FFPROXY.QUICK(7)

💖 ffproxy.quick(7) 💖

okay bestie, welcome to the ffproxy.quick manual page — section 7, the quick intro one, and yes it's giving "read this first before you break anything" energy 🎀

---

✨ NAME ✨

ffproxy.quick — filtering HTTP/HTTPS proxy server quick introduction

Like, the lore page. The sparknotes. The tl;dr that's somehow still a whole manual. 🦋

---

🌸 DESCRIPTION 🌸

so ffproxy is a filtering HTTP/HTTPS proxy server. it filters by host, URL, and header — yes, all three, no cap. custom header entries can be filtered AND added. it can even drop its privileges and optionally chroot(2) to some directory, which is the security glow-up we all deserve 💅. logging to syslog(3) is supported, and so is using another auxiliary proxy server. there's also an HTTP accelerator feature (acting as a front-end to an HTTP server) included, because why not. contacting IPv6 servers as well as binding to IPv6 is supported and allows transparent IPv6 over IPv4 browsing (and vice versa). literally iconic behavior 🌈

this manual describes how to set up a basic HTTP proxy installation. it is assumed that you already have compiled the program or installed it via port or package — so like, we're past the "how do I even get this" stage, bestie, we're in the "make it work" era ✨

---

🎀 COPYING FILES 🎀

the program comes with default configuration files that contain both examples and suggested entries. you can simply copy them to a directory of your choice. this directory will become the program's working directory. main character energy: the folder IS the vibe. 👑

mkdir /var/ffproxy
tar cf - db/ html/ | ( cd /var/ffproxy ; tar xf - )
cp sample.config /var/ffproxy/ffproxy.conf

the above example would install all needed files to /var/ffproxy, which is ffproxy's default working directory. so if you just do exactly this, you're already slaying 🫶

---

🔒 SECURING 🔒

okay so now the proxy has its own working directory. by default, ffproxy does not change UID/GID after start. for security reasons we want to enable it — like, we want the privilege drop, it's the whole point. you have two choices now: either use existing UID/GID or add custom UID/GID for ffproxy. see adduser(8) or useradd(8), depending on your system, on how to create new IDs. pick your fighter 🥊

edit ffproxy.conf and change the lines containing uid and gid

# change UID and GID
#
# to use, both uid and gid must be set
# (disabled by default)
#uid proxy
#gid proxy
uid _ffproxy
gid _ffproxy

in addition to changing UID and GID, ffproxy should be executed change-rooted to its working directory. so we change chroot_dir and db_files_path in the configuration file

# change root to (only in connection with uid and gid change)
# (disabled by default)
chroot_dir /var/ffproxy

# path to db/ and html/ directories
# (default: /var/ffproxy)
db_files_path .

db_files_path must be changed, too, since that is relative to the new root. don't skip that one, it's not optional, it's the whole plot twist 😭

finally, we copy /etc/resolv.conf to ffproxy's home to enable DNS in chroot and chown /var/ffproxy so the proxy's master process can write its PID file

mkdir /var/ffproxy/etc
cp /etc/resolv.conf /var/ffproxy/etc/
chmod 750 /var/ffproxy
chown _ffproxy._ffproxy /var/ffproxy

---

🚪 ACCESS TO THE PROXY 🚪

by default, nobody is allowed to connect to ffproxy. nobody. zero. the door is shut, the lights are off, the party hasn't started 🙈

let's say, we want to provide LAN users a filtering proxy to shut down malicious content coming from the Internet. so the proxy has to be listening on the local network interface only. we change bind_ipv4 and bind_ipv6 appropriately in ffproxy.conf

bind_ipv4 martyr.burden.eu.org
bind_ipv6 martyr.burden.eu.org

additionally, we have to change db/access.ip. by, for example,

^192\.168\.10\.

we allow 192.168.10.0/24 to use our proxy. that regex is the bouncer at the club, and it's checking IDs 💅

---

🚀 STARTING THE PROXY 🚀

last step is starting ffproxy. keep in mind that we run the program change-rooted to /var/ffproxy, so files are relative to the new root. yes, relative. remember it. it matters. 🔥

cd /var/ffproxy ; /usr/local/bin/ffproxy -f ffproxy.conf

starts ffproxy. now test if it works correctly. if not, change ffproxy.conf and/or read ffproxy(8) ffproxy.conf(5)

ffproxy is not running as a daemon right now. if everything seems to work, simply shut down the proxy by pressing CTRL-C, set daemonize yes in the configuration file and start ffproxy again. glow-up complete, bestie ✨

---

🦋 TRANSPARENT OPERATION 🦋

the proxy allows transparent operation, that is, HTTP traffic is redirected to the proxy which simulates an HTTP server so that the users don't have to specify a proxy server. consider forced usage of a proxy server as well. to do that, you will have to configure your NAT accordingly. on OpenBSD you'll want a line like

rdr on rl0 proto tcp from any to any port 80 -> 127.0.0.1 port 8080

in /etc/pf.conf. see your NAT's documentation for details on how to do this. your NAT, your rules, your problem (affectionate) 🧚

---

⭐ VERSION ⭐

this manual documents ffproxy 1.6 (2005-01-05).

---

👀 SEE ALSO 👀

ffproxy(8), ffproxy.conf(5), pf.conf(5)

---

okay bestie that's the whole page, you ate that 💜 this was ffproxy.quick, section 7, from Jan 5, 2005 — yeah the date is giving vintage but the knowledge is timeless 👑✨