Smithproxy is highly configurable, fast and transparent TCP/UDP/TLS (SSL) proxy written in C++17.
It uses our C++17 socket proxying library called socle.

QUIC build defaults

QUIC uses ngtcp2 by default, built statically from the pinned src/ext/ngtcp2 Git submodule (currently upstream v1.26.0). Its OpenSSL crypto adapter is built from the same source. OpenSSL 3.5 or newer remains a system shared-library dependency; no separate Smithproxy runtime is installed.

Source checkout is the distribution path. Populate all submodules before building (including after updating a checkout):

git clone --recurse-submodules https://github.com/astibal/smithproxy.git
cd smithproxy
git submodule update --init --recursive
sudo ./tools/linux-deps.sh
sudo ./tools/linux-build.sh

The default build needs CMake 3.20 or newer. Configuration and compilation do not download ngtcp2, use FetchContent, or require distribution ngtcp2 packages. Git pins the exact dependency commit; updating it is a reviewed source change. Source archives must include populated submodules: GitHub's automatic source ZIP/tar archives do not include their contents. The dependency's license is installed alongside Smithproxy documentation.

For distributions with older OpenSSL, an explicit compatibility build remains available. It does not gain QUIC features missing from the installed OpenSSL:

sudo env SMITHPROXY_ENABLE_NGTCP2=OFF ./tools/linux-deps.sh
sudo env SMITHPROXY_ENABLE_NGTCP2=OFF ./tools/linux-build.sh

Direct CMake builds use -DSMITHPROXY_ENABLE_NGTCP2=OFF for that opt-out. An enabled build can also explicitly select the OpenSSL QUIC transport at runtime with SMITHPROXY_QUIC_BACKEND=openssl; unset means ngtcp2.

show status and /api/status/ping expose dependency information from the same snapshot (libraries in JSON): OpenSSL build/runtime versions, linkage and loaded library paths, plus embedded ngtcp2's version and source commit. OpenSSL is labelled external, since a custom prefix is also supported and library paths alone do not prove distribution package ownership. A source archive without Git metadata reports an unknown commit rather than guessing. The build metadata header is generated in the ignored build directory.

The optional Docker/Debian packaging scripts use this same source build. sx-builder.py --ngtcp2 OFF or DEB_BUILD_PROFILES=pkg.smithproxy.openssl-quic selects the compatibility build. ${shlibs:Depends} captures shared runtime dependencies such as OpenSSL; embedded ngtcp2 needs no separate runtime package.

Testing policy

Since October 2026, Smithproxy development follows a strict, documented testing policy. Successful clean-tree validation runs can be published as commit-specific reports recording the test profile, executed sections, results, selected metrics and reproduction command. The report format and publishing rules live in docs/test-reports/; failed or dirty runs do not produce a passing report.

For day-to-day commands see the short tests/docs/TESTING_CHEATSHEET.md. The coverage --local profile combines native tests with an instrumented local dataplane sanity pass and therefore requires sudo/root.

Note: Snap and precompiled binary packages are no longer available from Russia Federation and Belarus as a response to their blatant war crimes being committed when invading Ukraine these days. For individuals from named countries: there are still sources which can be easily compiled; in the mean time seek more uncensored information!

Read fresh Release Notes to stay tuned!
Documentation: https://smithproxy.readthedocs.org
To replay captured traffic, check out the sister project pplay.

Availability:

• Linux - can be installed as a service (distro packages, or easily compiled from sources)
  • Download binary linux .deb (arm64, armhf, amd64) packages and source from: https://download.smithproxy. org/
  • Download and compile directly from source (known to work: Debian, Ubuntu, Alpine, Fedora, Kali, Arch)
• Docker - available as an image on docker hub
  • See our docker hub page: https://hub.docker.com/r/astibal/smithproxy
  • 
• Snap - install smithproxy service as a confined snap (with some limitations)!
  • Visit snap store here: https://snapcraft.io/smithproxy

Core features:

• TCP/UDP and TLS - intercept routed traffic, locally-originated traffic and SOCKS proxy requests
• configure policy based traffic matching similar to modern firewalls
• utilize per-policy applicable content, dns, tls, detection and authentication profiles
• re-route traffic (DNAT) and load-balance it, stickiness based on source-IP, L3 or L4 header data
• enjoy insightful CLI with configuration control
• export intercepted traffic to rotated pcap files, or emitting it to remote workstation in GRE

TLS features:

• TLS security checks (OCSP, OCSP stapling, automatic CRL download)
• custom certificates based on target IP or SNI
• Certificate Transparency checks for outbound connections
• HTML replacement browser warnings
• STARTTLS support for most starttls capable protocols, including HTTP proxy CONNECT
• Seamless HTTPS redirection to authentication portal
• Exporting sslkeylog
• KTLS support (level of acceleration depends on OpenSSL version)

Other:

• Local and LDAP user authentication using builtin web portal (using complementary package)
• SOCKS4/SOCKS5 and HTTP CONNECT explicit proxies with DNS hostname support
• Engines: limited HTTP1 and HTTP2 support
• DNS inspection allows FQDN policy objects, including DoH
• Policies based on FQDN and 2nd level DNS domain
• both IPv4 and IPv6 are supported
• detailed debugging messages in CLI if needed
• various sinkhole options - traffic is captured but not proxied

Tools:

• built-in tools to help with CA and certificate enrollment needed to run smithproxy
• auto-enrolling portal certificate based on system IP and hostname
• auto-detect inspection interface(s) based on system routing information
• check pplay tool: replays captures over the network with many cool features

HTTP CONNECT explicit proxy

The HTTP/1.0 and HTTP/1.1 CONNECT host:port listener uses the same policy, DNS resolution and TLS/STARTTLS interception path as the SOCKS listener. IPv4, IPv6 (CONNECT [::1]:443) and FQDN authorities are accepted.

Enable it in etc/smithproxy.cfg:

settings = {
    accept_http_connect = TRUE;
    http_connect_port = "3128";
    http_connect_workers = 0; // automatic worker count; -1 disables workers
};

The listener returns 200 after the upstream connection succeeds, 400 for invalid requests, 403 when policy rejects the connection, 431 when the header reaches the 8 KiB limit, and 502 for resolution or upstream connection failure. Requests and error responses close the connection where appropriate.

Current limitation: application data sent in the same TCP segment immediately after the CONNECT headers can be discarded during the frontend-to-tunnel handoff. Clients should wait for 200 Connection Established before sending tunnel data. CONNECT request pipelining is not supported.

Support and contacts

• Discord server: https://discord.gg/vf4Qwwt
• email support: <support@smithproxy.org>
• Documentation: https://smithproxy.readthedocs.org