@@ -6,7 +6,7 @@ Tunn is a powerful and flexible SSH tunneling tool written in Go that creates se
66
77- ** Multiple Tunnel Strategies** : Support for proxy, SNI fronting, and direct connection modes
88- ** WebSocket-based SSH Tunnels** : Establishes SSH connections over WebSocket for better bypass capabilities
9- - ** SOCKS Proxy** : Built-in SOCKS5 proxy server for routing local traffic through the tunnel
9+ - ** Dual Proxy Support ** : Built-in SOCKS5 and HTTP proxy server for routing local traffic through the tunnel
1010- ** Domain Spoofing** : Front domain support for Host header manipulation to bypass restrictions
1111- ** Configurable Payloads** : Custom HTTP payload templates for different environments
1212- ** Cross-platform** : Windows, Linux, and macOS support
@@ -65,18 +65,25 @@ make build-all
6565
6666## Usage
6767
68- Tunn supports three main tunneling strategies:
68+ Tunn supports multiple tunneling strategies, and all modes support both SOCKS5 and HTTP local proxy types via the global ` --proxy-type ` flag:
69+
70+ ** Global Proxy Type Control:**
71+ - ` --proxy-type socks5 ` (default): Universal compatibility, works with any TCP-based protocol
72+ - ` --proxy-type http ` : Optimized for web traffic, works with HTTP/HTTPS applications
6973
7074### 1. Proxy Mode
7175
7276Routes traffic through an HTTP proxy server first, then establishes a WebSocket tunnel to the target host.
7377
7478``` bash
75- # Basic proxy mode
79+ # Basic proxy mode with SOCKS5 local proxy (default)
7680tunn proxy --proxy-host proxy.example.com --target-host ssh-server.com --ssh-username user --ssh-password pass
7781
82+ # Proxy mode with HTTP local proxy
83+ tunn --proxy-type http proxy --proxy-host proxy.example.com --target-host ssh-server.com --ssh-username user --ssh-password pass
84+
7885# With custom proxy port and front domain
79- tunn proxy \
86+ tunn --proxy-type socks5 proxy \
8087 --proxy-host proxy.example.com \
8188 --proxy-port 8080 \
8289 --target-host ssh-server.com \
@@ -96,11 +103,11 @@ tunn proxy \
96103Uses SNI (Server Name Indication) fronting to establish connections through a proxy with forged SNI headers.
97104
98105``` bash
99- # Basic SNI fronting
106+ # Basic SNI fronting with SOCKS5 proxy (default)
100107tunn sni --front-domain google.com --proxy-host proxy.example.com --ssh-username user --ssh-password pass
101108
102- # With custom configuration
103- tunn sni \
109+ # SNI fronting with HTTP proxy
110+ tunn --proxy-type http sni \
104111 --front-domain cloudflare.com \
105112 --proxy-host proxy.example.com \
106113 --proxy-port 443 \
@@ -120,11 +127,11 @@ tunn sni \
120127Establishes a direct connection to the target host with optional Host header spoofing.
121128
122129``` bash
123- # Basic direct connection
130+ # Basic direct connection with SOCKS5 proxy (default)
124131tunn direct --target-host ssh-server.com --ssh-username user --ssh-password pass
125132
126- # With front domain spoofing
127- tunn direct \
133+ # Direct connection with HTTP proxy and front domain spoofing
134+ tunn --proxy-type http direct \
128135 --front-domain google.com \
129136 --target-host ssh-server.com \
130137 --target-port 443 \
@@ -141,7 +148,8 @@ tunn direct \
141148
142149All modes support these additional options:
143150
144- - ` --local-port ` / ` -l ` : Local SOCKS proxy port (default: 1080)
151+ - ` --proxy-type ` : Local proxy type - ` socks5 ` (default) or ` http ` (global flag)
152+ - ` --local-port ` / ` -l ` : Local proxy port (default: 1080 for SOCKS5, 8080 for HTTP)
145153- ` --ssh-port ` : SSH port on target server (default: 22)
146154- ` --timeout ` / ` -t ` : Connection timeout in seconds (0 = no timeout)
147155- ` --payload ` : Custom HTTP payload template
@@ -172,6 +180,81 @@ tunn proxy \
172180 --ssh-password pass
173181```
174182
183+ ## SOCKS5 vs HTTP Proxy Comparison
184+
185+ Tunn now supports both SOCKS5 and HTTP proxy types for your local proxy server. Here's when to use each:
186+
187+ ### SOCKS5 Proxy (Default)
188+
189+ ** Best for:** Universal application compatibility
190+ ** Protocols:** Any TCP-based protocol (SSH, HTTP, HTTPS, FTP, SMTP, etc.)
