HTTP / HTTPS Outbound Proxy

How HTTP outbound connections work

The client first connects to server:port the configured upstream proxy, then sends an HTTP CONNECT request to establish a TCP tunnel to the destination host. Whether the destination uses HTTP or HTTPS does not change the node type here.

type: http By default, the upstream proxy connection is unencrypted. Only when tls: trueis set does the client use TLS for the connection to the upstream proxy. HTTP outbound does not provide UDP forwarding.

Minimum required fields

These four fields define a minimal unauthenticated HTTP outbound node. The node name is referenced by policy groups and rules and must be unique.

nameRequired

The node name, later used in proxy-groups or in rules.

typeRequired

Set this to http。

serverRequired

The domain name or IP address of the upstream HTTP proxy.

portRequired

The listening port of the upstream proxy. The port number alone does not determine whether TLS is enabled.

Authentication and CONNECT headers

When the upstream requires Basic proxy authentication, provide both the username and password.headers These headers are added to the CONNECT request. Override defaults such as Host, User-Agent, or Proxy-Connection only when required by the gateway.

usernameOptional

The upstream proxy authentication username. The current implementation sends Basic authentication only when both the username and password are non-empty.

passwordOptional

and username The corresponding proxy authentication password.

headersOptional

CONNECT request headers as key-value pairs. Do not put ordinary destination-site request headers here.

HTTPS upstreams and certificate verification

With TLS enabled, the SNI, certificate name, and certificate chain all apply to the upstream proxy, not the final website. Keep certificate verification enabled under normal circumstances.

tlsOptional

Set to true to connect to the upstream HTTP proxy over TLS.

sniOptional

The server name used in the TLS handshake. When omitted, it uses server。

name-cert-verifyOptional

Sets the certificate DNSName verification target separately without changing the SNI.

skip-cert-verifyUse with caution

Skips certificate verification. Use only for temporary troubleshooting when you understand the risk.

fingerprintOptional

The SHA-256 fingerprint of the complete certificate, not a browser client fingerprint.

certificate / private-keyOptional

When both values are provided, they enable mTLS using PEM content or the corresponding file paths.

Authenticated HTTPS node example

This example enables both upstream TLS and Basic authentication. If the upstream requires no authentication, remove username and password. If the upstream is a plaintext HTTP proxy, remove tls and sni。

• If a TLS handshake error occurs, first confirm that the upstream actually provides an HTTPS proxy service.
• For a 407 Proxy Authentication Required response, verify the account, password, and authentication methods accepted by the upstream.
• For CONNECT method not allowed, the upstream may not be a forward proxy or may not permit the CONNECT method.

proxies:
  - name: http-upstream
    type: http
    server: proxy.example.com
    port: 443
    username: user
    password: pass
    tls: true
    sni: proxy.example.com