TinyProxy Linux Setup

README.md

Tinyproxy Installation and Configuration Guide

Here's a comprehensive guide for installing and configuring Tinyproxy on Linux, including setting up an upstream proxy and configuring bypass rules for specific domains and IPs.

Installation

Debian/Ubuntu-based distributions:

sudo apt update
sudo apt install tinyproxy

Red Hat/CentOS/Fedora-based distributions:

# For CentOS/RHEL
sudo yum install epel-release
sudo yum install tinyproxy

# For Fedora
sudo dnf install tinyproxy

Arch Linux:

sudo pacman -S tinyproxy

Configuration

Tinyproxy's configuration file is typically located at /etc/tinyproxy/tinyproxy.conf. Let's create a backup before making changes:

sudo cp /etc/tinyproxy/tinyproxy.conf /etc/tinyproxy/tinyproxy.conf.backup

Now edit the configuration file:

sudo nano /etc/tinyproxy/tinyproxy.conf

Basic Configuration

Here are key settings to customize:

1. Port: Change the listening port if needed

   Port 8888
   

2. Access Control: Restrict which IP addresses can use the proxy

   # Allow connections from local network only
   Allow 127.0.0.1
   Allow 192.168.0.0/16
   

3. Logging: Configure logging level and location

   LogLevel Info
   LogFile "/var/log/tinyproxy/tinyproxy.log"
   

4. Connection Settings:

   # Maximum number of clients
   MaxClients 100
   
   # Timeout settings (in seconds)
   Timeout 600
   

Configuring Upstream Proxy

To forward traffic to another proxy, add the Upstream directive:

# Format: Upstream host:port
Upstream proxy.example.com:3128

If your upstream proxy requires authentication, you can specify it as:

Upstream username:[email protected]:3128

Configuring Bypass Rules (No Proxy)

Tinyproxy handles bypass rules through two mechanisms:

1. Using ConnectPort

The ConnectPort directive controls which ports can be accessed directly (bypassing the upstream proxy) for CONNECT methods. By default, it allows ports 443 and 563:

ConnectPort 443
ConnectPort 563
# Add more ports as needed
ConnectPort 80

2. Using Filter Rules

For more granular control, including domain-specific and IP-specific bypass rules, we'll use the filtering capabilities:

1. Create a filter file:

   sudo mkdir -p /etc/tinyproxy/bypass
   sudo nano /etc/tinyproxy/bypass/no_proxy.filter

2. Add the domains and IPs that should bypass the upstream proxy:

   # Format for domains (one per line):
   .example.com
   example.org
   subdomain.example.net
   
   # Format for IP addresses:
   192.168.1.0/24
   10.0.0.1
   

3. In the tinyproxy.conf file, add:

   Filter "/etc/tinyproxy/bypass/no_proxy.filter"
   FilterDefaultDeny No
   FilterType Reverse
   FilterCaseSensitive No
   

The FilterType Reverse setting means that the listed domains will bypass the upstream proxy (opposite of regular filtering).

Custom Bypass Script (Advanced)

For more advanced control, you can use a custom script. Create a file /usr/local/bin/tinyproxy-bypass.sh:

sudo nano /usr/local/bin/tinyproxy-bypass.sh

Add this content:

#!/bin/bash

# Extract domain/IP from the request line
HOST=$(echo "$1" | grep -oP '(?<=Host: ).*(?=\r)')
CONNECT=$(echo "$1" | grep -oP 'CONNECT \K[^:]+')
TARGET=${CONNECT:-$HOST}

# Check if the target should bypass the proxy
if grep -q "$TARGET" /etc/tinyproxy/bypass/no_proxy.filter; then
    exit 1  # Bypass upstream proxy
else
    exit 0  # Use upstream proxy
fi

Make it executable:

sudo chmod +x /usr/local/bin/tinyproxy-bypass.sh

Then add to tinyproxy.conf:

