Package tcpproxy lets users build TCP proxies, optionally making
routing decisions based on HTTP/1 Host headers and the SNI hostname
in TLS connections.
Calling Run (or Start) on a proxy also starts all the necessary
For each accepted connection, the rules for that ipPort are
matched, in order. If one matches (currently HTTP Host, SNI, or
always), then the connection is handed to the target.
The two predefined Target implementations are:
1) DialProxy, proxying to another address (use the To func to return a
2) TargetListener, making the matched connection available via a
But Target is an interface, so you can also write your own.
Note that tcpproxy does not do any TLS encryption or decryption. It
only (via DialProxy) copies bytes around. The SNI hostname in the TLS
header is unencrypted, for better or worse.
This package makes no API stability promises. If you depend on it,