Caddy as transparent proxy

Plugins
1

Hi,

Are there any plugins or example templates for caddy to be configured as transparent proxy ?

In particular, I want to create a setup with caddy where client sends traffic to caddy (acting as transparent proxy). Caddy should then forward the connection to another forward proxy. The forward proxy will send the traffic to the server.

For example -  HTTPS traffic flow
Client                             Caddy                          Forward proxy        Server
==============================================================================
TLS handshake                      Extract SNI                  Respond to
                                   and send                     connect
                                   connect                        request
                                   request to
                                   forward proxy
                                   
                                   Forward TLS 
                                   handshake to
                                   Forward proxy
2

I believe you want forwardproxy.

There’s a PR to make it work for Caddy 2. It’s done, and just needs more testing.

3

Thanks Matt !

Can you please shed some light on how forward proxy can help this scenario ? Will it not expect a CONNECT request for HTTPS connections ? Whereas in transparent proxy the client will send a TLS handshake directly instead of preceding it with a CONNECT request.

4

The forwardproxy plugin will terminate TLS on an outer connection but then establish an HTTPS tunnel to a site. (Clients need to support this.)

If you want a purely transparent proxy that doesn’t terminate TLS, you can use the layer4 plugin to do TCP proxying:

(Of course, you can also use that plugin to terminate TLS, or even unwrap one TLS connection from over another, or whatever you need to do. Very flexible.)

5

Okay, so caddy-l4 should hold the tls and explicitly send a CONNECT request to the forward proxy ? Can that be achieved using a specific handler in caddy json ?

6

Posting again for some feedback -

Okay, so caddy-l4 should hold the tls and explicitly send a CONNECT request to the forward proxy ? Can that be achieved using a specific handler in caddy json ?

7

Can you please help ?
Caddy-l4 should hold the tls and explicitly send a CONNECT request to the forward proxy ? Can that be achieved using a specific handler in caddy json ?