Machine-wide, targeted transparent proxying for specific domains. Pick an upstream HTTP proxy, activate it, and route only selected targets (Anthropic/OpenAI/Google/AWS/Cloudflare/Vercel/Supabase or your own list).
curl -fsSL https://github.com/Dicklesworthstone/rust_proxy/archive/refs/heads/main.tar.gz | tar xz && cd rust_proxy-main && cargo install --path .Or build from source:
cargo install --git https://github.com/Dicklesworthstone/rust_proxy.gitThe Problem: You want a proxy for specific domains (e.g., API providers) without forcing a global system proxy or browser extensions.
The Solution: rust_proxy installs no system-wide default proxy; it uses iptables + ipset to redirect only targeted IPv4 traffic into a local transparent proxy that tunnels through your chosen upstream HTTP proxy.
| Feature | What It Does |
|---|---|
| Targeted routing | Only routes domains you list; everything else stays direct. |
| Machine-wide | Works for CLI tools, SDKs, and apps without per-app config. |
| Proxy stats | Tracks bytes sent/received, activation age, and ping. |
| Provider ranges | Optionally adds AWS/Cloudflare/Google IPv4 ranges for wildcard domains. |
| Safe defaults | No permanent system proxy settings; rules are applied at runtime. |
# Build
cargo build --release
# Initialize config
./target/release/rust_proxy init
# Add a proxy (plain credentials)
./target/release/rust_proxy proxy add mesh-us us-wa.proxymesh.com:31280 \
--username YOUR_USER --password YOUR_PASS
# Activate + start daemon
./target/release/rust_proxy activate --select
sudo ./target/release/rust_proxy daemon
# Verify
./target/release/rust_proxy status
./target/release/rust_proxy list
# Deactivate (clears iptables/ipset if root)
sudo ./target/release/rust_proxy deactivate- Targeted by default: route only the domains you choose, not the whole machine.
- Runtime state only: no permanent system proxy settings or network config drift.
- Observable behavior: stats + clear CLI output make it obvious what is active.
- Safe failure modes: if the daemon stops, traffic returns to normal routing.
| Capability | rust_proxy | Global proxy env | Browser extension | proxychains |
|---|---|---|---|---|
| Machine-wide | ✅ | ❌ | ✅ | |
| Per-domain targeting | ✅ | ❌ | ✅ (browser only) | |
| Works for SDKs/CLIs | ✅ | ❌ | ✅ | |
| Requires app config | ❌ | ✅ | ✅ | ❌ |
| Uses iptables/ipset | ✅ | ❌ | ❌ | ❌ |
When to use rust_proxy:
- You need machine-wide routing for a small, controlled set of domains.
- You want zero per-app configuration and no global proxy defaults.
When rust_proxy might not be ideal:
- You need IPv6 or non-Linux environments.
- You want traffic inspection or MITM features (out of scope).
curl -fsSL https://github.com/Dicklesworthstone/rust_proxy/archive/refs/heads/main.tar.gz | tar xz
cd rust_proxy-main
cargo install --path .cargo install --git https://github.com/Dicklesworthstone/rust_proxy.gitgit clone https://github.com/Dicklesworthstone/rust_proxy.git
cd rust_proxy
cargo build --release
sudo cp target/release/rust_proxy /usr/local/bin/- Build or install
rust_proxy. - Run
rust_proxy initto create~/.config/rust_proxy/config.toml. - Add at least one proxy with
rust_proxy proxy add .... - Activate a proxy with
rust_proxy activate --select. - Run
sudo rust_proxy daemonto apply machine-wide routing.
Create a default config if missing.
rust_proxy init
rust_proxy init --forceAdd an upstream proxy definition.
rust_proxy proxy add mesh-us us-wa.proxymesh.com:31280 \
--username YOUR_USER --password YOUR_PASS
rust_proxy proxy add mesh-us us-wa.proxymesh.com:31280 \
--username-env PROXY_USER --password-env PROXY_PASSRemove a proxy definition.
rust_proxy proxy remove mesh-usList configured proxies (no stats).
rust_proxy proxy listAdd a target domain with an optional provider hint.
rust_proxy targets add api.openai.com
rust_proxy targets add example.com --provider openaiRemove a target domain.
rust_proxy targets remove api.openai.comList target domains.
rust_proxy targets listSet the active proxy.
rust_proxy activate mesh-us
rust_proxy activate --selectRun the transparent proxy daemon (requires sudo).
sudo rust_proxy daemonDisable routing (clears iptables/ipset when root).
sudo rust_proxy deactivate
sudo rust_proxy deactivate --keep-rulesShow proxy stats table.
rust_proxy list
rust_proxy list --json
rust_proxy list --format toonShow active proxy + rule status.
rust_proxy status
rust_proxy status --json
rust_proxy status --format toonMachine output supports JSON or TOON.
rust_proxy list --format json
rust_proxy list --format toon
RUST_PROXY_OUTPUT_FORMAT=toon rust_proxy status --json
TOON_DEFAULT_FORMAT=toon rust_proxy list --jsonCheck system dependencies.
rust_proxy diagnoseGenerate shell completions for bash, zsh, fish, PowerShell, or elvish.
