3proxy.cfg - 3proxy configuration file


Common structure:
Configuration file is a text file 3proxy reads configuration from. Each line of the file is a command executed immediately, as it was given from console. Sequence of commands is important. Configuration file as actually a script for 3proxy executable. Each line of the file is treated as a blank (space or tab) separated command line. Additional space characters are ignored. Think about 3proxy as

Any string beginning with space character or ´#´ character is comment. It´s ignored. <LF>s are ignored. <CR> is end of command.

Quotation character is spaces or another special characters. To use quotation character inside quotation character must be dubbed (BASIC convention). For example to use HELLO Good practice is to quote any argument you use.

File inclusion:
You can include file by using $FILENAME macro (replace FILENAME with a path to file, for example $/usr/local/etc/3proxy/conf.incl or
$ required in last example because path contains space character. For included file <CR> (end of line characters) is treated as space character (arguments delimiter instead of end of command delimiter). Thus, include files are only useful to store long signle-line commands (like userlist, network lists, etc). To use dollar sign somewhere in argument it must be quoted. Recursion is not allowed.

Next commands start gateway services:

proxy [options]
- HTTP/HTTPS proxy (default port 3128)
- SOCKS 4/4.5/5 proxy (default port 1080)
- POP3 proxy (default port 110)
- FTP proxy (default port 21)
- Web interface (default port 80)
- caching DNS proxy (default port 53)
- TCP portmapper
- UDP portmapper

change default server port to NUMBER
disable NTLM authentication (required if passwords are stored in Unix crypt format).
enable NTLMv1 authentication.

(for admin) secure, allow only secure operations, currently only traffic counters view without ability to reset.
(for dnspr) simple, do not use resolver and 3proxy cache, always use external DNS server.
(for udppm) singlepacket, expect only one packet from both client and server
Never ask for username/password
(for socks) require username/password in authentication methods
(for proxy) anonymous proxy (no information about client reported)
(for proxy) anonymous proxy (random client information reported)
(for proxy) generate Via: and X-Forwared-For: instead of Forwarded:
Only resolve IPv6 addresses. IPv4 addresses are packed in IPv6 in IPV6_V6ONLY compatible way.
Only resolve IPv4 addresses
Resolve IPv6 addresses if IPv4 address is not resolvable
Resolve IPv4 addresses if IPv6 address is not resolvable
listen on given local HOST:port for incoming connections instead of making remote outgoing connection. Can be used with another 3proxy service running -r option for connect back functionality. Most commonly used with tcppm. HOST can be given as IP or hostname, useful in case of dynamic DNS.
connect to given remote HOST:port instead of listening local connection on -p or default port. Can be used with another 3proxy service running -R option for connect back functionality. Most commonly used with proxy or socks. HOST can be given as IP or hostname, useful in case of dynamic DNS.
options for proxy-to-client (oc), proxy-to-server (os), proxy listening (ol), connect back client (or), connect back listening (oR) sockets. Options like TCP_CORK, TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS, USE_TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT, SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE, SO_DONTROUTE may be supported depending on OS.
bind internal interface / external inteface to given INTERFACE (e.g. eth0) if SO_BINDTODEVICE supported by system
Also, all options mentioned for proxy(8) socks(8) pop3p(8) tcppm(8) udppm(8) ftppr(8)
are also supported.
Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT HTTP and SOCKS proxies are standard.
POP3 proxy must be configured as POP3 server and requires username in the form of: [email protected] If POP3 proxy access must be authenticated, you can specify username as proxy_username:proxy_password:[email protected]
DNS proxy resolves any types of records but only hostnames are cached. It requires nserver/nscache to be configured. If nserver is configured as TCP, redirections are applied on connection, so parent proxy may be used to resolve names to IP.
FTP proxy can be used as FTP server in any FTP client or configured as FTP proxy on a client with FTP proxy support. Username format is one of
[email protected]
FTPuser:[email protected]
proxyuser:proxypassword:FTPuser:[email protected]
Please note, if you use FTP client interface for FTP proxy do not add FTPpassword and FTPServer to username, because FTP client does it for you. That is, if you use 3proxy with authentication use proxyuser:proxypassword:FTPuser as FTP username, otherwise do not change original FTP user name

include <path>
Include config file

config <path>
Path to configuration file to use on 3proxy restart or to save configuration.

ReOpens configuration file for write access via Web interface, and rereads it. Usually should be first command on config file but in combination with config it can be used anywhere to open alternate config file. Think twice before using it.

End of configuration

log [[@|]logfile] [<LOGTYPE>]
sets logfile for all gateways
@ (for Unix) use syslog, filename is used as ident name
use ODBC, filename consists of comma-delimited datasource,username,password (username and password are optional)
LOGTYPE is one of:
M Monthly
W Weekly (starting from Sunday)
D Daily
H Hourly
if logfile is not specified logging goes to stdout. You can specify individual logging options for gateway by using -l option in gateway configuration.
log command supports same format specifications for filename template as As with Grinwitch time zone for all time-based format specificators.

rotate <n>
how many archived log files to keep

logformat <format>
Format for log record. First symbol in format must be L (local time) or G (absolute Grinwitch time). It can be preceeded with -XXX+Y where XXX is list of characters to be filtered in user input (any non-printable characters are filtered too in this case) and Y is replacement character. For example, the beginning of logformat means comma and percent are replaced with space and all time based elemnts are in local time zone.
You can use:

%y Year in 2 digit format
%Y Year in 4 digit format
%m Month number
%o Month abbriviature
%d Day
%H Hour
%M Minute
%S Second
%t Timstamp (in seconds since 01-Jan-1970)
%. milliseconds
%z timeZone (from Grinvitch)
%D request duration (in milliseconds)
%b average send rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
%B average receive rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
%U Username
%N service Name
%p service Port
%E Error code
%C Client IP
%c Client port
%R Remote IP
%r Remote port
%i Internal IP used to accept client connection
%e External IP used to establish connection
%Q Requested IP
%q Requested port
%n requested hostname
%I bytes In
%O bytes Out
%h Hops (redirections) count
%T service specific Text
%N1-N2T (N1 and N2 are positive numbers) log only fields from N1 thorugh N2 of service specific text
in the case of ODBC logging logformat specifies SQL statement, for exmample:

logdump <in_traffic_limit> <out_traffic_limit>
Immediately creates additional log records if given amount of incoming/outgoing traffic is achieved for connection, without waiting for connection to finish. It may be useful to prevent information about long-lasting downloads on server shutdown.

archiver <ext> <commandline>
Archiver to use for log files. <ext> is file extension produced by archiver. Filename will be last argument to archiver, optionally you can use %A as produced archive name and %F as filename.

Sets timeout values, defaults 1, 5, 30, 60, 180, 1800, 15, 60, 15, 5.
BYTE_SHORT short timeout for single byte, is usually used for receiving single byte from stream.
BYTE_LONG long timeout for single byte, is usually used for receiving first byte in frame (for example first byte in socks request).
STRING_SHORT short timeout, for character string within stream (for example to wait between 2 HTTP headers)
STRING_LONG long timeout, for first string in stream (for example to wait for HTTP request).
CONNECTION_SHORT inactivity timeout for short connections (HTTP, POP3, etc).
CONNECTION_LONG inactivity timeout for l