$./proxies

Port X talks to port Y. Optionally with TLS.

A relay is not a product. It is a process. Login: ssh user@kire.net. Bind where you were told you may bind. Placeholder hostname below is shell.kire.net — replace it from the welcome mail / client area.

What this page is. Using the shell as a TCP forward, and as a TLS-wrapping or TLS-terminating proxy. socat, ncat, stunnel, hitch, nginx stream, haproxy — if the binary is there. If not, ask, or compile in $HOME. We are not going to bless a specific version in a blog post.

Who it is for. You need port X on the shell to speak to port Y somewhere else, or you need TLS in front of a plain TCP service you already run. If SSH -L / -D already does it, stop reading and go to ./ssh-forwarding.

$why-a-kire-shell

Stable IPv4 and IPv6. A PTR that is not your cable modem. DDoS in front. identd already answered. The laptop lid is closed. This is still not a residential proxy farm, and we will not pretend it is.

$cheat-sheet

thing	what it does	when to use it
SSH `-L` / `-D`	tunnel in the session you already have	first try. usually enough
dumb TCP forward	bytes in, bytes out, no TLS	two plain ports, same world
TLS wrap	plain service + TLS on the outside	you have a cert, the client expects 6697-shaped things
TLS terminate	TLS on the way in, plain on the way out	the backend is localhost and lazy
WireGuard	overlay, not a port proxy	only if a tunnel is not enough. ./vpn

$for-beginners

Check what exists before compiling a shrine:

command -v socat ncat stunnel nginx haproxy hitch

Privileged ports (< 1024) are not yours. Bind high, or ask staff. Process limits are still process limits.

I need port X on the shell to talk to port Y somewhere else

socat, if present. Listen on the shell, connect onward. Example: local 9000 → some host 6667. Replace hosts.

socat TCP-LISTEN:9000,bind=127.0.0.1,fork,reuseaddr TCP:irc.example.net:6667

bind=127.0.0.1 means only the shell can hit it. That is the correct default. Pair with SSH -L from home if you need to hit it. Binding the vhost publicly is how open proxies are born. Don’t.

I need TLS in front of a plain TCP service

stunnel (or hitch, or nginx stream) wraps or terminates. Certs are your problem. A self-signed cert is fine for a client you control; it is not fine for strangers.

# stunnel.conf — TLS in front of a local plain port
foreground = no
pid = /home/user/stunnel.pid
[wrap]
accept = 127.0.0.1:6697
connect = 127.0.0.1:6667
cert = /home/user/certs/fullchain.pem
key = /home/user/certs/privkey.pem

Then stunnel ~/stunnel.conf if the binary is there. Keep the accept address loopback unless you have a reason and a clue.

$for-people-who-already-know-the-flags

A dumb TCP forward is not an SSL proxy. One copies bytes. The other speaks a handshake. Do not log the handshake into a world-readable file. Do not log credentials. Rotate whatever you do log.

SNI: if you terminate more than one name on one port, the proxy has to look at the ClientHello. nginx stream + ssl_preread, haproxy ssl, stunnel SNI maps — pick one binary and read its man page. We are not going to re-document OpenSSL.

Client certs: possible. Usually more ceremony than a KIRE shell is for. If you need mTLS, you already have a config file.

PROXY protocol: only if the next hop understands it. Sending it into a stock ircd will make a mess. Idle timeouts: set them. Half-open relays are how you discover file descriptor limits.

SO_REUSEPORT if you are stacking workers. systemd --user for the process if you must; it still counts as a process. No CAP_NET_BIND_SERVICE unless staff said so.

IPv4 and IPv6 both exist here. Bind the family you meant. A vhost PTR does not magically make a bad bind correct.

If the job is “my browser on cafe Wi-Fi,” that is SSH -D, not this page. If the job is “a routed network for the household,” that is ./vpn and probably a no.

$dont

Open proxy. Public relay. “SOCKS for friends of friends.” Site copy has said this since forever.
Mining, scanners, spam, services you do not own.
Binding 25/465/587 as a surprise MX. No.
Logging full TLS keys “for debug” and leaving them in ~/tmp.

Full text: AUP / TOS. Unsure whether a process is approved: ask before it is a ticket about a kill.

$smaller-tool

SSH tunnel · TCP/SSL proxy · WireGuard.

client area order a shell ask a human