3proxy/man/3proxy.cfg.3

.TH 3proxy.cfg "8" "January 2019" "3proxy 0.9" "Universal proxy server"
.SH NAME
.B 3proxy.cfg
3proxy configuration file
.SH DESCRIPTION
 Common structure:
.br
 Configuration file is a text file 3proxy reads configuration from. Each line
of the file is a command executed immediately, as if it were given from the
console. The sequence of commands is important. The configuration file is actually a
script for the 3proxy executable.
Each line of the file is treated as a blank (space or tab) separated
command line. Additional space characters are ignored. 
Think about 3proxy as "application level router" with console interface.

.br
 Comments:
.br
 Any line beginning with a space character or \'#\' character is a comment. It\'s
ignored. <LF>s are ignored. <CR> is the end of a command.

.br
 Quotation:
.br
 The quotation character is " (double quote). Quotation must be used to quote
spaces or other special characters. To use a quotation character inside
a quoted string, the character must be doubled (BASIC convention). For example, to use
HELLO "WORLD" as an argument, you should write it as "HELLO ""WORLD""".
Good practice is to quote any argument you use.

.br
 File inclusion:
.br
 You can include file by using $FILENAME macro (replace FILENAME with a path
to file, for example $/usr/local/etc/3proxy/conf.incl or 
 $"c:\\\\Program Files\\3proxy\\include.cfg" Quotation is
required in last example because path contains space character. 
For included file <CR> (end of line characters) is treated as space character
(arguments delimiter instead of end of command delimiter). 
Thus, include files are only useful to store long single-line commands
(like userlist, network lists, etc).
To use dollar sign somewhere in argument it must be quoted. 
Recursion is not allowed.

.br
 Next commands start gateway services:

.br
.B proxy
[options]
.br
.B socks
[options]
.br
.B pop3p
[options]
.br
.B ftppr
[options]
.br
.B admin
[options]
.br
.B dnspr
[options]
.br
.B tcppm
[options]
<SRCPORT> <DSTADDR> <DSTPORT>
.br
.B udppm
[options]
<SRCPORT> <DSTADDR> <DSTPORT>
.br
 Descriptions:
.br
.B proxy
HTTP/HTTPS proxy (default port 3128)
.br
.B socks
SOCKS 4/4.5/5 proxy (default port 1080)
.br
.B tlspr
SNI proxy (destination address is taken from TLS handshake), may be used to redirect any TLS-based traffic
.br
.B auto
Proxy with protocol autoselection between proxy / socks / tlspr 
.br
.B pop3p
POP3 proxy (default port 110)
.br
.B smtpp
SMTP proxy (default port 25)
.br
.B ftppr
FTP proxy (default port 21)
.br
.B admin
Web interface (default port 80)
.br
.B dnspr
caching DNS proxy (default port 53)
.br
.B tcppm
TCP portmapper
.br
.B udppm
UDP portmapper