# Bash (add to ~/.bashrc)
rust_proxy completions bash >> ~/.bashrc
source ~/.bashrc
# Zsh (add to ~/.zshrc or use fpath)
rust_proxy completions zsh > ~/.zfunc/_rust_proxy
# Then add to ~/.zshrc: fpath=(~/.zfunc $fpath)
# Fish
rust_proxy completions fish > ~/.config/fish/completions/rust_proxy.fish
# PowerShell (add to profile)
rust_proxy completions powershell >> $PROFILE
# Elvish
rust_proxy completions elvish >> ~/.elvish/rc.elvConfig file location:
~/.config/rust_proxy/config.toml
State file location:
~/.local/state/rust_proxy/state.json
Example config (copy-paste ready):
# ~/.config/rust_proxy/config.toml
active_proxy = "mesh-us"
[[proxies]]
id = "mesh-us"
url = "http://us-wa.proxymesh.com:31280"
[proxies.auth]
username_env = "PROXY_USER"
password_env = "PROXY_PASS"
[[targets]]
domain = "api.openai.com"
provider = "openai"
[[targets]]
domain = "api.anthropic.com"
provider = "anthropic"
[[targets]]
domain = "console.cloud.google.com"
provider = "google"
[settings]
listen_port = 12345
# Refresh DNS + provider ranges every 5 minutes
dns_refresh_secs = 300
# Ping proxies every 60 seconds
ping_interval_secs = 60
# Proxy ping timeout (ms)
ping_timeout_ms = 1500
# ipset name used for targets
ipset_name = "rust_proxy_targets"
# iptables chain name
chain_name = "RUST_PROXY"
# Provider IPv4 ranges
include_aws_ip_ranges = true
include_cloudflare_ip_ranges = true
include_google_ip_ranges = true
# Connection retry settings (exponential backoff)
connect_max_retries = 3
connect_initial_backoff_ms = 100
connect_max_backoff_ms = 5000For production deployments, run rust_proxy as a systemd service for automatic startup and restart on failure.
# Copy the service file
sudo cp rust_proxy.service /etc/systemd/system/
# (Optional) Set up proxy credentials
sudo cp rust_proxy.env.example /etc/rust_proxy.env
sudo chmod 600 /etc/rust_proxy.env
sudo nano /etc/rust_proxy.env # Edit with your credentials
# Reload systemd and enable the service
sudo systemctl daemon-reload
sudo systemctl enable rust_proxy
# Start the service
sudo systemctl start rust_proxy# Check status
sudo systemctl status rust_proxy
# View logs
sudo journalctl -u rust_proxy -f
# Restart after config changes
sudo systemctl restart rust_proxy
# Stop the service
sudo systemctl stop rust_proxy- The systemd service runs as root (required for iptables/ipset)
- Config is read from
/root/.config/rust_proxy/config.toml - State is stored in
/root/.local/state/rust_proxy/state.json - Proxy credentials can be set in
/etc/rust_proxy.env - The service restarts automatically on failure with exponential backoff
CLI
│
▼
Config / State
│
▼
Daemon
│ ├─ DNS (targets) + Provider IP ranges
│ ├─ ipset sync
│ ├─ iptables NAT rules
│ └─ Transparent proxy (CONNECT → upstream HTTP proxy)
▼
Upstream Proxy → Internet
sudo rust_proxy daemon
sudo rust_proxy deactivateInstall dependencies (Ubuntu/Debian):
sudo apt-get update
sudo apt-get install -y iptables ipsetrust_proxy proxy add <id> <host:port>
rust_proxy activate --selectCheck proxy credentials and connectivity:
rust_proxy proxy list
# verify credentials and reachabilityrust_proxy targets add api.openai.com- IPv6 support: only IPv4 is supported today.
- Non-Linux platforms: uses
iptables+ipsetand is Linux-only. - TLS inspection: no MITM or certificate injection.
It is a Rust-based proxy selector with minimal system footprint.
No. It only applies runtime iptables rules while the daemon is running.
No. The proxy uses CONNECT and does not terminate TLS.
Yes. Use --username-env and --password-env when adding a proxy.
sudo rust_proxy deactivateAbout Contributions: Please don't take this the wrong way, but I do not accept outside contributions for any of my projects. I simply don't have the mental bandwidth to review anything, and it's my name on the thing, so I'm responsible for any problems it causes; thus, the risk-reward is highly asymmetric from my perspective. I'd also have to worry about other "stakeholders," which seems unwise for tools I mostly make for myself for free. Feel free to submit issues, and even PRs if you want to illustrate a proposed fix, but know I won't merge them directly. Instead, I'll have Claude or Codex review submissions via
ghand independently decide whether and how to address them. Bug reports in particular are welcome. Sorry if this offends, but I want to avoid wasted time and hurt feelings. I understand this isn't in sync with the prevailing open-source ethos that seeks community contributions, but it's the only way I can move at this velocity and keep my sanity.
License is not yet specified.
This tool modifies firewall rules. Use with care and ensure you can access your machine via a local terminal if you are editing rules over SSH.