Forward SNI proxy with multiple gateways reddit / selfhosted ---------------------------------------------------------------------- SlowStopper · 2023-12-08 12:03 Hi there, I'm in need of a solution (and I'll let you connect the dots why I need to do this yourself ;-) ). I've got an Android device on which a bunch a applications run. Thing is, some of the applications only work when their traffic goes through a VPN. I \*can\* put all the traffic through it, but I'd rather not. So I thought, it should be fairly easy to put a transparent proxy in my network that would work like this: 1. Intercept HTTPS connection. 2. Check SNI in the initial packet. 3. Based on it select either normal gateway or VPN gateway to forward the connection through. Nice, clean, doesn't require TLS decryption (said applications use certificate pinning, so traffic has to be kept encrypted). So I've been looking through Internet for past week and can't find any examples of that. Sure, HAProxy or Squid can do 1. and 2., but for 3. they actually require a proxy (as this feature is supposed to work as reverse proxy), not a gateway. It's possible it would work if I configured 3 proxies (1 reverse and 2 forwarding, with different default routes), but it seems like huge overkill. I found that Envoy can (probably) do that, but I don't quite understand how and how to deploy it on my Proxmox server. Any suggestions/help? ---------------------------------------------------------------------- ElevenNotes · 2023-12-08 12:35 You can use nginx with stream and a map table for the different FQDN and forward the stream like this. Yes you would need two additional forwarders (stream) again, but you can simply achieve this with 3 nginx containers and your VPN container and route traffic like this. map $ssl_preread_server_name $upstream For the mapping to different upstreams. ---------------------------------------------------------------------- ericesev · 2023-12-08 14:17 >Check SNI in the initial packet TLS 1.3 added support for encrypted SNI. Have you double-checked that the SNI header in the initial packet is not encrypted? [https://blog.cloudflare.com/encrypted- sni/](https://blog.cloudflare.com/encrypted-sni/) ---------------------------------------------------------------------- ithilelda · 2023-12-08 15:45 - why would you need a transparent proxy instead of an http/socks5 proxy? The latter doesn't need to intercept or inspect anything, just have your app respect the proxy setting of your android system. - haproxy, npm and envoy are all reverse proxies. they are not proxies. You would never get what you need with them. - we usually use exactly what you need as a way to circumvent censorship in China. I'm using one as I'm typing now. But the documentations are mostly in Chinese, and a previous incident has scared the sh*t out of those authors so they are pretty hard to find lol. I'll lead you to the repo on github, but you may have a hard time setting it up on your own. here they are: the commandline binaries that could be run on the server/router: clash meta: https://github.com/MetaCubeX/mihomo (the repo is a decoy. the bins and sources are actually in the release lol) sing-box: https://github.com/SagerNet/sing-box the android graphical client: nekobox: https://github.com/MatsuriDayo/NekoBoxForAndroid clash for android: https://github.com/MetaCubeX/ClashMetaForAndroid the desktop client: clash verge: https://github.com/clash-verge-rev/clash-verge-rev ---------------------------------------------------------------------- SlowStopper · 2023-12-10 12:31 I'll have a look, thanks. As for app support, I'm not sure if apps in question actually honor proxy settings, but that's something to check. ---------------------------------------------------------------------- ithilelda · 2023-12-11 01:05 most android app should repect your proxy setting unless they aren't using the default libraries. Windows, not so much. But they should provide a setting somewhere. ---------------------------------------------------------------------- SlowStopper · 2023-12-11 14:14 All right, assuming that I can make the app work with a proxy, would you mind helping me with simple config file? Let's say that for address '[www.wired.com](https://www.wired.com)' I want to route traffic through interface eth1, and everything else through eth0. Based on the documentation, I'm not even sure it's possible... ---------------------------------------------------------------------- ithilelda · 2023-12-12 03:58 sure, not at all. so sing-box's outgoing traffic is setup by defining outbounds. every outbound has a list of common field called Dial Fields. In its doc, there is a "bind_interface" setting that binds such outbound to a specific interface. The Route rules are whitelists. If matches a certain criteria, the outbound of such rule is used, otherwise the default outbound is used. The default outbound can be defined in the Route config with the "final" field, or the first outbound would be used. With that said, you could define an outbound that binds to eth0 (let's call it default), and another binds to eth1 (let's call it routing). Then define a route rule that matches your domain and route to the "routing" outbound. It would look like this: { "outbounds": [ { "tag": "default", "type": whatever you setup it to be, "bind_interface": "eth0" }, { "tag": "routing", "type": whatever you setup it to be, "bind_interface": "eth1" } ], "route": { "rules": [ { "domain": "www.wired.com", "outbound": "routing" } ] } } ---------------------------------------------------------------------- SlowStopper · 2023-12-19 10:15 OK, got as far as running the thing, but apparently I need an "inbound" object as well, so sing-box knows what to listen for. I see that there is both HTTP mode and TLS mode, however TLS requires decrypting traffic - a no-go, since the application I want to redirect is using certificate pinning. This is why I have to rely on an unencrypted SNI and not anything else to redirect traffic. Do you know if sing-box is capable of that? I can't find any relevant "inbound". ---------------------------------------------------------------------- ithilelda · 2023-12-20 10:57 there's also socks5. ---------------------------------------------------------------------- SlowStopper · 2023-12-21 10:25 How that does change the issue?