.br
 Options:
.br
.B -pNUMBER
change default server port to NUMBER
.br
.B -n
disable NTLM authentication (required if passwords are stored in Unix crypt format).
.br
.B -n1
enable NTLMv1 authentication.
.br
.B -g(GRACE_TRAFF,GRACE_NUM,GRACE_DELAY)
delay GRACE_DELAY milliseconds before polling if average polling size is below GRACE_TRAFF bytes and GRACE_NUM read operations in a single direction are detected within 1 second. Useful to minimize polling
.B -s
 (for admin) secure, allow only secure operations, currently only traffic counters
view without ability to reset.
.br
 (for dnspr) simple, do not use resolver and 3proxy cache, always use external DNS server.
.br
 (for udppm) singlepacket, expect only one packet from both client and server
.br
.B -u
Never ask for username/password
.br
.B -u2
(for socks) require username/password in authentication methods
.br
.B -a
(for proxy) anonymous proxy (no information about client reported)
.br
.B -a1
(for proxy) anonymous proxy (random client information reported)
.br
.B -a2
(for proxy) generate Via: and X-Forwarded-For: instead of Forwarded:
.br
.B -6
Only resolve IPv6 addresses. IPv4 addresses are packed in IPv6 in IPV6_V6ONLY compatible way.
.br
.B -4
Only resolve IPv4 addresses
.br
.B -46
Resolve IPv6 addresses if IPv4 address is not resolvable
.br
.B -64
Resolve IPv4 addresses if IPv6 address is not resolvable
.br
.B -RHOST:port
listen on given local HOST:port for incoming connections instead of making remote outgoing connection. Can be used with another 3proxy service running -r option for connect back functionality. Most commonly used with tcppm. HOST can be given as IP or hostname, useful in case of dynamic DNS.
.br
.B -rHOST:port
connect to given remote HOST:port instead of listening local connection on -p or default port. Can be used with another 3proxy service running -R option for connect back functionality. Most commonly used with proxy or socks. HOST can be given as IP or hostname, useful in case of dynamic DNS.
.br
.B -ocOPTIONS, -osOPTIONS, -olOPTIONS, -orOPTIONS, -oROPTIONS
options for proxy-to-client (oc), proxy-to-server (os), proxy listening (ol), connect back client (or), connect back listening (oR) sockets.
Options like TCP_CORK, TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS, USE_TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT, SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE, SO_DONTROUTE may be supported depending on OS.
.br
.B -DiINTERFACE, -DeINTERFACE
bind internal interface / external interface to given INTERFACE (e.g. eth0) if SO_BINDTODEVICE is supported by the system. You may need to run as root or have CAP_NET_RAW capability in order to bind to an interface, depending on the system, so this option may require root privileges and can be incompatible with some configuration commands like chroot and setuid (and daemon if setcap is used).
.br
.B -e
External address. IP address of the interface the proxy should initiate connections
from. External IP must be specified if you need incoming connections.
By default the system will decide which address to use in accordance
with the routing table.
.br
.B -i
Internal address. IP address the proxy accepts connections to.
By default, connections to any interface are accepted. 
.br
.B -N
(for socks) External NAT address 3proxy reports to client for BIND and UDPASSOC
By default external address is reported. It's only useful in the case
of IP-IP NAT (will not work for PAT)
.br
 Also, all options mentioned for 
.BR proxy (8)
.BR socks (8)
.BR pop3p (8)
.BR tcppm (8)
.BR udppm (8)
.BR ftppr (8)
 are also supported.
.br
 Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT
HTTP and SOCKS proxies are standard. 
.br
 POP3 proxy must be configured as POP3 server and requires username in the form of:
pop3username@pop3server. If POP3 proxy access must be authenticated, you can
specify username as proxy_username:proxy_password:POP3_username@pop3server
.br
 DNS proxy resolves any types of records but only hostnames are cached. It
requires nserver/nscache to be configured. If nserver is configured as TCP,
redirections are applied on connection, so parent proxy may be used to resolve
names to IP.
.br
 FTP proxy can be used as FTP server in any FTP client or configured as FTP
proxy on a client with FTP proxy support. Username format is one of
.br
 FTPuser@FTPServer
.br
 FTPuser:FTPpassword@FTPserver
.br
 proxyuser:proxypassword:FTPuser:FTPpassword@FTPserver
.br
 Please note, if you use FTP client interface for FTP proxy do not add FTPpassword and FTPServer to username, because FTP client does it for you. That is, if you use 3proxy with authentication use proxyuser:proxypassword:FTPuser as FTP username, otherwise do not change original FTP user name

.br
.B include
<path>
.br
 Include config file

.br
.B config
<path>
.br
 Path to configuration file to use on 3proxy restart or to save configuration.

.br
.B writable
.br
 ReOpens configuration file for write access via Web interface,
and rereads it. Usually should be first command on config file
but in combination with config
it can be used anywhere to open
alternate config file. Think twice before using it.

