. Поэтому далее  рассмотрим на примере FreeBSD настройку ведения логов в базе SQLite. Эта  база данных выбрана в качестве примера потому,  что она проста в установке и настроке (в принципе настройка ведения логов в любой другой базе mysql или  postgresql отличается только настройкой его odbc-драйвера)
  
- Устанавливаем SQLite
+ Устанавливаем SQLite
 wget http://www.sqlite.org/sqlite-2.8.14.tar.gz
 tar -xvzf sqlite-2.8.14.tar.gz
 cd sqlite 
@@ -12,7 +12,7 @@ cd sqlite
 gmake 
 gmake install
 
- Устанавливаем iODBC менеджер
+ Устанавливаем iODBC менеджер
 wget http://www.iodbc.org/libiodbc-3.51.2.tar.gz
 tar -xvzf libiodbc-3.51.2.tar.gz
 cd libiodbc-3.51.2
@@ -20,24 +20,24 @@ cd libiodbc-3.51.2
 make 
 make install
 
- Устанавливаем odbc драйвер SQLite
+ Устанавливаем odbc драйвер SQLite
 wget http://www.ch-werner.de/sqliteodbc/sqliteodbc-0.62.tar.gz
 tar -xvzf sqliteodbc-0.62.tar.gz
 cd sqliteodbc-0.62
 
 ./configure
- Если у вас скрипт configure выдал ошибку : 
+ Если у вас скрипт configure выдал ошибку : 
  (configure: error: SQLite library too old)
- то ее можно попробовать обойти, вставив (SQLITE_COMPILE=1
+ то ее можно попробовать обойти, вставив (SQLITE_COMPILE=1
- в стр. 5092 после условия if endif) в файле configure
+ в стр. 5092 после условия if endif) в файле configure
 make 
 make install
 
 
- Далее настраиваем записи для iODBC менеджера в
+ Далее настраиваем записи для iODBC менеджера в
-файлах /etc/odbcinst.ini и /etc/odbc.ini
+файлах /etc/odbcinst.ini и /etc/odbc.ini
 
-Настраиваем odbc драйвер 
+Настраиваем odbc драйвер 
 --------------/etc/odbcinst.ini-------------
 [ODBC Drivers]
 SQLite=Installed
@@ -46,8 +46,8 @@ SQLite=Installed
 Driver=/usr/local/lib/libsqliteodbc.so
 ---------------------------------------
 
-Создаем DSN для базы c именем "sqlite", которая будет 
+Создаем DSN для базы c именем "sqlite", которая будет 
-располагаться в каталоге: /usr/local/3proxy/logs.db
+располагаться в каталоге: /usr/local/3proxy/logs.db
 
 --------------/etc/odbc.ini----------------
 [ODBC Data Sources]
@@ -61,8 +61,8 @@ Database=/usr/local/3proxy/logs.db
 Timeout=2000
 ---------------------------------------
 
-Создаем базу для логов и таблицу в формате (logformat 
+Создаем базу для логов и таблицу в формате (logformat 
-см. описание в 3proxy.cfg.sample )
+см. описание в 3proxy.cfg.sample )
 
 sqlite /usr/local/3proxy/logs.db
 
@@ -79,7 +79,7 @@ sqlite>create table log (
    ...>);
 
 
-Добавляем следующие записи в конфигурационный файл 3proxy.cfg
+Добавляем следующие записи в конфигурационный файл 3proxy.cfg
 ---------------3proxy.cfg-----------------   
 log &sqlite
 
@@ -88,12 +88,12 @@ l_descr)
 values ('%d-%m-%Y', '%H:%M:%S', '%U', '%N', %I, %O, '%T')"
 ------------------------------------------
 
-Cобрать 3proxy c поддрежкой iODBC, для этого в Makefile.unix поменять
+Cобрать 3proxy c поддрежкой iODBC, для этого в Makefile.unix поменять
  
 CFLAGS = -Wall -O2 -c -pthread -D_THREAD_SAFE -D_REENTRANT -DWITH_STD_MALLOC -I/usr/local/include
 LIBS = -L /usr/local/lib -lodbc
 
-и дать команды
+и дать команды
 
 make clean
 make -f Makefile.unix

doc/ru/odbc.txt

@@ -1,6 +1,6 @@
 Eugene: Re: 3proxy 0.6 + iODBC + PostgreSQL  22.11.2007 19:04:23
- 	 	 	 	 	Наконец-то я разобрался и запустил.
+ 	 	 	 	 	Наконец-то я разобрался и запустил.
-1. Я использовал пакет unixODBC.
+1. Я использовал пакет unixODBC.
 2. /etc/unixODBC/odbc.ini
 [proxy]
 Description             = PostgreSQL ODBC driver
@@ -12,7 +12,7 @@ ServerName              = localhost
 Description             = PostgreSQL ODBC driver
 Driver          = /usr/local/lib/psqlodbcw.so
 Setup           = /usr/lib/libodbcpsqlS.so
-4. Собирал вручную psqlodbc-08.02.0500, слитый с postgresql.org (получился psqlodbcw.so).
+4. Собирал вручную psqlodbc-08.02.0500, слитый с postgresql.org (получился psqlodbcw.so).
 5. 3proxy.conf
 log &proxy,logger,123
 logformat "LINSERT INTO logger (ldatetime,username,userip,trafin,trafout,service,host,port,
@@ -20,9 +20,9 @@ url) VALUES ('%Y-%m-%d %H:%M:%S','%U','%C',
 '%I','%O','%N',
 '%n','%r','%T');"
 
-То есть пароли и логины в odbc.ini прописывать не надо - система падает на драйвере ODBC.
+То есть пароли и логины в odbc.ini прописывать не надо - система падает на драйвере ODBC.
-Использовать libiodbc тоже не надо - система падает на libiodbc.so.
+Использовать libiodbc тоже не надо - система падает на libiodbc.so.
 
