How does a proxy server handle non-http traffic?

Question

I have an application that makes an un-secure connection over a non-http port to a server daemon. We use this tool internally. There might be occasion for some of our users to work outside our facility. I don't want un-secure connections being made from the outside into our facility. This traffic is not encrypted and could pose a risk.

My thought was to use an application like OSX Proxifier to proxy my specific application's traffic to a proxy server over https using ssl. I would then setup a proxy server, but what I do not understand is how or if it is possible for a proxy to then forward that data to another server.

Answer 1

There are a few standard ways of proxying inbound general network traffic ("reverse proxying").

If the inbound traffic is only HTTP(S), then a web server can forward it. See e.g. ProxyPass in Apache.

Arbitrary inbound TCP traffic can be proxied with SOCKS. A SOCKS-aware client wraps its request in a SOCKS request, and sends it to a SOCKS server, which interprets and forwards the request. This is often done with ssh, which offers the DynamicForward option to set up a SOCKS proxy. It opens a port that listens on the client host, forwards SOCKS traffic over the encrypted connection, and interprets and routes it on the server. Many network clients can be told to use a SOCKS proxy.

Another common way is to tunnel traffic over SSL. stunnel for example will do this. On the client it listens on a port, wraps the traffic within SSL, and sends it to an server. On the server, stunnel unwraps the SSL and forwards the traffic to a configured service.

You can send different types of traffic to the same port, often 443, by using a port multiplexer on the other end to figure out what type of traffic it is and route it to the right service. sslh and sshttp are two that handle the common case of multiplexing HTTP and SSH on one port - say wrapped in SSL and sent to port 443. Finally TCPMUX is a protocol that was developed for port multiplexing. xinetd for example can interpret it, but it isn't implemented in any clients that I know of. (You'd want to wrap it in SSL.)