.br
.B end
.br
 End of configuration

.br
.B log
[[@|&]logfile] [<LOGTYPE>]
.br
 sets logfile for all gateways
.br
 @ (for Unix) use syslog, filename is used as ident name
.br
 & use ODBC, filename consists of comma-delimited datasource,username,password (username and password are optional)
.br
 radius - use RADIUS for logging
.br
 LOGTYPE is one of:
.br
  M Monthly
.br
  W Weekly (starting from Sunday)
.br
  D Daily
.br
  H Hourly
.br
 if logfile is not specified logging goes to stdout. You can specify individual logging options for gateway by using -l
option in gateway configuration.
.br
 log command supports same format specifications for filename template
as "logformat" (if filename contains \'%\' sign it\'s believed to be template).
As with "logformat" filename must begin with \'L\' or \'G\' to specify Local or
Grinwitch time zone for all time-based format specificators.

.br
.B rotate
<n>
 how many archived log files to keep

.br
.B logformat
<format>
.br
 Format for log record. First symbol in format must be L (local time)
or G (absolute Grinwitch time). 
It can be preceeded with -XXX+Y where XXX is list of characters to be
filtered in user input (any non-printable characters are filtered too
in this case) and Y is replacement character. For example, "-,%+ L" in
the beginning of logformat means comma and percent are replaced
with space and all time based elemnts are in local time zone.
.br
 You can use:

.br
  %y Year in 2 digit format
.br
  %Y Year in 4 digit format
.br
  %m Month number
.br
  %o Month abbreviation
.br
  %d Day
.br
  %H Hour
.br
  %M Minute
.br
  %S Second
.br
  %t Timestamp (in seconds since 01-Jan-1970)
.br
  %. milliseconds
.br
  %z time zone (from Greenwich)
.br
  %D request duration (in milliseconds)
.br
  %b average send rate per request (in bytes per second); this speed is typically below the connection speed shown by the download manager.
.br
  %B average receive rate per request (in bytes per second); this speed is typically below the connection speed shown by the download manager.
.br
  %U Username
.br
  %N service Name
.br
  %p service Port
.br
  %E Error code
.br
  %C Client IP
.br
  %c Client port
.br
  %R Remote IP
.br
  %r Remote port
.br
  %i Internal IP used to accept client connection
.br
  %e External IP used to establish connection
.br
  %Q Requested IP
.br
  %q Requested port
.br
  %n requested hostname
.br
  %I bytes In
.br
  %O bytes Out
.br
  %h Hops (redirections) count
.br
  %T service specific Text
.br
  %N1-N2T (N1 and N2 are positive numbers) log only fields from N1 through N2 of service-specific text
.br
 In the case of ODBC logging, logformat specifies an SQL statement, for example:
.br
 logformat "-\'+_Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values (\'%d-%m-%Y %H:%M:%S\', \'%U\', \'%N\', %I, %O, \'%T\')"

.br
.B logdump
<in_traffic_limit> <out_traffic_limit>
.br
 Immediately creates additional log records if given amount of incoming/outgoing
traffic is achieved for connection, without waiting for connection to finish.
It may be useful to prevent information about long-lasting downloads on server
shutdown.

.br
.B archiver
<ext> <commandline>
.br
 Archiver to use for log files. <ext> is file extension produced by
archiver. Filename will be last argument to archiver, optionally you
can use %A as produced archive name and %F as filename.

.br
.B timeouts
<BYTE_SHORT> <BYTE_LONG> <STRING_SHORT> <STRING_LONG> <CONNECTION_SHORT> <CONNECTION_LONG> <DNS> <CHAIN> <CONNECT> <CONNECTBACK>
.br
 Sets timeout values, defaults 1, 5, 30, 60, 180, 1800, 15, 60, 15, 5.
.br
 BYTE_SHORT short timeout for single byte, is usually used for receiving single byte from stream.
.br
 BYTE_LONG long timeout for single byte, is usually used for receiving first byte in frame (for example first byte in socks request).
.br
 STRING_SHORT short timeout, for character string within stream (for example to wait between 2 HTTP headers)
.br
 STRING_LONG long timeout, for first string in stream (for example to wait for HTTP request).
.br
 CONNECTION_SHORT inactivity timeout for short connections (HTTP, POP3, etc).
.br
 CONNECTION_LONG inactivity timeout for long connection (SOCKS, portmappers, etc).
.br
 DNS timeout for DNS request before requesting next server
.br
 CHAIN timeout for reading data from chained connection
.br
 default timeouts 1 5 30 60 180 1800 15 60 15 5