FilterExtended On
FilterExtendedStatus 1
FilterExtendedExecPath "/usr/local/bin/tinyproxy-bypass.sh"

Handling HTTPS Traffic

HTTPS traffic requires special handling as Tinyproxy acts as a tunnel rather than a proxy for such requests. Add the following to your configuration:

# Allow HTTPS connections
ConnectPort 443

# If your upstream proxy has HTTPS support
# Uncomment and adjust the upstream directive:
# Upstream https://proxy.example.com:3128

Starting and Managing Tinyproxy

Start the service:

sudo systemctl start tinyproxy

Enable autostart at boot:

sudo systemctl enable tinyproxy

Check status:

sudo systemctl status tinyproxy

Restart after configuration changes:

sudo systemctl restart tinyproxy

Monitor logs:

sudo tail -f /var/log/tinyproxy/tinyproxy.log

Testing Your Configuration

1. Basic proxy test:

curl -x http://localhost:8888 http://httpbin.org/ip

2. Testing bypass rules:

# Should use direct connection (bypass)
curl -x http://localhost:8888 http://example.com

# Should use upstream proxy
curl -x http://localhost:8888 http://google.com

3. Testing with explicit environment variables:

export http_proxy=http://localhost:8888
export https_proxy=http://localhost:8888
export no_proxy=example.com,192.168.1.0/24

curl http://httpbin.org/ip  # Should use proxy
curl http://example.com     # Should bypass proxy

Troubleshooting

1. Connection refused

• Verify Tinyproxy is running: sudo systemctl status tinyproxy
• Check if the firewall is blocking: sudo ufw allow 8888/tcp (for Ubuntu)
• Verify the config doesn't have typos: sudo tinyproxy -d -c /etc/tinyproxy/tinyproxy.conf

2. Upstream proxy issues

• Verify upstream proxy is accessible: telnet proxy.example.com 3128
• Check authentication details if used
• Ensure proper format in the configuration file

3. Bypass rules not working

• Increase log level to Debug: LogLevel Debug
• Verify domains/IPs are correctly formatted in the filter file
• Restart Tinyproxy after changes

Complete Configuration Example

Here's a full example configuration that includes all the elements discussed:

# Basic settings
User nobody
Group nogroup
Port 8888
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatFile "/usr/share/tinyproxy/stats.html"
LogFile "/var/log/tinyproxy/tinyproxy.log"
LogLevel Info
PidFile "/var/run/tinyproxy/tinyproxy.pid"
MaxClients 100
MinSpareServers 5
MaxSpareServers 20
StartServers 10
MaxRequestsPerChild 0

# Access control
Allow 127.0.0.1
Allow 192.168.0.0/16

# Upstream proxy configuration
Upstream proxy.example.com:3128

# Direct connection ports
ConnectPort 443
ConnectPort 563
ConnectPort 80

# No proxy rules using filtering
Filter "/etc/tinyproxy/bypass/no_proxy.filter"
FilterDefaultDeny No
FilterType Reverse
FilterCaseSensitive No

# Optional extended filtering using custom script
FilterExtended On
FilterExtendedStatus 1
FilterExtendedExecPath "/usr/local/bin/tinyproxy-bypass.sh"

# SOCKS5 support (if needed)
# Uncomment to enable SOCKS5 forwarding
# Socks5Proxy proxy.example.com:1080

Performance Tuning

To get the best performance from Tinyproxy:

1. Increase MaxClients if you have many connections:

   MaxClients 200
   

2. Adjust server pool for your system's resources:

   MinSpareServers 10
   MaxSpareServers 30
   StartServers 15
   

3. Enable buffer limits to prevent memory issues:

   AddHeader "X-Forwarded-For" "${remote-ip}"
   ReversePath "/example" "http://example.org/"
   

4. Configure ViaProxyName to disguise the proxy:

   ViaProxyName "proxy"
   

This configuration should give you a lightweight and efficient proxy setup that forwards traffic to your upstream proxy while bypassing it for specified domains and IP addresses.