Can v2ray proxy "transparent" https traffic (no CONNECT method request)? #2758

namniav · 2023-11-13T09:33:57Z

namniav
Nov 13, 2023

Hi, I want to use v2ray as a proxy client that proxy "transparent" https traffic which is directly sent to v2ray WITHOUT a CONNECT request. I have read v2fly's guide about TProxy but it's somehow different to my target:

v2ray should proxy only traffic that directly sent to it, not all traffic from a host or LAN. So I'm not doing any non-v2ray configurations like iptables or something else mentioned in v2fly's guide.
v2ray should find destination domain from TLS Server Name Indication (SNI), because other part of the traffic is encrypted with TLS.

To describe the question better, please consider this example:
Say v2ray client is running on 127.0.0.1:1080 and server (vmess protocol) is running on 1.1.1.1:1081, I would like to proxy this request:

curl --connect-to google.com:443:127.0.0.1:1080 https://google.com

to 1.1.1.1:1081 and then to real destination google.com:443.

I have tried this configuration. It does proxy http traffic but not https traffic:

  "inbounds": [
        {   
            "port": 1080,
            "listen": "0.0.0.0",
            "protocol": "http",
            "sniffing": {
                "enable": true,
                "destOverride": ["http", "tls"]
            },  
            "settings": {
                "allowTransparent": true
            },  
            "tag": "transparent"
        }
    ],

$ curl --connect-to google.com:80:127.0.0.1:1080 http://google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
$ curl --connect-to google.com:443:127.0.0.1:1080 https://google.com
curl: (35) error:0A000126:SSL routines::unexpected eof while reading

app/proxyman/inbound: connection ends > proxy/http: failed to read http request > malformed HTTP request "\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03\xecz\x89\xfe\xcfWj\x05\xfb1\xfe\x97\xa1YI\xe9!\xdb\xc2Rj\xeb\x94<ֈ\x7f%\xaaqη \x1a\xdd\xd4\x10\x8b\"\xe4\bH;\xf3\x91\x06[=\b\xc3ǯ\x0fn3DT\x02\fF\x95?\xa9\xe64\x00>\x13\x02\x13\x03\x13\x01\xc0,\xc00\x00\x9f̨̩̪\xc0+\xc0/\x00\x9e\xc0$\xc0(\x00k\xc0#\xc0'\x00g\xc0"

Answered by namniav

Nov 13, 2023

OK, I found the solution: dokodemo-door + sniffing.

I did try this method but failed because I didn't set address and port in settings, I thought that sniffing always override them. But it turns out that I was wrong and v2ray only override them when they're already set.

There's still a tiny issue that sniffing doesn't override port so I have to set it to fixed 443 for https only. But this is enough for me and I could add another inbounding for http (port 80) if I need it.

Here's the configuration:

        {   
            "tag": "transparent",
            "port": 1080,
            "listen": "0.0.0.0",
            "protocol": "dokodemo-door",
            "settings": {
                "addr…

View full answer

namniav · 2023-11-13T11:47:24Z

namniav
Nov 13, 2023
Author

OK, I found the solution: dokodemo-door + sniffing.

I did try this method but failed because I didn't set address and port in settings, I thought that sniffing always override them. But it turns out that I was wrong and v2ray only override them when they're already set.

There's still a tiny issue that sniffing doesn't override port so I have to set it to fixed 443 for https only. But this is enough for me and I could add another inbounding for http (port 80) if I need it.

Here's the configuration:

        {   
            "tag": "transparent",
            "port": 1080,
            "listen": "0.0.0.0",
            "protocol": "dokodemo-door",
            "settings": {
                "address": "non-existing-random-string",
                "port": 443
            },  
            "sniffing": {
                "enabled": true,
                "destOverride": ["http", "tls"]
            }   
        }

$ curl --connect-to google.com:443:127.0.0.1:1080 https://google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>
$ curl --connect-to apple.com:443:127.0.0.1:1080 https://apple.com
<HTML><HEAD><TITLE>Document Has Moved</TITLE></HEAD>
<BODY BGCOLOR="white" FGCOLOR="black"><H1>Document Has Moved</H1><HR>
<FONT FACE="Helvetica,Arial"><B>
Description: The document you requested has moved to a new location.  The new location is "https://www.apple.com/".
</B></FONT><HR></BODY>

v2ray logs

app/dispatcher: sniffed domain: google.com for tcp:non-existing-random-string:443
app/dispatcher: sniffed domain: apple.com for tcp:non-existing-random-string:443

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Can v2ray proxy "transparent" https traffic (no CONNECT method request)? #2758

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Can v2ray proxy "transparent" https traffic (no CONNECT method request)? #2758

Uh oh!

namniav Nov 13, 2023

Replies: 1 comment

Uh oh!

namniav Nov 13, 2023 Author

namniav
Nov 13, 2023

namniav
Nov 13, 2023
Author