snell_forward_rules.yaml

All examples

Change addresses, credentials, certificate paths, and other deployment-specific values before use. This is a complete source file, not a guarantee it can run unchanged on your machine. Read its comments for prerequisites, then run shoes check with the adapted file.

# Snell server that only allows requests to certain hostnames and IPs.
- address: 127.0.0.1:55555
  transport: tcp
  protocol:
    type: snell
    cipher: aes-128-gcm
    password: secretpass
  rules:
    # Clients trying to connect to hello.com on port 80 are allowed, but instead forwarded to
    # a local server on port 55556.
    - mask: hello.com:80
      action: allow
      override_address: 127.0.0.1:55556
      client_chain: direct
    # Clients can access 10.x addresses.
    - mask: 10.0.0.0/8
      action: allow
      client_chain: direct
    # Block all other addresses.
    - mask: 0.0.0.0/0
      action: block

View source at this revision