-Все вышесказанное справедливо для unixODBC + psqlodbc производства postgresql.org, как с -DSAFESQL, так и без оного.
+Все вышесказанное справедливо для unixODBC + psqlodbc производства postgresql.org, как с -DSAFESQL, так и без оного.
-С myodbc + unixODBC проблем не наблюдалось никаких.
+С myodbc + unixODBC проблем не наблюдалось никаких.
-Шаманство, в общем ;) 
+Шаманство, в общем ;) 

man/3proxy.8

@@ -14,18 +14,18 @@ server
 .RI [ \-\-remove ]
 .SH DESCRIPTION
 .B 3proxy
-is a universal proxy server. It can be used to provide internal users with
+is universal proxy server. It can be used to provide internal users wuth
 fully controllable access to external resources or to provide external
 users with access to internal resources. 3proxy is not developed to replace
 .BR squid (8),
-but it can extend the functionality of an existing caching proxy.
+but it can extend functionality of existing cashing proxy.
 It can be used to route requests between different types of clients and proxy
 servers. Think about it as application level
 gateway with configuration like hardware router has for network layer.
 It can establish multiple
 gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4,
 v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started
-from the configuration file like an independent service 
+from configuration file like independant service 
 .BR proxy (8)
 .BR socks (8)
 .BR pop3p (8)
@@ -35,24 +35,24 @@ from the configuration file like an independent service
 .BR dnspr
 but
 .BR 3proxy
-is not a kind of wrapper or superserver for these daemons. It just has the same
+is not a kind of wrapper or superserver for this daemons. It just has same
 code compiled in, but provides much more functionality. SOCKSv5
-implementation allows you to use 3proxy with any UDP or TCP based client
+implementatation allows to use 3proxy with any UDP or TCP based client
 applications designed without
 proxy support (with
 .IR SocksCAP ,
 .I FreeCAP
-or another client-side redirector under Windows or with a socksification library
+or another client-side redirector under Windows of with socksification library
-under Unix). So you can play your favourite games, listen to music, exchange
+under Unix). So you can play your favourite games, listen music, exchange
-files and messages and even accept incoming connections behind a proxy server.
+files and messages and even accept incoming connections behind proxy server.
 .PP
 .I dnspr
-does not exist as an independent service. It's a DNS caching proxy (it requires
+does not exist as independant service. It\' DNS caching proxy (it requires
 .I nscache
 and
 .I nserver
-to be set in the configuration. Only A-records are cached. Please note that
+to be set in configuration. Only A-records are cached. Please note, the
-this caching is mostly a 'hack' and has nothing to do with a real
+this caching is mostly a 'hack' and has nothing to do with real
 DNS server, but it works perfectly for SOHO networks.
 
 .PP
@@ -67,7 +67,7 @@ host or to another proxy server or even to a chain of proxy servers.
 .PP
 It supports different types of logging: to logfiles, 
 .BR syslog (3)
-(only under Unix) or to an ODBC database. Logging format is tunable to provide
+(only under Unix) or to ODBC database. Logging format is turnable to provide
 compatibility with existing log file parsers. It makes it possible to use
 3proxy with IIS, ISA, Apache or Squid log parsers.
 .SH OPTIONS
@@ -77,12 +77,12 @@ Name of config file. See
 .BR 3proxy.cfg (3)
 for configuration file format. Under Windows, if config_file is not specified,
 .BR 3proxy
-looks for a file named
+looks for file named
 .I 3proxy.cfg
-in the default location (in the same directory as the executable file and in the current
+in the default location (in same directory with executable file and in current
 directory). Under Unix, if no config file is specified, 3proxy reads
-configuration from stdin. It makes it possible to use the 3proxy.cfg file as
+configuration from stdin. It makes it possible to use 3proxy.cfg file as
-an executable script just by setting +x mode and adding
+executable script just by setting +x mode and adding
 .br
 #!/usr/local/3proxy/3proxy
 .br
@@ -98,28 +98,28 @@ as a system service
 .BR 3proxy
 from system services
 .SH SIGNALS
-Under Unix there are a few signals
+Under Unix there are few signals
 .BR 3proxy
 catches. See
 .BR kill (1).
 .TP
 .B SIGTERM
-clean up connections and exit
+cleanup connections and exit
 .TP
 .B SIGPAUSE
-stop accepting new connections, on second signal - start and re-read
+stop to accept new connections, on second signal - start and re-read
 configuration
 .TP
 .B SIGCONT
-start to accept new connections
+start to accept new conenctions
 .TP
 .B SIGUSR1
 reload configuration
 .PP
 Under Windows, if
 .BR 3proxy
-is installed as a service you can use standard service management to start, stop,
+is installed as service you can standard service management to start, stop,
-pause and continue the 3proxy service, for example:
+pause and continue 3proxy service, for example:
 .br
 .BR "net start 3proxy"
 .br

man/3proxy.cfg.3

@@ -6,9 +6,9 @@
  Common structure:
 .br
  Configuration file is a text file 3proxy reads configuration from. Each line
-of the file is a command executed immediately, as if it were given from the
+of the file is a command executed immediately, as it was given from
-console. The sequence of commands is important. The configuration file is actually a
+console. Sequence of commands is important. Configuration file as actually a
-script for the 3proxy executable.
+script for 3proxy executable.
 Each line of the file is treated as a blank (space or tab) separated
 command line. Additional space characters are ignored. 
 Think about 3proxy as "application level router" with console interface.
@@ -16,16 +16,16 @@ Think about 3proxy as "application level router" with console interface.
 .br
  Comments:
 .br
- Any line beginning with a space character or \'#\' character is a comment. It\'s
+ Any string beginning with space character or \'#\' character is comment. It\'s
-ignored. <LF>s are ignored. <CR> is the end of a command.
+ignored. <LF>s are ignored. <CR> is end of command.
 