191+
192+ ** Advantages:**
193+ - ✅ ** Protocol Agnostic** : Works with any TCP application
194+ - ✅ ** Binary Data Support** : Handles any type of data
195+ - ✅ ** Low Overhead** : Minimal protocol overhead
196+ - ✅ ** Port Flexibility** : Can connect to any port
197+ - ✅ ** Transparent** : Preserves original destination information
198+
199+ ** Use cases:**
200+ - SSH tunneling through proxies
201+ - Database connections
202+ - File transfers (FTP, SFTP)
203+ - Email clients (SMTP, IMAP)
204+ - Any non-web application
205+
206+ ** Example usage:**
207+ ``` bash
208+ # SOCKS5 proxy (default)
209+ tunn proxy --proxy-host proxy.example.com --target-host ssh-server.com --ssh-username user --ssh-password pass
210+
211+ # Configure applications
212+ curl --socks5 127.0.0.1:1080 https://httpbin.org/ip
213+ ssh -o ProxyCommand=" nc -X 5 -x 127.0.0.1:1080 %h %p" user@remote-server
214+ ```
215+
216+ ### HTTP Proxy
217+
218+ ** Best for:** Web browsing and HTTP-based applications
219+ ** Protocols:** HTTP and HTTPS
220+
221+ ** Advantages:**
222+ - ✅ ** Web Optimized** : Excellent performance for web traffic
223+ - ✅ ** Browser Compatible** : Works seamlessly with web browsers
224+ - ✅ ** Header Processing** : Can modify HTTP headers
225+ - ✅ ** CONNECT Support** : Full HTTPS tunneling support
226+
227+ ** Limitations:**
228+ - ❌ ** HTTP/HTTPS Only** : Cannot handle other protocols directly
229+ - ❌ ** Limited Scope** : Not suitable for non-web applications
230+
231+ ** Use cases:**
232+ - Web browsing through corporate proxies
233+ - HTTP API access
234+ - Web scraping
235+ - Browser-based applications
236+
237+ ** Example usage:**
238+ ``` bash
239+ # HTTP proxy mode
240+ tunn --proxy-type http proxy --proxy-host proxy.example.com --target-host ssh-server.com --ssh-username user --ssh-password pass
241+
242+ # Configure applications
243+ curl --proxy 127.0.0.1:8080 https://httpbin.org/ip
244+ export http_proxy=http://127.0.0.1:8080
245+ export https_proxy=http://127.0.0.1:8080
246+ ```
247+
248+ ### Choosing the Right Proxy Type
249+
250+ | Use Case | Recommended Type | Reason |
251+ | ----------| ------------------| ---------|
252+ | SSH tunneling | SOCKS5 | Universal protocol support |
253+ | Web browsing only | HTTP | Optimized for web traffic |
254+ | Database connections | SOCKS5 | Supports non-HTTP protocols |
255+ | Mixed applications | SOCKS5 | Maximum compatibility |
256+ | Corporate environments | HTTP | Better integration with existing HTTP proxy infrastructure |
257+
175258## Examples
176259
177260### Example 1: Corporate Proxy Bypass
@@ -188,7 +271,25 @@ tunn proxy \
188271 --local-port 1080
189272```
190273
191- ### Example 2: SNI Fronting for CDN Bypass
274+ ### Example 2: HTTP Proxy Mode for Web Traffic
275+
276+ ``` bash
277+ # Use HTTP proxy mode for optimized web browsing
278+ tunn --proxy-type http proxy \
279+ --proxy-host corporate-proxy.company.com \
280+ --proxy-port 8080 \
281+ --target-host ssh-server.com \
282+ --ssh-username user \
283+ --ssh-password pass
284+
285+ # The local HTTP proxy will be available on 127.0.0.1:8080
286+ # Configure your browser to use 127.0.0.1:8080 as HTTP proxy
287+ # Or set environment variables:
288+ # export http_proxy=http://127.0.0.1:8080
289+ # export https_proxy=http://127.0.0.1:8080
290+ ```
291+
292+ ### Example 3: SNI Fronting for CDN Bypass
192293
193294``` bash
194295# Use SNI fronting to bypass CDN restrictions
@@ -200,7 +301,7 @@ tunn sni \
200301 --ssh-password pass
201302```
202303
203- ### Example 3 : Direct Connection with Domain Spoofing
304+ ### Example 4 : Direct Connection with Domain Spoofing
204305
205306``` bash
206307# Direct connection with Host header spoofing
0 commit comments