3proxy: Multi-Protocol Proxy Server - AI-Optimized Reference

Overview

Technology: Lightweight multi-protocol proxy server (BSD licensed since 2002)
Core Value: Single binary handles HTTP/HTTPS, SOCKS4/5, DNS proxy, and port forwarding
Resource Footprint: 3-12MB RAM, ~4MB disk space
Use Cases: Development testing, corporate firewalls, privacy chains, legacy system bridging

Critical Success Factors

Why Choose 3proxy Over Alternatives

• Multi-protocol support: Unlike Squid (HTTP only) or Dante (SOCKS only), handles all protocols properly
• Resource efficiency: 3MB vs Squid's 150MB idle RAM usage
• Cross-platform consistency: Same config works Windows/Linux (unlike nginx)
• Thread-based architecture: Avoids memory explosion of forking proxies (2MB per connection)

Performance Thresholds

• Connection limits: 800-1000 concurrent connections before file descriptor limits
• Memory scaling: 3MB idle → 12MB at 200-300 connections
• Breaking point: Default 1024 connection limit, then refuses new connections
• Bandwidth impact: Each proxy hop adds latency, performance degrades significantly

Implementation Configuration

Installation Critical Paths

Linux Installation

git clone https://github.com/3proxy/3proxy
cd 3proxy
ln -s Makefile.Linux Makefile  # CRITICAL: Wrong Makefile = useless errors
make
sudo make install

Prerequisites:

• Ubuntu/Debian: build-essential required or "gcc: command not found"
• CentOS 7: Use Makefile.Linux-gcc or compilation fails
• Alpine Linux: Assumes glibc, requires modifications

System-specific failures:

• SELinux blocks service execution until correct context set
• Binary locations vary: /usr/local/bin/ (Ubuntu) vs /usr/sbin/ (CentOS)

Windows Installation

1. Download pre-built binaries from GitHub releases
2. CRITICAL: Whitelist folder in antivirus BEFORE extraction
3. Extract to C:\3proxy\
4. Run 3proxy --install as administrator (fails silently otherwise)

Windows-specific issues:

• Antivirus quarantines even after whitelisting
• Windows firewall blocks by default
• Corporate DLL restrictions break binary
• File paths must use forward slashes everywhere

Configuration That Works

Basic Working Config

# User authentication
users testuser:CL:testpass
# HTTP proxy on port 3128
proxy -p3128
# SOCKS proxy on port 1080
socks -p1080
# REQUIRED: Allow connection or all requests rejected
allow testuser

Critical requirements:

• allow line mandatory or "access denied" with no explanation
• Use mycrypt for password hashing in production (not CL cleartext)
• Config reload with kill -USR1 but fails silently on syntax errors
• Always test with 3proxy -t before production reload

File Structure

• Pre-chroot config: /etc/3proxy/3proxy.cfg (system settings)
• Main config: /usr/local/3proxy/conf/3proxy.cfg (proxy definitions)
• Forward slashes required even on Windows
• Different distros place service files inconsistently

Failure Modes and Solutions

Common Breaking Points

1. Antivirus false positives: All major antivirus flags proxy software
   • Solution: Whitelist before download, not after quarantine
2. File descriptor limits: Default 1024 connections then hard stop
   • Solution: ulimit -n 65536 + maxconn 10000 in config
3. Config syntax errors: Reload fails, keeps old config, cryptic errors
   • Solution: Always 3proxy -t before reload
4. Memory limits on embedded systems: 4MB binary too large for some routers
   • Solution: Use separate binaries (socks, proxy) saves ~500KB

Protocol-Specific Issues

• SOCKS5 UDP: Many implementations ignore this, 3proxy actually supports it
• HTTPS tunneling: CONNECT method implementation works properly (unlike some alternatives)
• DNS caching: Prevents hitting 8.8.8.8 for every request
• Legacy protocol support: POP3/SMTP/FTP proxying for ancient systems

Resource Requirements and Scaling

Performance Tuning Requirements

Connections	RAM Usage	CPU Impact	Required Tuning
<100	3-5MB	Negligible	Default config
100-1000	5-12MB	Low	Basic ulimit increase
1000+	15-50MB	Moderate	Kernel tuning + splice mode
10000+	50-200MB	High	Full system optimization

High-Load Configuration

• Linux splice mode: 10% performance boost but can drop connections with content filtering
• Disable splice with -s0 if experiencing random connection drops
• Kernel tuning required for >1000 connections
• Windows handles high connections better out-of-box than Linux