.br
.B radius 
<NAS_SECRET> <radius_server_1[:port][/local_address_1]> <radius_server_2[:port][/local_address_2]>
.br
 Configures RADIUS servers to be used for logging and authentication (log and auth types
must be set to radius). port and local address to use with given server may be specified.
.br
 Attributes within request: User-Name, Password: (username and password if presented by client),
Service Type: Authenticate-Only,
NAS-Port-Type: NAS-Port-Virtual,
NAS-Port-ID: (proxy service port, e.g. 1080),
NAS-IPv6-Address / NAS-IP-Address: (proxy interface accessed by client),
NAS-Identifier: (text identifing proxy, e.g. PROXY or SOCKSv5),
Framed-IPv6-Address / Framed-IP-Address: (IP address of the client),
Called-Station-ID: (requested Hostname, if presents),
Login-Service: (type of request, e.g. 1001 - SOCKS CONNECT, 1010 - HTTP GET, 1013 - HTTP CONNECT),
Login-TCP-Port: (requested port),
Login-IPv6-Host / Login-IP-Host: (requested IP). 
.br
 Supported reply attributes for authentication:
Framed-IP-Address / Framed-IPv6-Address (IP to assign to user), Reply-Message.
Use authcache to speedup authentication. RADIUS feature is currently experimental.

.br
.B nserver
<ipaddr>[:port][/tcp]
.br
 Nameserver to use for name resolutions. If none specified 
system routines for name resolution is
used. Optional port number may be specified.
If optional /tcp is added to IP address, name resolution is
performed over TCP.

.br
.B nscache
<cachesize>
.B nscache6
<cachesize>
.br
 Cache <cachesize> records for name resolution (nscache for IPv4,
nscache6 for IPv6). The cache size should usually be large enough
(for example, 65536).

.br
.B nsrecord
<hostname> <hostaddr>
.br
 Adds static record to nscache. nscache must be enabled. If 0.0.0.0
is used as a hostaddr host will never resolve, it can be used to
blacklist something or together with 
.B dialer
command to set up UDL for dialing.

.br
.B fakeresolve
.br
 All names are resolved to the 127.0.0.2 address. Useful if all requests are
redirected to a parent proxy with http, socks4+, connect+ or socks5+.

.br
.B dialer
<progname>
.br
 Execute progname if external name can\'t be resolved.
Hint: if you use nscache, dialer may not work, because names will
be resolved through cache. In this case you can use something like
http://dial.right.now/ from browser to set up connection.


.br
.B internal
<ipaddr>
.br
 sets ip address of internal interface. This IP address will be used
to bind gateways. Alternatively you can use -i option for individual
gateways. Since 0.8 version, IPv6 address may be used.

.br
.B external
<ipaddr>
.br
 sets ip address of external interface. This IP address will be source
address for all connections made by proxy. Alternatively you can use -e
option to specify individual address for gateway. Since 0.8 version
External or -e can be given twice: once with IPv4 and once with IPv6 address.
   
.br
.B maxconn
<number>
.br
 sets the maximum number of simultaneous connections to each service
started after this command at the network level. Default is 100.
.br
 To limit clients, use connlim instead. maxconn will silently ignore
new connections, while connlim will report back to the client that
the connection limit has been reached.

.br
.B backlog
.br
 sets the listening socket backlog of new connections. Default is
1 + maxconn/8. Maximum value is capped by kernel tunable somaxconn.

.br
.B service
.br
 (deprecated). Indicates that 3proxy should behave as a Windows 95/98/NT/2000/XP
service; has no effect under Unix. Not required for 3proxy 0.6 and above. If
you upgraded from a previous version of 3proxy, use --remove and --install
to reinstall the service.