 .br
  Quotation:
 .br
- The quotation character is " (double quote). Quotation must be used to quote
+ Quotation character is " (double quote). Quotation must be used to quote
-spaces or other special characters. To use a quotation character inside
+spaces or another special characters. To use quotation character inside
-a quoted string, the character must be doubled (BASIC convention). For example, to use
+quotation character must be dubbed (BASIC convention). For example to use
-HELLO "WORLD" as an argument, you should write it as "HELLO ""WORLD""".
+HELLO "WORLD" as an argument you should use it as "HELLO ""WORLD""".
 Good practice is to quote any argument you use.
 
 .br
@@ -37,7 +37,7 @@ to file, for example $/usr/local/etc/3proxy/conf.incl or
 required in last example because path contains space character. 
 For included file <CR> (end of line characters) is treated as space character
 (arguments delimiter instead of end of command delimiter). 
-Thus, include files are only useful to store long single-line commands
+Thus, include files are only useful to store long signle-line commands
 (like userlist, network lists, etc).
 To use dollar sign somewhere in argument it must be quoted. 
 Recursion is not allowed.
@@ -120,7 +120,7 @@ disable NTLM authentication (required if passwords are stored in Unix crypt form
 enable NTLMv1 authentication.
 .br
 .B -g(GRACE_TRAFF,GRACE_NUM,GRACE_DELAY)
-delay GRACE_DELAY milliseconds before polling if average polling size is below GRACE_TRAFF bytes and GRACE_NUM read operations in a single direction are detected within 1 second. Useful to minimize polling
+delay GRACE_DELAY  milliseconds before polling if average polling size below  GRACE_TRAFF bytes and GRACE_NUM read operations in single directions are detected within 1 second. Useful to minimize polling
 .B -s
  (for admin) secure, allow only secure operations, currently only traffic counters
 view without ability to reset.
@@ -142,7 +142,7 @@ Never ask for username/password
 (for proxy) anonymous proxy (random client information reported)
 .br
 .B -a2
-(for proxy) generate Via: and X-Forwarded-For: instead of Forwarded:
+(for proxy) generate Via: and X-Forwared-For: instead of Forwarded:
 .br
 .B -6
 Only resolve IPv6 addresses. IPv4 addresses are packed in IPv6 in IPV6_V6ONLY compatible way.
@@ -167,17 +167,17 @@ options for proxy-to-client (oc), proxy-to-server (os), proxy listening (ol), co
 Options like TCP_CORK, TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS, USE_TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT, SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE, SO_DONTROUTE may be supported depending on OS.
 .br
 .B -DiINTERFACE, -DeINTERFACE
-bind internal interface / external interface to given INTERFACE (e.g. eth0) if SO_BINDTODEVICE is supported by the system. You may need to run as root or have CAP_NET_RAW capability in order to bind to an interface, depending on the system, so this option may require root privileges and can be incompatible with some configuration commands like chroot and setuid (and daemon if setcap is used).
+bind internal interface / external inteface to given INTERFACE (e.g. eth0) if SO_BINDTODEVICE supported by system. You may need to run as root or to have CAP_NET_RAW capability in order to bind to interface, depending on system, so this option may require root privileges and can be incompatible with some configuraton commands like chroot and setuid (and daemon if setcap is used).
 .br
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. External IP must be specified if you need incoming connections.
-By default the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .br
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. 
+By default connection to any interface is accepted. 
 .br
 .B -N
 (for socks) External NAT address 3proxy reports to client for BIND and UDPASSOC
@@ -298,7 +298,7 @@ with space and all time based elemnts are in local time zone.
 .br
   %m Month number
 .br
-  %o Month abbreviation
+  %o Month abbriviature
 .br
   %d Day
 .br
@@ -308,17 +308,17 @@ with space and all time based elemnts are in local time zone.
 .br
   %S Second
 .br
-  %t Timestamp (in seconds since 01-Jan-1970)
+  %t Timstamp (in seconds since 01-Jan-1970)
 .br
   %. milliseconds
 .br
-  %z time zone (from Greenwich)
+  %z timeZone (from Grinvitch)
 .br
   %D request duration (in milliseconds)
 .br
-  %b average send rate per request (in bytes per second); this speed is typically below the connection speed shown by the download manager.
+  %b average send rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
 .br
-  %B average receive rate per request (in bytes per second); this speed is typically below the connection speed shown by the download manager.
+  %B average receive rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
 .br
   %U Username
 .br
@@ -354,9 +354,9 @@ with space and all time based elemnts are in local time zone.
 .br
   %T service specific Text
 .br
-  %N1-N2T (N1 and N2 are positive numbers) log only fields from N1 through N2 of service-specific text
+  %N1-N2T (N1 and N2 are positive numbers) log only fields from N1 thorugh N2 of service specific text
 .br
- In the case of ODBC logging, logformat specifies an SQL statement, for example:
+ in the case of ODBC logging logformat specifies SQL statement, for exmample:
 .br
  logformat "-\'+_Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values (\'%d-%m-%Y %H:%M:%S\', \'%U\', \'%N\', %I, %O, \'%T\')"
 
@@ -441,8 +441,8 @@ performed over TCP.
 <cachesize>
 .br
  Cache <cachesize> records for name resolution (nscache for IPv4,
-nscache6 for IPv6). The cache size should usually be large enough
+nscache6 for IPv6). Cachesize usually should be large enougth
-(for example, 65536).
+(for example 65536).
 
 .br
 .B nsrecord
@@ -457,8 +457,8 @@ command to set up UDL for dialing.
 .br
 .B fakeresolve
 .br
- All names are resolved to the 127.0.0.2 address. Useful if all requests are
+ All names are resolved to 127.0.0.2 address. Usefull if all requests are
-redirected to a parent proxy with http, socks4+, connect+ or socks5+.
+redirected to parent proxy with http, socks4+, connect+ or socks5+.
 
