cloudflared icon indicating copy to clipboard operation
cloudflared copied to clipboard

Add HTTP proxy support for tunnel connections

Open shayonj opened this issue 5 months ago • 0 comments

This PR adds support for HTTP and SOCKS proxy configurations to cloudflared tunnel connections via standard environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY). This enables cloudflared to work in enterprise environments that require all outbound traffic to route through corporate proxy infrastructure.

Changes include:

  • Added proxyAwareDialer struct that implements both HTTP CONNECT and SOCKS proxy protocols
  • Modified rawTCPService and tcpOverWSService to use proxy.Dialer interface instead of net.Dialer
  • Added proxy detection using proxy.FromEnvironmentUsing() for SOCKS proxies and http.ProxyFromEnvironment() for HTTP proxies
  • There is now a createProxyDialer to make delegation easy
  • DNS dialer specifically uses direct connection to avoid circular dependencies when resolving proxy hostnames
  • Added tests

Proxy precedence order:

  • SOCKS proxy detection via ALL_PROXY environment variable
  • HTTP proxy detection via HTTP_PROXY/HTTPS_PROXY environment variables (supports both upper and lower case)
  1. Direct connection fallback when no proxy is configured

Authentication support:

  • Basic authentication via URL format (http://user:pass@proxy:8080)
  • Proxy-Authorization headers for HTTP CONNECT method
  • SOCKS4/SOCKS5 proxy support via golang.org/x/net/proxy

Usage Example:

export HTTP_PROXY="http://user:[email protected]:8080"
export HTTPS_PROXY="http://user:[email protected]:8080"

# Or SOCKS proxy
export ALL_PROXY="socks5://proxy.corp.com:1080"

./cloudflared tunnel run --credentials-file tunnel.json my-tunnel

Example: image

https://github.com/cloudflare/cloudflared/issues/1076

shayonj avatar Aug 02 '25 13:08 shayonj