.br
.B daemon
.br
 Should be specified to close the console. Do not use \'daemon\' with \'service\'.
At least under FreeBSD, \'daemon\' should precede any proxy service
and log commands to avoid socket problems. Always place it in the beginning
of the configuration file.

.br
.B auth
<authtype> [...]
.br
 Type of user authorization. Currently supported:
.br
 none - no authentication or authorization required.
.br
 Note: if auth is none, any IP-based limitation, redirection, etc. will not work.
This is the default authentication type
.br
 iponly - authentication by access control list with username ignored.
 Appropriate for most cases
.br
 useronly - authentication by username without checking for any password with
authorization by ACLs. Useful for e.g. SOCKSv4 proxy and icqpr (icqpr set UIN /
AOL screen name as a username)
.br
 dnsname - authentication by DNS hostname with authorization by ACLs.
The DNS hostname is resolved via a PTR (reverse) record and validated (the resolved
name must resolve to the same IP address). It\'s recommended to use authcache by
IP for this authentication.
NB: there is no password check; the name may be spoofed.
.br
 strong - username/password authentication required. It will work with
SOCKSv5, FTP, POP3 and HTTP proxy. 
.br
 cache - cached authentication, may be used with \'authcache\'.
.br
 radius - authentication with RADIUS.
.br
 Plugins may add additional authentication types.

.br
 It\'s possible to use multiple authentication types in the same command. E.g.
.br
 auth iponly strong
.br
 In this case, \'strong\' authentication will be used only if resource
access cannot be performed with \'iponly\' authentication, that is, a username is
required in the ACL. It\'s useful to protect access to some resources with
a password while allowing passwordless access to other resources, or to use
IP-based authentication for dedicated laptops and request a username/password for
shared ones.

.br
.B authcache
<cachtype> <cachtime>
.br
 Cache authentication information for a given amount of time (cachetime) in seconds.
Cachetype is one of:
.br
 ip - after successful authentication all connections during caching time
from same IP are assigned to the same user, username is not requested.
.br
 ip,user username is requested and all connections from the same IP are
assigned to the same user without actual authentication.
.br
 user - same as above, but IP is not checked. 
.br
 user,password - both username and password are checked against cached ones.
.br
 limit - limit user to use only one ip, \'ip\' and \'user\' are required
.br
 acl - only use cached auth if user access service with same ACL 
.br
 ext - cache external IP
.br
Use auth type \'cache\' for cached authentication

.br
.B allow
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B deny
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
 Access control entries. All lists are comma-separated, no spaces are
allowed. Usernames are case sensitive (if used with authtype nbname
username must be in uppercase). Source and target lists may contain
IP addresses (W.X.Y.Z), ranges A.B.C.D - W.X.Y.Z (since 0.8) or CIDRs (W.X.Y.Z/L). 
Since 0.6, the targetlist may also contain host names,
instead of addresses. It\'s possible to use a wildmask in
the beginning and at the end of the hostname, e.g. *badsite.com or *badcontent*.
The hostname is only checked if a hostname is present in the request.
Targetportlist may contain ports (X) or port ranges lists (X-Y). For any field *
sign means ANY. If access list is empty it\'s assumed to be
.br
 allow *
.br
 If access list is not empty last item in access list is assumed to be
.br
 deny *
.br
 You may want explicitly add deny * to the end of access list to prevent
HTTP proxy from requesting user\'s password.
Access lists are checked after user have requested any resource.
If you want 3proxy to reject connections from specific addresses
immediately without any conditions you should either bind proxy
to appropriate interface only or to use ip filters.

.br
 Operation is one of:
.br
 CONNECT establish outgoing TCP connection
.br
 BIND bind TCP port for listening
.br
 UDPASSOC make UDP association
.br
 ICMPASSOC make ICMP association (for future use)
.br
 HTTP_GET HTTP GET request
.br
 HTTP_PUT HTTP PUT request
.br
 HTTP_POST HTTP POST request
.br
 HTTP_HEAD HTTP HEAD request
.br
 HTTP_CONNECT HTTP CONNECT request
.br
 HTTP_OTHER over HTTP request
.br
 HTTP matches any HTTP request except HTTP_CONNECT
.br
 HTTPS same as HTTP_CONNECT
.br
 FTP_GET FTP get request
.br
 FTP_PUT FTP put request
.br
 FTP_LIST FTP list request
.br
 FTP_DATA FTP data connection. Note: FTP_DATA requires access to dynamic
non-privileged (1024-65535) ports on the remote side.
.br
 FTP matches any FTP/FTP Data request
.br
 ADMIN access to administration interface

.br
 Weekdays are week day numbers or periods, 0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday.
.br
 Timeperiodlists is a list of time
periods in HH:MM:SS-HH:MM:SS format. For example, 00:00:00-08:00:00,17:00:00-24:00:00 lists non-working hours.

.br
.B parent
<weight> <type> <ip> <port> <username> <password>
.br
 this command must follow "allow" rule. It extends last allow rule to
build proxy chain. Proxies may be grouped. Proxy inside the
group is selected randomly. If few groups are specified one proxy
is randomly picked from each group and chain of proxies is created
(that is second proxy connected through first one and so on).
Weight is used to group proxies. Weight is a number between 1 and 1000.
Weights are summed and proxies are grouped together until the weight of
the group is 1000. That is:
.br
 allow *
.br
 parent 500 socks5 192.168.10.1 1080
.br
 parent 500 connect 192.168.10.1 3128
.br
 makes 3proxy to randomly choose between 2 proxies for all outgoing
connections. These 2 proxies form 1 group (summarized weight is 1000).
.br
 allow * * * 80
.br
 parent 1000 socks5 192.168.10.1 1080
.br
 parent 1000 connect 192.168.20.1 3128
.br
 parent 300 socks4 192.168.30.1 1080
.br
 parent 700 socks5 192.168.40.1 1080
.br
 creates chain of 3 proxies: 192.168.10.1, 192.168.20.1 and third
is (192.168.30.1 with probability of 0.3 or 192.168.40.1
with probability of 0.7) for outgoing web connections. Chains are only applied to new connections, pipelined (keep-alive) requests in the same connection use the same chain.

.br
 type is one of:
.br
 extip does not actually redirect the request; it sets the external address for this request to <ip>. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random.
.br
 tcp simply redirect connection. TCP is always last in chain. This type of proxy is a simple TCP redirection, it does not support parent authentication.
.br
 http redirect to HTTP proxy. HTTP is always the last chain. It should only be used with http (proxy) service,
if used with different service, it works as tcp redirection.
.br
 pop3 redirect to POP3 proxy (only local redirection is supported, can only be used as a first hop in chaining)
.br
 ftp redirect to FTP proxy (only local redirection is supported, can only be used as a first hop in chaining)
.br
 connect parent is HTTP CONNECT method proxy
.br
 connect+ parent is HTTP CONNECT proxy with name resolution (hostname is used instead of IP if available)
.br
 socks4 parent is SOCKSv4 proxy
.br
 socks4+ parent is SOCKSv4 proxy with name resolution (SOCKSv4a)
.br
 socks5 parent is SOCKSv5 proxy
.br
 socks5+ parent is SOCKSv5 proxy with name resolution
.br
 socks4b parent is SOCKS4b (broken SOCKSv4 implementation with shortened
server reply; I never saw this kind of server, but they say there are some).
Normally you should not use this option. Do not confuse this option with
SOCKSv4a (socks4+).
.br
 socks5b parent is SOCKS5b (broken SOCKSv5 implementation with shortened
server reply. I think you will never find it useful). Never use this option
unless you know exactly you need it.
.br
 admin redirect request to local \'admin\' service (with -s parameter).
.br
 Use "+" proxy only with "fakeresolve" option
.br

 IP and port are ip addres and port of parent proxy server.
If IP is zero, ip is taken from original request, only port is changed.
If port is zero, it\'s taken from original request, only IP is changed.
If both IP and port are zero - it\'s a special case of local redirection,
it works only with
.B socks
proxy. In case of local redirection request is redirected to different service, 
.B ftp
locally redirects to
.B ftppr
.B pop3
locally redirects to
.B pop3p
.B http
locally redirects to
.B proxy
.B admin
locally redirects to the admin -s service.