 .br
 .B dialer
@@ -491,8 +491,8 @@ External or -e can be given twice: once with IPv4 and once with IPv6 address.
 .B maxconn
 <number>
 .br
- sets the maximum number of simultaneous connections to each service
+ sets maximum number of simulationeous connections to each service
-started after this command at the network level. Default is 100.
+started after this command on network level. Default is 100.
 .br
  To limit clients, use connlim instead. maxconn will silently ignore
 new connections, while connlim will report back to the client that
@@ -507,17 +507,17 @@ the connection limit has been reached.
 .br
 .B service
 .br
- (deprecated). Indicates that 3proxy should behave as a Windows 95/98/NT/2000/XP
+ (depricated). Indicates 3proxy to behave as Windows 95/98/NT/2000/XP
-service; has no effect under Unix. Not required for 3proxy 0.6 and above. If
+service, no effect for Unix. Not required for 3proxy 0.6 and above. If
-you upgraded from a previous version of 3proxy, use --remove and --install
+you upgraded from previous version of 3proxy use --remove and --install
-to reinstall the service.
+to reinstall service.
 
 .br
 .B daemon
 .br
- Should be specified to close the console. Do not use \'daemon\' with \'service\'.
+ Should be specified to close console. Do not use \'daemon\' with \'service\'.
-At least under FreeBSD, \'daemon\' should precede any proxy service
+At least under FreeBSD \'daemon\' should preceed any proxy service
-and log commands to avoid socket problems. Always place it in the beginning
+and log commands to avoid sockets problem. Always place it in the beginning
 of the configuration file.
 
 .br
@@ -528,8 +528,8 @@ of the configuration file.
 .br
  none - no authentication or authorization required.
 .br
- Note: if auth is none, any IP-based limitation, redirection, etc. will not work.
+ Note: is auth is none any ip based limitation, redirection, etc will not work. 
-This is the default authentication type
+This is default authentication type
 .br
  iponly - authentication by access control list with username ignored.
  Appropriate for most cases
@@ -538,11 +538,11 @@ This is the default authentication type
 authorization by ACLs. Useful for e.g. SOCKSv4 proxy and icqpr (icqpr set UIN /
 AOL screen name as a username)
 .br
- dnsname - authentication by DNS hostname with authorization by ACLs.
+ dnsname - authentication by DNS hostnname with authorization by ACLs.
-The DNS hostname is resolved via a PTR (reverse) record and validated (the resolved
+DNS hostname is resolved via PTR (reverse) record and validated (resolved
-name must resolve to the same IP address). It\'s recommended to use authcache by
+name must resolve to same IP address). It\'s recommended to use authcache by
-IP for this authentication.
+ip for this authentication.
-NB: there is no password check; the name may be spoofed.
+NB: there is no any password check, name may be spoofed.
 .br
  strong - username/password authentication required. It will work with
 SOCKSv5, FTP, POP3 and HTTP proxy. 
@@ -554,23 +554,23 @@ SOCKSv5, FTP, POP3 and HTTP proxy.
  Plugins may add additional authentication types.
 
 .br
- It\'s possible to use multiple authentication types in the same command. E.g.
+ It\'s possible to use few authentication types in the same commands. E.g.
 .br
  auth iponly strong
 .br
- In this case, \'strong\' authentication will be used only if resource
+ In this case \'strong\' authentication will be used only in case resource
-access cannot be performed with \'iponly\' authentication, that is, a username is
+access can not be performed with \'iponly\' authentication, that is username is
-required in the ACL. It\'s useful to protect access to some resources with
+required in ACL. It\'s usefull to protect access to some resources with
-a password while allowing passwordless access to other resources, or to use
+password allowing passwordless access to another resources, or to use
-IP-based authentication for dedicated laptops and request a username/password for
+IP-based authentication for dedicated laptops and request username/password for
 shared ones.
 
 .br
 .B authcache
 <cachtype> <cachtime>
 .br
- Cache authentication information for a given amount of time (cachetime) in seconds.
+ Cache authentication information to given amount of time (cachetime) in seconds.
-Cachetype is one of:
+Cahtype is one of:
 .br
  ip - after successful authentication all connections during caching time
 from same IP are assigned to the same user, username is not requested.
@@ -603,10 +603,10 @@ Use auth type \'cache\' for cached authentication
 allowed. Usernames are case sensitive (if used with authtype nbname
 username must be in uppercase). Source and target lists may contain
 IP addresses (W.X.Y.Z), ranges A.B.C.D - W.X.Y.Z (since 0.8) or CIDRs (W.X.Y.Z/L). 
-Since 0.6, the targetlist may also contain host names,
+Since 0.6, targetlist may also contain host names,
-instead of addresses. It\'s possible to use a wildmask in
+instead of addresses. It\'s possible to use wildmask in
-the beginning and at the end of the hostname, e.g. *badsite.com or *badcontent*.
+the begginning and in the the end of hostname, e.g. *badsite.com or *badcontent*.
-The hostname is only checked if a hostname is present in the request.
+Hostname is only checked if hostname presents in request.
 Targetportlist may contain ports (X) or port ranges lists (X-Y). For any field *
 sign means ANY. If access list is empty it\'s assumed to be
 .br
@@ -657,14 +657,14 @@ to appropriate interface only or to use ip filters.
  FTP_LIST FTP list request
 .br
  FTP_DATA FTP data connection. Note: FTP_DATA requires access to dynamic
-non-privileged (1024-65535) ports on the remote side.
+non-ptivileged (1024-65535) ports on remote side.
 .br
  FTP matches any FTP/FTP Data request
 .br
  ADMIN access to administration interface
 
 .br
- Weekdays are week day numbers or periods, 0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday.
+ Weeksdays are week days numbers or periods, 0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday.
 .br
  Timeperiodlists is a list of time
 periods in HH:MM:SS-HH:MM:SS format. For example, 00:00:00-08:00:00,17:00:00-24:00:00 lists non-working hours.
@@ -678,9 +678,9 @@ build proxy chain. Proxies may be grouped. Proxy inside the
 group is selected randomly. If few groups are specified one proxy
 is randomly picked from each group and chain of proxies is created
 (that is second proxy connected through first one and so on).
-Weight is used to group proxies. Weight is a number between 1 and 1000.
+Weight is used to group proxies. Weigt is a number between 1 and 1000.
-Weights are summed and proxies are grouped together until the weight of
+Weights are summed and proxies are grouped together untill weight of
-the group is 1000. That is:
+group is 1000. That is:
 .br
  allow *
 .br
@@ -708,7 +708,7 @@ with probability of 0.7) for outgoing web connections. Chains are only applied t
 .br
  type is one of:
 .br
- extip does not actually redirect the request; it sets the external address for this request to <ip>. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random.
+ extip does not actully redirect request, it sets external address for this request to <ip>. It can be chained with another parent types. It's usefaul to set external IP based on ACL or make it random.
 .br
  tcp simply redirect connection. TCP is always last in chain. This type of proxy is a simple TCP redirection, it does not support parent authentication.
 .br
@@ -732,8 +732,8 @@ if used with different service, it works as tcp redirection.
  socks5+ parent is SOCKSv5 proxy with name resolution
 .br
  socks4b parent is SOCKS4b (broken SOCKSv4 implementation with shortened
-server reply; I never saw this kind of server, but they say there are some).
+server reply. I never saw this kind ofservers byt they say there are).
-Normally you should not use this option. Do not confuse this option with
+Normally you should not use this option. Do not mess this option with
 SOCKSv4a (socks4+).
 .br
  socks5b parent is SOCKS5b (broken SOCKSv5 implementation with shortened
@@ -759,18 +759,18 @@ locally redirects to
 locally redirects to
 .B pop3p
 .B http
-locally redirects to
+locally redurects to
 .B proxy
 .B admin
-locally redirects to the admin -s service.
+locally redirects to admin -s service.
 
 .br
- Main purpose of local redirections is to have the requested resource
+ Main purpose of local redirections is to have requested resource
-(URL or POP3 username) logged and protocol-specific filters applied.
+(URL or POP3 username) logged and protocol-specific filters to be applied.
-In case of local redirection, ACLs are reviewed twice: first, by the SOCKS proxy up to the \'parent\'
+In case of local redirection ACLs are revied twice: first, by SOCKS proxy up to \'parent\'
-command and then by the gateway service the connection is
+command and then with gateway service connection is
-redirected to (HTTP, FTP or POP3) after the \'parent\' command. It means
+redirected (HTTP, FTP or POP3) after \'parent\' command. It means,
-an additional \'allow\' command is required for redirected requests, for
+additional \'allow\' command is required for redirected requests, for
 example:
 .br
  allow * * * 80
@@ -786,7 +786,7 @@ local HTTP proxy parses requests and allows only GET and POST requests.
 .br
  parent 1000 http 1.2.3.4 0
 .br
- Changes the external address for a given connection to 1.2.3.4 (equivalent to -e1.2.3.4)
+ Changes external address for given connection to 1.2.3.4 (an equivalent to -e1.2.3.4)
 .br
  Optional username and password are used to authenticate on parent
 proxy. Username of \'*\' means username must be supplied by user.
@@ -843,17 +843,15 @@ noforce allows to keep previously authenticated connections.
 <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
 <weekdayslist> <timeperiodslist>
 .br
- bandlim sets a bandwidth limitation filter to <rate> bps (bits per second).
+ bandlim sets bandwith limitation filter to <rate> bps (bits per second)
-If you want to specify bytes per second, multiply your value by 8.
+If you want to specife bytes per second - multiply your value to 8.
-bandlim rules act in the same manner as allow/deny rules, except for
+bandlim rules act in a same manner as allow/deny rules except
 one thing: bandwidth limiting is applied to all services, not to some
 specific service. 
-bandlimin and nobandlimin apply to incoming traffic
+bandlimin and nobandlimin applies to incoming traffic
-.br
+bandlimout and nobandlimout applies to outgoing traffic
-bandlimout and nobandlimout apply to outgoing traffic
+If tou want to ratelimit your clients with IPs 192.168.10.16/30 (4
-.br
+addresses) to 57600 bps you have to specify 4 rules like
-If you want to ratelimit your clients with IPs 192.168.10.16/30 (4
-addresses) to 57600 bps, you have to specify 4 rules like
 .br
  bandlimin 57600 * 192.168.10.16
 .br
@@ -863,12 +861,12 @@ addresses) to 57600 bps, you have to specify 4 rules like
 .br
  bandlimin 57600 * 192.168.10.19
 .br
- and each of your clients will have a 56K channel. If you specify
+ and every of you clients will have 56K channel. If you specify
 .br
  bandlimin 57600 * 192.168.10.16/30
 .br
- you will have a 56K channel shared between all clients.
+ you will have 56K channel shared between all clients.
-If you want, for example, to limit all speed except access to POP3, you can use
+if you want, for example, to limit all speed ecept access to POP3 you can use
 .br
  nobandlimin * * * 110
 .br
@@ -893,17 +891,17 @@ connlim limits a number of parallel connections.
 .br
  connlim 20 0 * 127.0.0.1
 .br
- allows 20 simultaneous connections for 127.0.0.1.
+ allows 20 simulationeous connections for 127.0.0.1.
 .br
- Like with bandlimin, if an individual limit is required per client, a separate
+ Like with bandlimin, if individual limit is required per client, separate
-rule must be added for every client. Like with nobandlimin, noconnlim adds an
+rule mustbe added for every client. Like with nobanlimin, noconnlim adds an
 exception.
 
 
 
 .br
 .B counter
-<filename> <reporttype> <reportname>
+<filename> <reporttype> <repotname>
 .br
 .B countin
 <number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
@@ -930,29 +928,29 @@ exception.
 <weekdayslist> <timeperiodslist>
 .br
 
- counter, countin, nocountin, countout, nocountout, countall,
+ counter, countin, nocountin, countout, noucountout, countall,
-nocountall commands are used to set a traffic limit
+nocountall commands are used to set traffic limit
-in MB for a period of time (day, week or month). Filename is a path
+in MB for period of time (day, week or month). Filename is a path
 to a special file where traffic information is permanently stored.
-The number is the sequential number of the record in this file. If the number is 0,
+number is sequential number of record in this file. If number is 0
-this counter is not preserved in the counter file (that is,
+this counter is not preserved in counter file (that is
-if the proxy is restarted, all counters with 0 are flushed); otherwise, it
+if proxy restarted all counters with 0 are flushed) overwise it
-should be a unique sequential number which points to the position of
+should be unique sequential number which points to position of
-the counter within the file.
+the couter within the file.
 Type specifies a type of counter. Type is one of:
 .br
- H - counter is reset hourly
+ H - counter is resetted hourly
 .br
- D - counter is reset daily
+ D - counter is resetted daily
 .br
- W - counter is reset weekly
+ W - counter is resetted weekly
 .br
- M - counter is reset monthly
+ M - counter is resetted monthely
 .br
- reporttype/reportname may be used to generate traffic reports.
+ reporttype/repotname may be used to generate traffic reports.
-Reporttype is one of D, W, M, H (hourly) and reportname specifies the filename
+Reporttype is one of D,W,M,H(hourly) and repotname specifies filename
-template for reports. The report is a text file with counter values in
+template for reports. Report is text file with counter values in
-the format:
+format:
 .br
  <COUNTERNUMBER> <TRAF>
 .br
@@ -978,13 +976,13 @@ username[:pwtype:password] ...
 .br
  users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
 .br
- Note: double quotes are required because the password contains a $ sign.	
+ Note: double quotes are requiered because password contains $ sign.	
 
 .br
 .B flush
 .br
- empty the active access list. The access list must be flushed every time you create a
+ empty active access list. Access list must be flushed avery time you creating
-new access list for a new service. For example:
+new access list for new service. For example:
 .br
  allow *
 .br
@@ -1045,14 +1043,14 @@ for all threads.
 .B stacksize
 <value_to_add_to_default_stack_size>
 .br
- Change the default size for thread stacks. May be required in some situations,
+ Change default size for threads stack. May be required in some situation,
-e.g. with non-default plugins, or on some platforms (some FreeBSD versions
+e.g. with non-default plugins, on on some platforms (some FreeBSD version
-may require adjusting the stack size due to an incorrectly defined value in system
+may require adjusting stack size due to invalid defined value in system
-header files; this value is also often required to be changed for ODBC and
+header files, this value is also oftent reqruied to be changed for ODBC and
-PAM support on Linux). If you experience 3proxy
+PAM support on Linux. If you experience 3proxy
 crash on request processing, try to set some positive value. You may start with
 stacksize 65536 
-and then find the minimal value for the service to work. If you experience
+and then find the minimal value for service to work. If you experience
 memory shortage, you can try to experiment with negative values.
 
 .SH PLUGINS
@@ -1072,9 +1070,9 @@ as
 .B filtermaxsize
 <max_size_of_data_to_filter>
 .br
- If Content-length (or another data length) is greater than the given value, no
+ If Content-length (or another data length) is greater than given value, no
-data filtering will be performed through filtering plugins to avoid data
+data filtering will be performed thorugh filtering plugins to avoid data
-corruption and/or Content-Length changing. Default is 1MB (1048576).
+corruption and/or Content-Length chaging. Default is 1MB (1048576).
 
 .SH BUGS
 Report all bugs to

man/ftppr.8

@@ -19,7 +19,7 @@ servers.
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -28,17 +28,17 @@ Be silenT. Do not log start/stop/accept error records.
 Never look for username authentication.
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -h
-Default destination. It's used if the target address is not specified by the user.
+Default destination. It's used if targed address is not specified by user.
 .TP
 .B -p
 Port. Port proxy listens for incoming connections. Default is 21.
@@ -48,7 +48,7 @@ Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
@@ -56,24 +56,24 @@ syslog is used for logging.
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
 crashes.
 .SH CLIENTS
-You can use any FTP client, regardless of FTP proxy support. For a client with
+You can use any FTP client, regardless of FTP proxy support. For client with
-FTP proxy support, configure
+FTP proxy support configure
 .I internal_ip
 and
 .IR port
-in the FTP proxy parameters.
+in FTP proxy parameters.
-For clients without FTP proxy support, use
+For clients without FTP proxy support use
 .I internal_ip
 and
 .IR port
-as the FTP server. The address of the real FTP server must be configured as a part of
+as FTP server. Address of real FTP server must be configured as a part of
-the FTP username. The format for the username is
+FTP username. Format for username is
 .IR username \fB@ server ,
 where
 .I server
-is the address of the FTP server and
+is address of FTP server and
 .I username
-is the user\'s login on this FTP server. The login itself may contain an \'@\' sign.
+is user\'s login on this FTP server. Login itself may contain \'@\' sign.
 Only cleartext authentication is currently supported.
 .SH BUGS
 Report all bugs to

