The Proxy Management System provides a flexible, multi-protocol proxy orchestration layer that manages various proxy types (WireGuard, SOCKS5, HTTP, RPN variants), implements intelligent proxy selection with connection pinning, monitors proxy health, and supports proxy chaining (hopping). The system is centered around the proxifier component which maintains proxy registries, handles proxy lifecycle, and routes connections through the most appropriate proxy based on destination, user preferences, and proxy health status.
For DNS resolution over proxies, see DNS Resolution System. For the protocol handlers that consume proxies, see Protocol Handlers (TCP/UDP/ICMP). For connection reliability features, see Connection Reliability and Anti-Censorship.
The proxifier struct in intra/ipn/proxies.go230-266 serves as the central orchestrator for all proxy operations. It implements the Proxies interface and maintains multiple registries for different proxy types, connection pins, and hop mappings.
Core Data Structures
Title: Proxifier Entity Relationship
Sources: intra/ipn/proxies.go230-266 intra/ipn/proxies.go286-336
Proxifier Initialization
The NewProxifier() function creates the proxifier with all built-in proxies and registries. It initializes pin caches with a pintimeout of 10 minutes intra/ipn/proxies.go151
Title: Proxifier Initialization Sequence
Sources: intra/ipn/proxies.go286-336 intra/ipn/proxies.go322-330
For details on registry management and proxy lifecycle, see Proxy Architecture and Orchestration.
The system supports multiple proxy types organized into three categories: built-in proxies, user-added proxies, and RPN (Rethink Proxy Network) proxies. All proxies must implement the Proxy interface intra/ipn/proxies.go170-191
Proxy Type Hierarchy
Title: Proxy Interface Implementations
Sources: intra/ipn/proxies.go159-168 intra/ipn/proxies.go34-55
Proxy Status States
Proxies transition through status states defined by pxstatus intra/ipn/proxies.go71-92:
| Status | Code | String | Description |
|---|---|---|---|
TOK | x.TOK | "ok" | Proxy is healthy and responsive intra/ipn/proxies.go81 |
TUP | x.TUP | "up" | Proxy is up but not yet verified intra/ipn/proxies.go79 |
TZZ | x.TZZ | "idle" | Proxy is idle (no activity for 2 mins) intra/ipn/proxies.go81 |
TNT | x.TNT | "unresponsive" | Proxy not responding intra/ipn/proxies.go83 |
TPU | x.TPU | "paused" | Proxy manually paused intra/ipn/proxies.go85 |
TKO | x.TKO | "notok" | Health check failed intra/ipn/proxies.go75 |
END | x.END | "ended" | Proxy stopped intra/ipn/proxies.go87 |
Sources: intra/ipn/proxies.go57-63 intra/ipn/proxies.go71-92 intra/backend/ipn_proxies.go73-85
The ProxyTo() method in intra/ipn/proxies.go1022-1110 implements the core selection logic. It chooses the best proxy for a given destination IP:port based on pinned connections, proxy health, and routing capability.
ProxyTo Selection Flow
uidPins or ipPins intra/ipn/proxies.go1042Connection Pinning
Connection pinning caches successful proxy selections to avoid repeated selection overhead. The system uses uidPins (scoped to user ID and destination) and ipPins (scoped to destination only) with a pintimeout of 10 minutes intra/ipn/proxies.go151
Sources: intra/ipn/proxies.go1022-1110 intra/ipn/proxies.go150-153
The WireGuard proxy (wgproxy) embeds a full gvisor network stack (wgtun) to intercept packets and route them through a WireGuard tunnel.
Key Features:
stack.Stack to fake a TUN device for the WireGuard implementation intra/ipn/wgproxy.go112update() method in intra/ipn/wgproxy.go188 and intra/ipn/proxy.go213 allows changing peer configuration without tearing down the entire stack.WGFAST prefix intra/ipn/proxies.go50Barrier to cache and throttle WireGuard UAPI statistics collection intra/ipn/wgproxy.go147For deep dive into the netstack integration and configuration, see WireGuard Proxy Implementation.
The auto proxy implements intelligent proxy selection by racing multiple proxies (Exit, Exit64, RpnWin) in parallel with staggered delays.
Health Monitoring Logic:
TNT (unresponsive) or TKO (failed).For details on the racing algorithm and the health state machine, see Auto Proxy and Health Monitoring.
Proxy hopping allows one proxy (origin) to route its outbound traffic through another proxy (via). This is managed through the Hop method intra/ipn/proxies.go190
Hopping Rules:
hp map to track which origins are dependent on which hop proxies intra/ipn/proxies.go244Sources: intra/ipn/proxies.go119-128 intra/ipn/proxies.go244 intra/ipn/proxy.go200-202
The RPN subsystem manages advanced proxy integrations, primarily Windscribe (RpnWin). It handles account registration, dynamic WireGuard configuration generation, and regional server selection.
Key Subsystems:
RpnWin proxies through the Rpn interface intra/ipn/proxies.go193-200RpnAcc.Conf() for features like credential rotation and DNS filtering presets intra/ipn/proxy.go111-114Emplace method intra/ipn/proxy.go176For details on RPN registration and regional forking, see RPN (Rethink Private Network).
Sources: intra/ipn/proxies.go intra/ipn/proxy.go intra/ipn/wgproxy.go intra/backend/ipn_proxies.go