Skip to content

Add HTTP proxy support for tunnel connections #1514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

shayonj
Copy link

@shayonj shayonj commented Aug 2, 2025

This PR adds support for HTTP and SOCKS proxy configurations to cloudflared tunnel connections via standard environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY). This enables cloudflared to work in enterprise environments that require all outbound traffic to route through corporate proxy infrastructure.

Changes include:

  • Added proxyAwareDialer struct that implements both HTTP CONNECT and SOCKS proxy protocols
  • Modified rawTCPService and tcpOverWSService to use proxy.Dialer interface instead of net.Dialer
  • Added proxy detection using proxy.FromEnvironmentUsing() for SOCKS proxies and http.ProxyFromEnvironment() for HTTP proxies
  • There is now a createProxyDialer to make delegation easy
  • DNS dialer specifically uses direct connection to avoid circular dependencies when resolving proxy hostnames
  • Added tests

Proxy precedence order:

  • SOCKS proxy detection via ALL_PROXY environment variable
  • HTTP proxy detection via HTTP_PROXY/HTTPS_PROXY environment variables (supports both upper and lower case)
  1. Direct connection fallback when no proxy is configured

Authentication support:

  • Basic authentication via URL format (http://user:pass@proxy:8080)
  • Proxy-Authorization headers for HTTP CONNECT method
  • SOCKS4/SOCKS5 proxy support via golang.org/x/net/proxy

Usage Example:

export HTTP_PROXY="http://user:[email protected]:8080"
export HTTPS_PROXY="http://user:[email protected]:8080"

# Or SOCKS proxy
export ALL_PROXY="socks5://proxy.corp.com:1080"

./cloudflared tunnel run --credentials-file tunnel.json my-tunnel

Example:
image

#1076

@shayonj shayonj force-pushed the s/proxy-fix branch 2 times, most recently from 7995418 to 664ed3f Compare August 2, 2025 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant