SubspaceTransparent proxy with upstream routing

Route HTTP, HTTPS, WebSocket, SOCKS5, and WSS traffic through upstream proxies based on hostnames and IP ranges — without terminating TLS.

Get Started

Configuration

🔐

No TLS Termination

Extracts SNI from the TLS ClientHello for routing decisions, then tunnels raw bytes. Your TLS traffic is never decrypted.

🧭

Flexible Routing

Match by exact hostname, domain suffix, glob pattern, or CIDR subnet. Last-match-wins ordering gives you precise control.

🧦

SOCKS5 Inbound

Accepts SOCKS5 clients on the same port as HTTP, auto-detected from the first byte. Works with git, ssh, curl, and any SOCKS5-aware tool.

📑

Internal Pages

Built-in link dashboards at pages.subspace.pub and live statistics at stats.subspace.pub. Press / to search across pages and links, or route queries through configured external search engines.

🔄

Hot Reload

Config file changes are detected and applied without restart. Split your config across multiple files with include and glob support.

📊

Statistics

Live metrics, upstream health, and historical charts with persistent SQLite storage. Configurable retention (defaults to one year) with automatic downsampling.

♻

Connection Pooling

Reuses upstream connections across HTTP requests, avoiding repeated TCP and proxy handshakes.

🏥

Health Monitoring

TCP health checks for all upstreams, per-upstream traffic stats, and live log streaming from a running server.

⚡

Zero-Copy Relay

Tunneled connections (TLS, CONNECT, WebSocket) use kernel-level splice/sendfile for efficient data transfer.