ProxyBridge for Linux 4.0.0

ProxyBridge 4.0.0 for Linux is a new implementation, not an update of 3.2.x.

✨ What's new

Linux version now use eBPF instead of IPTables.

Proxies and rules

• Multiple proxy configurations. Add any number of SOCKS5 and HTTP proxies, each with its own authentication, and mark one as the default.
• Different proxy per rule. Every rule picks its own proxy, so curl can go to proxy 1 and firefox to proxy 2 at the same time. A rule's action is one choice: Direct, Block, or one of your proxies.
• Domain name support. Rules can match domain names such as github.com and *.github.com, mixed with IP addresses, CIDR networks (10.0.0.0/8), ranges and wildcards in one list. Names are learned from the program's own DNS answers.
• IPv6 support. IPv6 addresses and networks work in rules (TCP, and UDP on connected sockets), and a proxy can be given as an IPv6 address. Domain matching is IPv4 only.
• DNS via proxy, per proxy. When on (the default), the proxy receives the host name and resolves it. When off, it receives the IP address.
• Localhost proxy support. A PROXY rule can also proxy connections to 127.0.0.1 and ::1 (tick Also proxy localhost traffic on the rule), for example to inspect a local application in Burp Suite. Without the tick, localhost stays local.
• UDP, QUIC and HTTP/3 through a SOCKS5 proxy that supports UDP ASSOCIATE. Nexus Proxy is made for testing this.
• Proxy test in five steps: reach the proxy, log in, load a page, measure tunnel time, probe UDP.

Monitoring and profiles

• Live Connections tab: the connections going through a proxy right now, with process, destination, proxy, age, and bytes sent and received.
• Connection log with search, pause, and UDP marked (UDP); Log Filters (include/exclude by process, address, port, protocol, action); Log Every Connection; auto-clear.
• Profiles in the same .pbprofile format as Windows and macOS: new, duplicate, rename, delete, switch, import and export.
• Command line: sudo ProxyBridge --profile <name or file> with --verbose 0-3, --version, --help and --update.

Architecture

• eBPF instead of iptables/NFQUEUE. ProxyBridge hooks the socket calls of programs and sends only the connections your rules select to the proxy. Connections that no rule matches are left alone. There are no firewall rules to clean up. If ProxyBridge stops or crashes, traffic goes direct at once.
• No sudo for the window. The installer sets up a root service, proxybridge.service, and the window talks to it. You are added to the group proxybridge, which is what allows that.
• Start at Boot. With it on, the service applies your active profile when the machine starts and keeps routing after you close the window. With it off, the service sits idle until a window opens, and closing the window stops routing again.
• Self-contained programs. The command line program and library need only glibc 2.34 or newer. The window needs GTK 3, which the installer adds if it is missing.
• Documentation: nine Linux pages on the ProxyBridge website, with examples and troubleshooting.

🔒 Security

• The service runs as root with a restricted sandbox: a limited set of capabilities, a read-only system, no access to home folders, and a restricted system-call and socket surface. systemd-analyze security rates it 4.4 (OK).
• Only root and members of the group proxybridge can use the service. Anyone else is refused, and refusals cost almost nothing, so a local user cannot flood it.
• The window refuses to talk to a socket that does not belong to root.
• The one-line installer downloads into a private folder, verifies the SHA-256, and runs the archive's own setup.sh.
• Proxy credentials are stored with mode 0600 in a root-only folder and are never taken from the command line.
• The service and installer were security-reviewed before release, and all verified problems were fixed.

📋 Requirements

• Linux kernel 5.11 or newer with BTF (/sys/kernel/btf/vmlinux) and cgroup v2
• Root to install; 64-bit Intel/AMD
• Not supported: WSL1 and WSL2 (their kernels have no BTF or cgroup BPF)

📥 Install

curl -Lo deploy.sh https://raw.githubusercontent.com/InterceptSuite/ProxyBridge/refs/heads/master/Linux/deploy.sh && sudo bash deploy.sh

The script checks the SHA-256 of the download. Or use the archive: verify it with sha256sum -c ProxyBridge-Linux-v4.0.0.tar.gz.sha256, extract it, then run sudo ./setup.sh. Then start the window with ProxyBridgeGUI, with no sudo.

⬆️ Upgrading from 3.2.x or the Linux beta

• Your settings are kept. The old /etc/proxybridge/config.ini is converted into a profile the first time the window opens, and kept as config.ini.bak.
• The old iptables rules are gone; there is nothing to clean up.
• Command line options changed. --proxy, --rule, --dns-via-proxy and --cleanup no longer exist. Build a profile in the window (or write a .pbprofile) and run it with sudo ProxyBridge --profile <name or file>.
• The group grants administrative power. Members of proxybridge can route, block and read the proxy passwords of every user's traffic. Add only people you would give sudo for ProxyBridge. The installer adds the user who ran it; run it as sudo env PB_NO_GROUP_USER=1 ./setup.sh to skip that.

⚠️ Known limitations

• Connections that were already open when you add or change a rule keep their old route until they reconnect.
• Domain rules only match names the program looked up with ordinary DNS, so DNS over HTTPS or TLS is not seen. Only IPv4 destinations are matched by name.
• Native IPv6 UDP sent from an unconnected socket to a PROXY rule fails (a kernel limit); programs usually fall back to IPv4.
• A proxy given as a host name is resolved to IPv4 only. Use the IPv6 address itself for an IPv6 proxy.
• UDP and QUIC need a SOCKS5 proxy that supports UDP ASSOCIATE. HTTP proxies, SSH -D tunnels and Tor cannot carry UDP.
• Programs in containers or other network namespaces are not redirected.
• In Live Connections, a UDP flow whose process has already exited shows as pid <number> instead of its name.