Forward proxy with caddy2

Forza · August 2, 2022, 7:25am

Hi,

Is there a way to setup Caddy2 as a forward proxy? I saw a post from two years ago that this was planned for the forwardproxy plugin (Making a forward proxy with v2) but it seems to not work to build.

Could I use caddy-l4 Modules - Caddy Documentation to achieve something similar? I want to run a pure proxy with no website.

The proxy should authenticate against upstream. Clients should not use any authentication.

matt · August 2, 2022, 3:39pm

The v2 branch works:

github.com/caddyserver/forwardproxy

Support Caddy 2

caddyserver:master ← caddyserver:caddy2

opened 11:25PM - 20 Apr 20 UTC

mholt

+2058 -1462

All the tests pass. I tried to keep as much as possible the same, but a few thi…ngs don't translate well to Caddy 2, notably one test in probe_resist_test.go on L200, I had to change that test case since I didn't quite understand why it was the way it was before. **Have not vetted this for privacy or security guarantees. Do not rely on this code.** Example config: ```json { "apps": { "http": { "servers": { "srv0": { "listen": [ ":443" ], "logs": {}, "routes": [ { "handle": [ { "handler": "forward_proxy" } ] }, { "match": [ { "host": ["foo.localhost"] } ], "handle": [ { "handler": "static_response", "body": "Yahaha! You found me!" } ] } ] } } } } } ``` @sergeyfrolov Please give this a once-over if you have a chance. Or better yet, ping me in Slack so I can give you a brief walkthrough of the changes. It'd be good to have an extra set of eyeballs review any sensitive parts that I might have (probably) botched up. I also wonder if we can remove basicauth logic out from this code and use Caddy 2's existing basicauth module instead. Let's chat when you have a chance. But, if I don't hear from you in the next couple weeks I might just go ahead anyway. Thanks!

As far as I know. There’s a failing test but I think it’s because the test is wrong (I couldn’t figure out how to get it ported from Caddy 1 setup). Still, I can’t prove that, so if you absolutely need the assurance of privacy (i.e. if your physical safety is at risk) I would maybe wait until someone with expertise volunteers to test it thoroughly. (I even do not have the necessary experience for that.)

system · September 1, 2022, 7:26am

This topic was automatically closed after 30 days. New replies are no longer allowed.