ProxyBridge Linux 4.0.0-Beta

⚠️ This is a BETA release and we are looking for testers.
The Linux datapath has been rewritten from scratch. Please try it on your distribution and kernel and report anything that misbehaves, by opening an issue with the details listed at the bottom.

What's new

eBPF datapath replaces iptables/NFQUEUE. Traffic is now redirected by eBPF programs attached to the root cgroup. There are no iptables or nftables rules, no packet queue to the user space, and nothing to clean up after a crash: the kernel detaches the programs when ProxyBridge exits.

• TCP and UDP forced through a proxy: SOCKS5 (with username/password, and UDP ASSOCIATE) and HTTP CONNECT.
• Multiple proxies, with a different proxy per rule. Rules are evaluated in order and the first match wins.
• Rules by process, destination IP, port and protocol. Supported forms are globs, CIDR, ranges, 192.168.*.* octet wildcards, and port lists and ranges.
• Domain-name rules (for example *.github.com), learned by observing DNS answers. Domain rules can also choose the proxy.
• Actions: PROXY, DIRECT or BLOCK per rule.
• Automatic exemption for local proxy processes, so a proxy running on the same machine is never looped through itself.
• Hijack protection and container isolation: only traffic from this network namespace is redirected, and a local process cannot spoof a destination for another connection.
• Low overhead: bounded memory (about 100 bytes per idle connection), splice-based relaying, and a fast in-kernel path for the common cases.
• GTK GUI with a connection-event queue, a status bar, asynchronous start/stop, multiple proxy profiles, and the same rule features as the CLI.
• CLI: proxy credentials are scrubbed from the process list.

Build and portability

• Fixes #146 (GLIBC_2.38 not found on Ubuntu 22.04): the binaries now need glibc 2.34 or newer. Ubuntu 22.04, Debian 12 and RHEL 9 are covered.
• libbpf is linked statically, so the run-time dependencies are only libelf, zlib and GTK 3 (for the GUI).
• Hardened build: LTO, FORTIFY_SOURCE=3, PIE, full RELRO, BIND_NOW, stack protector and CET. Every build is audited automatically and fails if a check does not pass.
• setup.sh installs the dependencies (apt, dnf, yum, pacman, zypper, xbps) and the binaries.

Requirements

• Linux kernel 5.11 or newer with BTF (/sys/kernel/btf/vmlinux) and cgroup v2
• Root (see the known limitations)
• GTK 3 for the GUI

Known limitations (beta)

• IPv4 is fully supported. IPv6: TCP to IPv6 destinations is handled. Unconnected IPv6 UDP and IPv6-only sockets cannot be redirected by the kernel, and fail closed (blocked, not leaked).
• UDP through an HTTP proxy is not possible (HTTP CONNECT has no UDP). Use a SOCKS5 proxy for UDP.
• Still requires root. Running with reduced capabilities (issue #237) is not supported yet, because matching rules against other users' processes needs access to /proc for them.
• The GUI was verified with automated headless tests. Dialogs have had limited hands-on testing, so please report UI bugs.

Testing status

Covered by automated tests: rule matching, DNS tap, the relay (SOCKS5, HTTP and UDP), security (hijack, spoofing, container), churn and 10,000-connection scale, with leak checks (ASan/LSan) and thread checks (TSan).

Please test and report

We would especially like feedback on:

• Different distributions, kernels (5.11 and newer) and desktop environments
• Real applications: browsers, SSH, curl, games, DNS-heavy workloads, containers and VPNs running alongside
• Domain rules and per-rule proxies with your own proxy setup
• GUI behaviour and long-running stability

When reporting, please include your distribution and kernel (uname -r), the output with --verbose 1, and the rules you used.

Install

tar xzf ProxyBridge-Linux-v4.0.0-Beta.tar.gz
cd ProxyBridge-Linux-v4.0.0-Beta
sudo ./setup.sh
sudo ProxyBridge --proxy socks5://127.0.0.1:1080 --rule "firefox:*:*:TCP:PROXY"