man/pop3p.8

@@ -19,7 +19,7 @@ servers.
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -28,27 +28,27 @@ Be silenT. Do not log start/stop/accept error records.
 Never look for username authentication.
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -p
 Port. Port proxy listens for incoming connections. Default is 110.
 .TP
 .B -h
-Default destination. It's used if the target address is not specified by the user.
+Default destination. It's used if targed address is not specified by user.
 .TP
 .B -l
 Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
@@ -56,21 +56,21 @@ syslog is used for logging.
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
 crashes.
 .SH CLIENTS
-You can use any MUA (Mail User Agent) with POP3 support. Set the client to use
+You can use any MUA (Mail User Agent) with POP3 support. Set client to use
 .I internal_ip
 and
 .IR port
-as a POP3 server. The address of the real POP3 server must be configured as a part of
+as a POP3 server. Address of real POP3 server must be configured as a part of
-the POP3 username. The format for the username is
+POP3 username. Format for username is
 .IR username \fB@ server ,
 where
 .I server
-is the address of the POP3 server and
+is address of POP3 server and
 .I username
-is the user\'s login on this POP3 server. The login itself may contain an \'@\' sign.
+is user\'s login on this POP3 server. Login itself may contain \'@\' sign.
 Only cleartext authentication is supported, because challenge-response
-authentication (APOP, CRAM-MD5, etc.) requires a challenge from the server before
+authentication (APOP, CRAM-MD5, etc) requires challenge from server before
-we know which server to connect to.
+we know which server to connect.
 .SH BUGS
 Report all bugs to
 .BR 3proxy@3proxy.org

man/proxy.8

@@ -17,7 +17,7 @@ is HTTP gateway service with HTTPS and FTP over HTTPS support.
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -26,14 +26,14 @@ Be silenT. Do not log start/stop/accept error records.
 Never ask for username authentication
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -a
 Anonymous. Hide information about client.
@@ -57,12 +57,12 @@ syslog is used for logging.
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
 crashes.
 .SH CLIENTS
-You should use a client with HTTP proxy support or configure a router to redirect
+You should use client with HTTP proxy support or configure router to redirect
-HTTP traffic to the proxy (transparent proxy). Configure the client to connect to
+HTTP traffic to proxy (transparent proxy). Configure client to connect to
 .I internal_ip
 and
 .IR port .
-HTTPS support allows you to use almost any TCP-based protocol. If you need to
+HTTPS support allows to use almost any TCP based protocol. If you need to
 limit clients, use 
 .BR 3proxy (8)
 instead.

man/smtpp.8

@@ -19,7 +19,7 @@ servers.
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -28,27 +28,27 @@ Be silenT. Do not log start/stop/accept error records.
 Never look for username authentication.
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -p
 Port. Port proxy listens for incoming connections. Default is 25.
 .TP
 .B -h
-Default destination. It's used if the target address is not specified by the user.
+Default destination. It's used if targed address is not specified by user.
 .TP
 .B -l
 Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
@@ -57,21 +57,21 @@ Increase or decrease stack size. You may want to try something like -S8192 if yo
 crashes.
 .SH CLIENTS
 You can use any MUA (Mail User Agent) with SMTP authentication support.
-Set the client to use
+Set client to use
 .I internal_ip
 and
 .IR port
-as an SMTP server. The address of the real SMTP server must be configured as a part of
+as a SMTP server. Address of real SMTP server must be configured as a part of
-the SMTP username. The format for the username is
+SMTP username. Format for username is
 .IR username \fB@ server ,
 where
 .I server
-is the address of the SMTP server and
+is address of SMTP server and
 .I username
-is the user\'s login on this SMTP server. The login itself may contain an \'@\' sign.
+is user\'s login on this SMTP server. Login itself may contain \'@\' sign.
 Only cleartext authentication is supported, because challenge-response
-authentication (CRAM-MD5, SPA, etc.) requires a challenge from the server before
+authentication (CRAM-MD5, SPA, etc) requires challenge from server before
-we know which server to connect to.
+we know which server to connect.
 .SH BUGS
 Report all bugs to
 .BR 3proxy@3proxy.org

man/socks.8

@@ -19,7 +19,7 @@ outgoing and reverse TCP connections and UDP portmapping.
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -28,19 +28,19 @@ Be silenT. Do not log start/stop/accept error records.
 Never ask for username authentication
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. External IP must be specified if you need incoming connections.
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -N
-External NAT address 3proxy reports to client for BIND and UDPASSOC.
+External NAT address 3proxy reports to client for BIND and UDPASSOC
-By default, the external address is reported. It's only useful in the case
+By default external address is reported. It's only useful in the case
-of IP-IP NAT (will not work for PAT).
+of IP-IP NAT (will not work for PAT)
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -p
 Port. Port proxy listens for incoming connections. Default is 1080.
@@ -58,7 +58,7 @@ syslog is used for logging.
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
 crashes.
 .SH CLIENTS
-You should use a client with SOCKS support or use some socksification support
+You should use client with SOCKS support or use some socksification support
 (for example
 .I SocksCAP
 or
@@ -67,9 +67,9 @@ Configure client to use
 .I internal_ip
 and
 .IR port .
-SOCKS allows you to use almost any application protocol without limitation. This
+SOCKS allows to use almost any application protocol without limitation. This
-implementation also allows you to open privileged ports on the server (if socks has
+implementation also allows to open priviledged port on server (if socks has
-sufficient privileges). If you need to control access, use
+sufficient privileges). If you need to control access use
 .BR 3proxy (8)
 instead.
 .SH BUGS