Decision-Support Comparisons

vs Popular Alternatives

Tool	Disk	RAM	Best Use Case	Major Limitation
3proxy	4MB	3-12MB	Multi-protocol, small footprint	Complex ACL syntax
Squid	80-120MB	50-300MB	HTTP caching with abundant RAM	No SOCKS, memory hungry
nginx	15-25MB	10-50MB	HTTP proxy + web server	HTTP-focused
HAProxy	5-10MB	8-30MB	Load balancing	Complex for basic proxy
Dante	10-20MB	5-25MB	SOCKS-only excellence	Single protocol

Cost-Benefit Analysis

Worth it for:

• Development environments requiring multiple proxy protocols
• Resource-constrained deployments (VPS, embedded systems)
• Legacy system integration requiring protocol bridging
• Commercial use without licensing fees

Not worth it for:

• High-performance HTTP caching (use Squid)
• Enterprise-grade management interfaces
• Complex load balancing scenarios (use HAProxy)

Security and Production Considerations

Access Control Reality

• ACL syntax "weird but functional once learned"
• Time-based blocking works (block Facebook during work hours)
• Per-user bandwidth quotas actually function (unlike Squid nightmare)
• RADIUS authentication available for enterprise masochism

Production Deployment Warnings

• Config files contain cleartext passwords by default
• Logging works but log rotation requires external tools
• No integrated content filtering (external solutions required)
• Web interface basic monitoring only, no config management

Authentication Options

• Plain text: users user:CL:pass (development only)
• Hashed: users user:CR:hash (production)
• RADIUS: Available but complex setup
• External auth: Possible but not documented well

Operational Intelligence

Real-World Usage Patterns

1. Corporate firewall replacement: Costs thousands less than commercial solutions
2. Development testing: Multiple instances on different ports for edge case testing
3. Privacy chains: Performance hit makes barely usable, each hop adds significant latency
4. Residential proxy business: Raspberry Pi deployment for bandwidth-conscious customers
5. Legacy system bridging: SOCKSv4 to HTTPS bridging for 15-year-old industrial systems

Community and Support Quality

• Maintainer responsiveness: Actually responds to GitHub issues (rare for OSS)
• Documentation quality: Scattered across 3 sites, mostly accurate but incomplete
• Update frequency: Stable releases every 6-12 months, development branch unstable
• Enterprise support: None - community support only

Hidden Costs and Requirements

• Time investment: 2-3 hours initial setup, 1-2 hours for high-load tuning
• Expertise required: Linux/Windows system administration, network concepts
• Maintenance overhead: Manual log rotation, antivirus whitelist management
• Troubleshooting difficulty: Cryptic error messages, sparse debugging tools

Version and Compatibility Matrix

Current Recommendations

• Production: 0.9.5 (March 2025 stable release)
• Avoid: Version 10.x (development, randomly breaks)
• Legacy: 0.8.x still supported with security backports
• Minimum supported: Windows 98+, Linux 2.4+

Platform-Specific Gotchas

• Ubuntu: Binaries in /usr/local/bin/, service file in /lib/systemd/system/
• CentOS: Binaries in /usr/sbin/, requires older Makefile
• Alpine: glibc assumptions cause compilation issues
• Windows: Service management via sc commands, not standard service tools

Critical Configuration Examples

Basic Multi-Protocol Setup

# Authentication
users admin:CR:$1$salt$hashedpassword

# Services
proxy -p3128 -a
socks -p1080 -a

# Access control
allow admin
deny *

High-Performance Configuration

# Performance tuning
maxconn 10000
daemon
nserver 8.8.8.8

# Logging
log /var/log/3proxy.log D
logformat "- +_L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"

# Services with authentication
proxy -p3128 -a
socks -p1080 -a

Corporate Firewall Example

# Time-based access control
timeperiod "workhours" {
    days * {
        0:1-8:59, 12:1-12:59, 18:1-23:59 # Block during work
    }
}

# Bandwidth limiting
counter /var/log/3proxy.cnt "D"
users employee:CL:password:10240:10240:1 # 10MB daily limit

# Service with restrictions
proxy -p3128
allow employee !workhours *.facebook.com
allow employee

This reference provides complete operational intelligence for successful 3proxy deployment while highlighting critical failure modes and real-world implementation challenges.