3proxy transparent proxying (Linux/BSD only)

Transparent proxying is part of 3proxy itself since 1.0.1. It was the separate TransparentPlugin before that, and the plugin line that used to load it is no longer needed: the transparent and notransparent commands are always available on the platforms that can redirect a connection.

It turns 3proxy into a transparent proxy for virtually any TCP-based protocol, with the rest of 3proxy applying as usual - redirections, parent proxies, ACLs, traffic limitations and logging. The destination IP and port come from the packet filter that redirected the connection, and are used as the target of the proxied connection.

log /path/to/log
auth iponly
allow * * * 80
parent 1000 http 0.0.0.0 0
allow *
parent 1000 socks5 SOCKS5_IP SOCKS5_PORT USER PASSWORD

transparent
tcppm -eLOCAL_IP 12345 127.0.0.1 11111
notransparent
proxy

Any TCP traffic redirected to port 12345 is routed through the parent SOCKSv5 proxy and logged, with the URLs of web requests visible in the log. The '127.0.0.1 11111' arguments are not used in that case: they are replaced by the destination the client was trying to reach.

The destination is looked up in pf on the BSDs, through /dev/pf, and asked of the kernel on Linux; a redirection that leaves the address on the socket is used where there is one. transparent takes an optional auto, netfilter, pf or socket to pin that choice.

The redirection rules must not match the connections 3proxy itself makes, or the traffic returns to the proxy and loops. Give the service an address to connect from with -e and exclude it in the rules, or run 3proxy as its own account and exclude that account.

Redirection rules for iptables, nftables, firewalld, ufw and pf are in How to proxy transparently, and the commands are described in 3proxy.cfg(5).