man/tcppm.8

@@ -17,27 +17,27 @@ forwards connections from local to remote TCP port
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -l
 Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
@@ -47,19 +47,19 @@ crashes.
 .SH ARGUMENTS
 .TP
 .I local_port
-- port tcppm accepts connections on
+- port tcppm accepts connection
 .TP
 .I remote_host
-- IP address of the host the connection is forwarded to
+- IP address of the host connection is forwarded to
 .TP
 .I remote_port
-- remote port the connection is forwarded to
+- remote port connection is forwarded to
 .SH CLIENTS
-Any TCP-based application can be used as a client. Use
+Any TCP based application can be used as a client. Use
 .I internal_ip
 and
 .I local_port
-as the destination in the client application. The connection is forwarded to
+as a destination in client application. Connection is forwarded to
 .IR remote_host : remote_port
 .SH BUGS
 Report all bugs to

man/tlspr.8

@@ -11,15 +11,15 @@
 .IB \fR[ -i internal_ip\fR]
 .IB \fR[ -e external_ip\fR]
 .SH DESCRIPTION
-.B tlspr
+.B proxy
-is an SNI gateway service (destination host is taken from TLS handshake). The destination port must be specified via the -P option (or it may be detected with the Transparent plugin).
+is SNI gateway service (destination host is taken from TLS handshake). Destination port must be specified via -P option (or it may be detected with Transparent plugin).
 .SH OPTIONS
 .TP
 .B -I
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
@@ -28,14 +28,14 @@ Be silenT. Do not log start/stop/accept error records.
 Never ask for username authentication
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate connections
+External address. IP address of interface proxy should initiate connections
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts connections to.
+Internal address. IP address proxy accepts connections to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -a
 Anonymous. Hide information about client.
@@ -47,17 +47,17 @@ Anonymous. Show fake information about client.
 listening_port. Port proxy listens for incoming connections. Default is 1443.
 .TP
 .B -P
-destination_port. Port to establish outgoing connections. Required unless the Transparent plugin is used, because the TLS handshake does not contain port information. Default is 443.
+destination_port. Port to establish outgoing connections. One is required unless Transparent plugin is not used because TLS handshake does not contain port information. Default is 443.
 .TP
 .B -c
-TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to pass, 1 - require TLS, only check client HELLO packet, 2 - require TLS, check both client and server HELLO, 3 - require TLS, check that the server sends a certificate (not compatible with TLS 1.3), 4 - require mutual TLS, check that the server sends a certificate request and the client sends a certificate (not compatible with TLS 1.3)
+TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to pass, 1 - require TLS, only check client HELLO packet, 2 - require TLS, check both client and server HELLO, 3 - require TLS, check server send certificate (not compatible with TLS 1.3), 4 - require mutual TLS, check server send certificate request and client sends certificate (not compatible with TLS 1.3)
 .TP
 .B -l
 Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
@@ -65,12 +65,13 @@ syslog is used for logging.
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
 crashes.
 .SH CLIENTS
-You should use a client with TLS support or configure a router to redirect
+You should use client with HTTP proxy support or configure router to redirect
-TLS traffic to the proxy (transparent proxy). Configure the client to connect to
+HTTP traffic to proxy (transparent proxy). Configure client to connect to
 .I internal_ip
 and
 .IR port .
-If you need to limit clients, use
+HTTPS support allows to use almost any TCP based protocol. If you need to
+limit clients, use 
 .BR 3proxy (8)
 instead.
 .SH BUGS

man/udppm.8

@@ -3,7 +3,7 @@
 .B udppm
 \- UDP port mapper
 .SH SYNOPSIS
-.BR "udppm " [ -ds ]
+.BR "pop3p " [ -ds ]
 .IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
 .IB \fR[ -i internal_ip\fR]
 .IB \fR[ -e external_ip\fR]
@@ -17,35 +17,35 @@ forwards datagrams from local to remote UDP port
 Inetd mode. Standalone service only.
 .TP
 .B -d
-Daemonize. Detach service from console and run in the background.
+Daemonise. Detach service from console and run in the background.
 .TP
 .B -t
 Be silenT. Do not log start/stop/accept error records.
 .TP
 .B -e
-External address. IP address of the interface the proxy should initiate datagrams
+External address. IP address of interface proxy should initiate datagrams
 from. 
-By default, the system will decide which address to use in accordance
+By default system will deside which address to use in accordance
-with the routing table.
+with routing table.
 .TP
 .B -i
-Internal address. IP address the proxy accepts datagrams to.
+Internal address. IP address proxy accepts datagrams to.
-By default, connections to any interface are accepted. It\'s usually unsafe.
+By default connection to any interface is accepted. It\'s usually unsafe.
 .TP
 .B -l
 Log. By default logging is to stdout. If
 .I logfile
 is specified logging is to file. Under Unix, if
 .RI \' @ \'
-precedes
+preceeds
 .IR logfile ,
 syslog is used for logging.
 .TP
 .B -s
-Single packet. By default, only one client can use the udppm service, but
+Single packet. By default only one client can use udppm service, but
-if -s is specified, only one packet will be forwarded between client and server.
+if -s is specified only one packet will be forwarded between client and server.
-This allows the service to be shared between multiple clients for single-packet services
+It allows to share service between multiple clients for single packet services
-(for example, name lookups).
+(for example name lookups).
 .TP
 .B -S
 Increase or decrease stack size. You may want to try something like -S8192 if you experience 3proxy
@@ -53,7 +53,7 @@ crashes.
 .SH ARGUMENTS
 .TP
 .I local_port
-- port udppm accepts datagrams on
+- port udppm accepts datagrams
 .TP
 .I remote_host
 - IP address of the host datagrams are forwarded to
@@ -61,11 +61,11 @@ crashes.
 .I remote_port
 - remote port datagrams are forwarded to
 .SH CLIENTS
-Any UDP-based application can be used as a client. Use
+Any UDP based application can be used as a client. Use
 .I internal_ip
 and
 .I local_port
-as the destination in the client application. All datagrams are forwarded to
+as a destination in client application. All datagrams are forwarded to
 .IR remote_host : remote_port
 .SH BUGS
 Report all bugs to