.br
 Main purpose of local redirections is to have the requested resource
(URL or POP3 username) logged and protocol-specific filters applied.
In case of local redirection, ACLs are reviewed twice: first, by the SOCKS proxy up to the \'parent\'
command and then by the gateway service the connection is
redirected to (HTTP, FTP or POP3) after the \'parent\' command. It means
an additional \'allow\' command is required for redirected requests, for
example:
.br
 allow * * * 80
.br
 parent 1000 http 0.0.0.0 0
.br
 allow * * * 80 HTTP_GET,HTTP_POST
.br
 socks
.br
 redirects all SOCKS requests with target port 80 to local HTTP proxy,
local HTTP proxy parses requests and allows only GET and POST requests.
.br
 parent 1000 http 1.2.3.4 0
.br
 Changes the external address for a given connection to 1.2.3.4 (equivalent to -e1.2.3.4)
.br
 Optional username and password are used to authenticate on parent
proxy. Username of \'*\' means username must be supplied by user.


.br
.B nolog
<n>
.br
 extends last allow or deny command to prevent logging, e.g.
.br
allow * * 192.168.1.1
.br
nolog


.br
.B weight
<n>
.br
 extends last allow or deny command to set weight for this request
.br
 allow * * 192.168.1.1
.br
 weight 100
.br
 Weight may be used for different purposes.


.br
.B force
.br
.B noforce
.br
 If force is specified for service, configuration reload will require all current
sessions of this service to be re-authenticated. If ACL is changed or user account
is removed, old connections which do not match current are closed.
noforce allows to keep previously authenticated connections.

.br
.B bandlimin
<rate> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B nobandlimin
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B bandlimout
<rate> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B nobandlimout
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
 bandlim sets a bandwidth limitation filter to <rate> bps (bits per second).
If you want to specify bytes per second, multiply your value by 8.
bandlim rules act in the same manner as allow/deny rules, except for
one thing: bandwidth limiting is applied to all services, not to some
specific service. 
bandlimin and nobandlimin apply to incoming traffic
.br
bandlimout and nobandlimout apply to outgoing traffic
.br
If you want to ratelimit your clients with IPs 192.168.10.16/30 (4
addresses) to 57600 bps, you have to specify 4 rules like
.br
 bandlimin 57600 * 192.168.10.16
.br
 bandlimin 57600 * 192.168.10.17
.br
 bandlimin 57600 * 192.168.10.18
.br
 bandlimin 57600 * 192.168.10.19
.br
 and each of your clients will have a 56K channel. If you specify
.br
 bandlimin 57600 * 192.168.10.16/30
.br
 you will have a 56K channel shared between all clients.
If you want, for example, to limit all speed except access to POP3, you can use
.br
 nobandlimin * * * 110
.br
 before the rest of bandlim rules.

.br
.B connlim
<rate> <period> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B noconnlim
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
 connlim sets connections rate limit per time period for traffic
pattern controlled by ACL. Period is in seconds. If period is 0,
connlim limits a number of parallel connections.
.br
 connlim 100 60 * 127.0.0.1
.br
 allows 100 connections per minute for 127.0.0.1.
.br
 connlim 20 0 * 127.0.0.1
.br
 allows 20 simultaneous connections for 127.0.0.1.
.br
 Like with bandlimin, if an individual limit is required per client, a separate
rule must be added for every client. Like with nobandlimin, noconnlim adds an
exception.



