tlspr(8)

💖 tlspr(8) — the SNI proxy gateway service, bestie edition 💖

okay so like, this is the manual page for tlspr, part of the Universal proxy server family (yes, that's the section 8 manual name situation, we're in admin territory now 👑). Sit down, grab a strawberry 🍓, and let's get you fluent.

---

✨ NAME ✨

tlspr — SNI proxy gateway service. that's it, that's the whole vibe. 🦋

---

✨ SYNOPSIS ✨

tlspr [-d][-a] [-l[[@]logfile]] [-plistening_port] [-Pdestination_port]
[-ctls_check_level] [-iinternal_ip] [-eexternal_ip]

like... look at her. the flags. the brackets. she's giving options. 💅

---

✨ DESCRIPTION ✨

so tlspr is an SNI gateway service, which is a fancy way of saying it peeks at the TLS handshake to figure out where you're actually trying to go — the destination host comes straight out of that handshake, no cap. 🧚

the destination port is a whole separate situation though: you must hand it over with the -P option, or it can get auto-detected with the Transparent plugin. either way, one of those two, bestie. 🙈

also important, and I need you to hear me on this one: tlspr does not do user authentication. zero. none. it's not that kind of girl. if you need access control you have exactly two moves:

• ACLs by client IP
• a parent proxy that actually does authentication

periodt. 🔥

---

✨ OPTIONS ✨

• -I — Inetd mode. Standalone service only. (yes, it's a capital I, don't @ me)
• -d — Daemonize. detaches the service from the console and sends it running off into the background like the independent queen she is. 👑
• -t — Be silenT. stops it from logging start/stop/accept error records. quiet luxury ✨
• -u — Never ask for username authentication. not even once. 🙅‍♀️
• -e — External address. this is the IP of the interface the proxy should initiate connections from. by default the system just decides which address to use based on the routing table — so if you don't set this, it's the OS's call, not yours. 😌
• -niPATH — (Linux only) switches to the network namespace identified by PATH before opening the listening socket. the current namespace gets saved and restored right after binding, which means outgoing connections run in the original namespace — unless you also pass -ne. sneaky but documented. 🫶
• -nePATH — (Linux only) switches to the network namespace identified by PATH after the listening socket has been bound (and after restoring from -ni if that one was in play). both -ni and -ne accept any namespace file path, e.g. /var/run/netns/myns or /proc/PID/ns/net, and both require CAP_SYS_ADMIN. yes, really. 💀
• -i — Internal address. the IP the proxy accepts connections to. by default it accepts connections to any interface, and ngl, that's usually unsafe — so maybe don't do that in public? 😭 Unix domain sockets are supported with the -iunix:/path/to/socket syntax (e.g. -iunix:/var/run/tlspr.sock). on Linux, abstract sockets use -iunix:@socketname. 🐧
• -a — Anonymous. hides information about the client. 🕶️
• -a1 — Anonymous, but make it fiction: shows fake information about the client. iconic behaviour honestly. 🌈
• -p — listening_port. the port the proxy listens on for incoming connections. default is 1443. 🌸
• -P — destination_port. the port used to establish outgoing connections. this one is required unless the Transparent plugin is used, because the TLS handshake simply does not contain port info — it's not hiding it, it just doesn't have it. default is 443. ⭐
• -c — TLS_CHECK_LEVEL. pick your fighter:
  • 0 (default) — allow non-TLS traffic to pass
  • 1 — require TLS, only check the client HELLO packet
  • 2 — require TLS, check both client and server HELLO
  • 3 — require TLS, check that the server sends a certificate (not compatible with TLS 1.3)
  • 4 — require mutual TLS, check that the server sends a certificate request and the client sends a certificate (not compatible with TLS 1.3)

lock it down as much as you want, just know 3 and 4 and TLS 1.3 are not friends. 💔

• -s — Split the TLS Client HELLO packet across multiple TCP segments, so SNI-based DPI detection has a harder time figuring out what's going on. an optional numeric value can follow it (e.g. -s1) to control the splitting behaviour. chaotic good. 😈
• -Ximap | -Xpop3 | -Xsmtp — STARTTLS mode for the given protocol. here's the choreography: the proxy speaks the plaintext protocol with the client (greeting, capability advertisement with STARTTLS only, STARTTLS command), then, once the client issues STARTTLS and sends a TLS Client HELLO, it connects to the destination taken from SNI (default ports 143/110/587), performs STARTTLS negotiation with the destination server, and transparently passes TLS traffic. and if the destination server doesn't support STARTTLS? the TLS handshake with the client fails. simple as that. 🎀
• -l — Log. by default logging goes to stdout. if a logfile is specified, logging goes to that file. under Unix, if @ precedes the logfile, syslog is used for logging instead. pick your journal, bestie. 📓
• -S — Increase or decrease stack size. if you experience 3proxy crashes, something like -S8192 is worth a try. 🛠️

---

✨ CLIENTS ✨

you should use a client with TLS support, or configure a router to redirect TLS traffic to the proxy (that's the transparent proxy setup, iykyk). either way, configure the client to connect to internal_ip and port. 🦋

and if you need to limit clients? use 3proxy(8) instead. this one isn't the bouncer, she's the doorman. 💅

---

✨ BUGS ✨

Report all bugs to 3proxy@3proxy.org 🐛 — be nice, they're doing their best.

---

✨ SEE ALSO ✨

3proxy(8), ftppr(8), htproxy(8), socks(8), pop3p(8), smtpp(8), tcppm(8), udppm(8), syslogd(8), and https://3proxy.org/ 🌐

the whole squad, assembled. 💜

---

✨ AUTHORS ✨

3proxy is designed by Vladimir Dubrovin <vlad@3proxy.org> 👑

---

ok that's the entire page, nothing skipped, nothing summarised, every flag accounted for. you're basically certified now. 🎓✨

---

and that's a wrap! this page is from the 3proxy 0.9 era, dated May 2026 — so yeah, it's giving fresh off the press 🎀💖 bye bestie, go proxy responsibly! 🦋