sni_sniffing.yaml

All examples

Change addresses, credentials, certificate paths, and other deployment-specific values before use. This is a complete source file, not a guarantee it can run unchanged on your machine. Read its comments for prerequisites, then run shoes check with the adapted file.

# SNI selects a route, never a replacement destination. Omission disables sniffing.
# The same setting also inspects cleartext HTTP/1 Host headers.
- address: "0.0.0.0:1080"
  protocol:
    type: mixed
    username: "proxy-user"
    password: "replace-this-password"
  sniff: true
  rules:
    # Block local/private destinations before client-controlled hostname rules.
    - masks:
        - "10.0.0.0/8"
        - "172.16.0.0/12"
        - "192.168.0.0/16"
        - "127.0.0.0/8"
        - "169.254.0.0/16"
        - "::1/128"
        - "fc00::/7"
        - "fe80::/10"
      action: block
    - masks: "example.com"
      action: allow
      client_chain:
        address: "127.0.0.1:1081"
        protocol:
          type: socks
    - masks: "0.0.0.0/0"
      action: allow

View source at this revision