.br
.B counter
<filename> <reporttype> <reportname>
.br
.B countin
<number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B nocountin
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B countout
<number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B nocountout
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B countall
<number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br
.B nocountall
<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>
.br

 counter, countin, nocountin, countout, nocountout, countall,
nocountall commands are used to set a traffic limit
in MB for a period of time (day, week or month). Filename is a path
to a special file where traffic information is permanently stored.
The number is the sequential number of the record in this file. If the number is 0,
this counter is not preserved in the counter file (that is,
if the proxy is restarted, all counters with 0 are flushed); otherwise, it
should be a unique sequential number which points to the position of
the counter within the file.
Type specifies a type of counter. Type is one of:
.br
 H - counter is reset hourly
.br
 D - counter is reset daily
.br
 W - counter is reset weekly
.br
 M - counter is reset monthly
.br
 reporttype/reportname may be used to generate traffic reports.
Reporttype is one of D, W, M, H (hourly) and reportname specifies the filename
template for reports. The report is a text file with counter values in
the format:
.br
 <COUNTERNUMBER> <TRAF>
.br
 The rest of parameters is identical to bandlim/nobandlim.

.br
.B users
username[:pwtype:password] ...
.br
 pwtype is one of:
.br
 none (empty) - use system authentication
.br
 CL - password is cleartext
.br
 CR - password is crypt-style password
.br
 NT - password is NT password (in hex)
.br
 example:
.br
 users test1:CL:password1 "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
.br
 users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
.br
 Note: double quotes are required because the password contains a $ sign.	

.br
.B flush
.br
 empty the active access list. The access list must be flushed every time you create a
new access list for a new service. For example:
.br
 allow *
.br
 pop3p
.br
 flush
.br
 allow * 192.168.1.0/24
.br
 socks
.br
 sets different ACLs for
.B pop3p
and
.B socks

.br
.B system
<command>
.br
 execute system command

.br
.B pidfile
<filename>
.br
 write pid of current process to file. It can be used to manipulate
3proxy with signals under Unix. Currently next signals are available:

.br
.B monitor
<filename>
.br
 If file monitored changes in modification time or size, 3proxy reloads
configuration within one minute. Any number of files may be monitored.

.br
.B setuid
<uid>
.br
 calls setuid(uid), uid can be numeric or since 0.9 username. Unix only. Warning: under some Linux
kernels setuid() works for current thread only. It makes it impossible to suid
for all threads.

.br
.B setgid
<gid>
.br
 calls setgid(gid), gid can be numeric or since 0.9 groupname. Unix only.

.br
.B chroot
<path> [<uid>] [<gid>]
.br
 calls chroot(path) and sets gid/uid. Unix only. uid/gid supported since 0.9, can be numeric or username/groupname

.br
.B stacksize
<value_to_add_to_default_stack_size>
.br
 Change the default size for thread stacks. May be required in some situations,
e.g. with non-default plugins, or on some platforms (some FreeBSD versions
may require adjusting the stack size due to an incorrectly defined value in system
header files; this value is also often required to be changed for ODBC and
PAM support on Linux). If you experience 3proxy
crash on request processing, try to set some positive value. You may start with
stacksize 65536
and then find the minimal value for the service to work. If you experience
memory shortage, you can try to experiment with negative values.

.SH PLUGINS

.br
.B plugin
<path_to_shared_library> <function_to_call> [<arg1> ...]
.br
 Loads specified library and calls given export function with given arguments,
as 
.br
 int functions_to_call(struct pluginlink * pl, int argc, char * argv[]);
.br
 function_to_call must return 0 in case of success, value > 0 to indicate error.

.br
.B filtermaxsize
<max_size_of_data_to_filter>
.br
 If Content-length (or another data length) is greater than the given value, no
data filtering will be performed through filtering plugins to avoid data
corruption and/or Content-Length changing. Default is 1MB (1048576).

.SH BUGS
Report all bugs to
.BR 3proxy@3proxy.org
.SH SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),
.br
 https://3proxy.org/
.SH TRIVIA
3APA3A is pronounced as \`\`zaraza\'\'.
.SH AUTHORS
3proxy is designed by Vladimir 3APA3A Dubrovin
.RI ( 3proxy@3proxy.org )