PROXY Protocol support for TCP/UDP streams

[MrOwen]

Add the ability to enable/disable tcp/udp proxy protocol stream for downstream services (only version 2 is needed I think).

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• Enhancement: Support for Proxy Protocol v1 and v2 #137

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[FrozenFrog]

PROXY_SUPPORT_PROXY_PROTOCOL
https://docs.godoxy.dev/docs/impl/internal-entrypoint#dependency-and-integration-map
Actually, I dont know your question.
From docs, godoxy only support http/https protocol. I wish godoxy will support tcp, so I can setup mtproxy behind godoxy

[yusing]

PROXY_SUPPORT_PROXY_PROTOCOL docs.godoxy.dev/docs/impl/internal-entrypoint#dependency-and-integration-map Actually, I dont know your question. From docs, godoxy only support http/https protocol. I wish godoxy will support tcp, so I can setup mtproxy behind godoxy

It does support TCP/UDP, even behind agents.
https://docs.godoxy.dev/docs/godoxy/getting-started/Configuring-Routes#stream-properties-tcpudp

[yusing]

Try v0.27.3. Added support for TCP, UDP in the future.

[FrozenFrog]

I have encountered an issue regarding the Proxy Protocol implementation. For instance, when running telemt docker with the following configuration:

  telemt:
    image: ghcr.io/telemt/telemt:latest
    network_mode: bridge
    container_name: telemt
    hostname: telemt
    environment:
      TZ: ${TZ}
    ports:
      - target: 992
         published: "992"
         protocol: tcp
    ............
    labels:
      proxy.aliases: mtproto.domain.com
      proxy.#1.port: 992
      proxy.#1.no_tls_verify: true

Telemt config

# === General Settings ===
[general]
use_middle_proxy = false
log_level = "normal"
[general.modes]
classic = false
secure = false
tls = true
[general.links]
show = "*"
public_host = "mtproto.domain.com"
public_port = 992

# === Server Binding ===
[server]
port = 992                        
proxy_protocol = false   

[[server.listeners]]
ip = "0.0.0.0"  

# === Anti-Censorship & Masking ===
[censorship]
tls_domain = "mtproto.domain.com"
mask = true
tls_emulation = true
tls_front_dir = "tlsfront"

When connecting directly to mtproto.domain.com via port 992 using the Telegram app on iOS, the connection works perfectly.
The Issue:
However, after setting up a TCP proxy through Godoxy, the connection fails and the following error occurs:

Telemt config from their docs

# === General Settings ===
[general]
use_middle_proxy = false
log_level = "normal"
[general.modes]
classic = false
secure = false
tls = true
[general.links]
show = "*"
public_host = "mtproto.domain.com"
public_port = 443

# === Server Binding ===
[server]
port = 992                        
proxy_protocol = true   # change because their docs recommend when using behind reserve proxy

[[server.listeners]]
ip = "0.0.0.0"  

# === Anti-Censorship & Masking ===
[censorship]
tls_domain = "mtproto.domain.com"
mask = true
tls_emulation = true
tls_front_dir = "tlsfront"

Godoxy config

entrypoint:
  support_proxy_protocol: true
  middlewares:
    - use: cloudflare_real_ip
    - use: redirect_http
    - use: crowdsec
      api_key: "6DAqd....."
      port: 7422
      route: 127.0.0.1
      bypass:
        - route mtproto.domain.com

Telemt docker

  telemt:
    image: ghcr.io/telemt/telemt:latest
    network_mode: bridge
    container_name: telemt
    hostname: telemt
    environment:
      TZ: ${TZ}
    ports:
    ............
    labels:
      proxy.aliases: mtproto.domain.com
      proxy.#1.scheme: tcp
      proxy.#1.port: 443:992
      proxy.#1.no_tls_verify: true
      proxy.#1.relay_proxy_protocol_header: true

Did I make any mistake config?

[yusing]

Did I make any mistake config

Quite a few...

1. bypassing middleware for TCP route has no effect since TCP routes does not support HTTP Middlewares
2. no_tls_verify on TCP route is no-op
3. 443 is used for HTTPS, you cannot bind it to a port already in use.

I guess what you're trying to do is

  telemt:
    image: ghcr.io/telemt/telemt:latest
    network_mode: bridge
    container_name: telemt
    hostname: telemt
    environment:
      TZ: ${TZ}
    labels:
      proxy.aliases: mtproto.domain.com
      proxy.#1.scheme: https
      proxy.#1.port: 443
      proxy.#1.no_tls_verify: true

[FrozenFrog]

I’ve tested it, and the issue persists. It seems MTProto might have a different approach to data encryption. I’ll need to deep dive into the code when I have some free time.
Thanks for the help!