5

So I know about basic proxies, and how they transparently forward the connection to destination. I just couldn't understand how chaining proxies work.

For example I have this chain: proxy1 -> proxy2 -> proxy3 -> proxy4 -> destination.

As in normal single proxies, our request is sent to the proxy, which then forwards it to the destination, and sends the response back. But in proxy-chaining, how does the proxy1 know that it has to forward the request to proxy2, and so on, instead of forwarding it directly to the destination?

Is it because of some kind of headers in the requests we send to proxy-chain, which appropriately tells proxies to forward the requests to next proxy?

Kamil Maciorowski
  • 81,893
jazz
  • 51

1 Answers1

3

I think it's about the "CONNECT" HTTP method.

In this mechanism, the client asks an HTTP proxy server to forward the TCP connection to the desired destination. The server then proceeds to make the connection on behalf of the client. Once the connection has been established by the server, the proxy server continues to proxy the TCP stream to and from the client. Note that only the initial connection request is HTTP - after that, the server simply proxies the established TCP connection.

The last sentence is the key. You ask proxy1 to proxy the connection to proxy2. Then everything that follows goes to proxy2 through proxy1 which doesn't interpret anymore, so you ask to proxy to proxy3 and this request is caught and interpreted by proxy2. The next CONNECT request (to proxy to proxy4) will pass through proxy1 and proxy2, it will be interpreted by proxy3 – and so on. Every proxy in the chain interprets exactly one CONNECT request, then it becomes transparent.

After all the proxies are properly set up by the sequence of initial packets, anything that uses a two-way TCP connection can be passed through the CONNECT tunnel.

Beware that

Not all HTTP proxy servers support this feature, and even those that do may limit the behaviour.

Final note: while experimenting, you may have troubles chaining proxies if the program you run uses GET instead of CONNECT. GET doesn't allow chaining, this is covered here. Your confusion about proxy-chaining may be because you are more familiar with (i.e. you think in terms of) the GET mechanism.

Kamil Maciorowski
  • 81,893