# proxy

* [proxy for bash](#proxy-for-bash)
* [proxy for curl](#proxy-for-curl)
* [proxy for yum](#proxy-for-yum)
* [proxy for apt](#proxy-for-apt)
* [proxy for docker](#proxy-for-docker)
  * [for docker build](#for-docker-build)
  * [for docker pull](#for-docker-pull)
* [proxy for pip](#proxy-for-pip)
  * [setup via command line](#setup-via-command-line)
  * [using directly](#using-directly)
* [proxy for ssh](#proxy-for-ssh)
  * [nc](#nc)
  * [corkscrew](#corkscrew)
  * [ncat](#ncat)
  * [connect](#connect)
  * [socat](#socat)
* [proxy for git](#proxy-for-git)
  * [http.proxy and https.proxy](#httpproxy-and-httpsproxy)
  * [core.gitproxy](#coregitproxy)
  * [core.sshCommand](#coresshcommand)
* [proxy for npm](#proxy-for-npm)
* [proxy for nc](#proxy-for-nc)
* [proxy for ssl](#proxy-for-ssl)
* [Q\&A](#qa)
  * [nc : `nc: Proxy error: "HTTP/1.1 200 Connection established"`](#nc--nc-proxy-error-http11-200-connection-established)
* [proxy with kubeconfig](#proxy-with-kubeconfig)
* [proxy with windows](#proxy-with-windows)

{% hint style="info" %}
> references:
>
> * [How to Use Netcat Commands: Examples and Cheat Sheets](https://www.varonis.com/blog/netcat-commands)
> * [SSH Tunneling and Proxying](https://www.baeldung.com/linux/ssh-tunneling-and-proxying)
> * [bryanpkc/corkscrew](https://github.com/bryanpkc/corkscrew)
> * [nc / netcat](https://ss64.com/osx/nc.html)
> * [gotoh/ssh-connect](https://github.com/gotoh/ssh-connect)
> * [larryhou/connect-proxy](https://github.com/larryhou/connect-proxy)
{% endhint %}

### proxy for bash

```bash
# global settings
$ cat /etc/bashrc
export http_proxy=http://proxy.domain.com:80/
export https_proxy=http://proxy.domain.com:80/

# individual account settings
$ cat ~/.bashrc
export http_proxy=http://proxy.domain.com:80/
export https_proxy=http://proxy.domain.com:80/
```

### proxy for curl

```bash
$ curl -x http://proxy.domain.com:80 <https://target.server.com>
```

*   to get head only

    ```bash
    $ curl -kvI -x http://proxy.domain.com:80 <https://target.server.com>
    ```

### proxy for yum

```bash
$ cat /etc/yum.conf
[main]
proxy=http://proxy.domain.com:80
```

### proxy for apt

> \[!TIP|label:see also]
>
> * [\* imarlso : apt.conf](https://github.com/marslo/ibook/blob/marslo/docs/linux/apt-yum.html#aptconf)

```bash
$ cat /etc/apt/apt.conf
Acquire::http::Proxy "http://proxy.domain.com:80";
Acquire::https::Proxy "http://proxy.domain.com:80";
Acquire::ftp::Proxy "http://proxy.domain.com:80";
```

### proxy for docker

> \[!TIP|label:see also]
>
> * [\* imarslo : docker proxy](https://github.com/marslo/ibook/blob/marslo/docs/virtualization/docker/tricky.html#docker-with-proxy)
> * [\* imarslo : setup proxy in daemon.json](https://github.com/marslo/ibook/blob/marslo/docs/virtualization/docker/dockerd.html#proxy)

#### for docker build

```json
$ mkdir -p ~/.docker
$ cat > ~/.docker/config.json << EOF
{
        "proxies": {
                "default": {
                        "httpProxy": "http://proxy.domain.com:80",
                        "httpsProxy": "http://proxy.domain.com:80"
                }
        }
}
EOF
```

*   or via cmd directly

    ```bash
    $ docker build \
             --build-arg http_proxy=http://proxy.domain.com:80 \
             --build-arg https_proxy=http://proxy.domain.com:443 \
    ```

#### for docker pull

```bash
# for rootless mode
$ mkdir -p ~/.config/systemd/user/docker.service.d/
# or regular mode
$ sudo mkdir -p /etc/systemd/system/docker.service.d

$ sudo bash -c "cat > /etc/systemd/system/docker.service.d" << EOF
[Service]
Environment="HTTP_PROXY=http://proxy.domain.com:80"
Environment="HTTPS_PROXY=https://proxy.domain.com:443"
Environment="NO_PROXY=localhost,127.0.0.1,docker-registry.example.com,.corp"
EOF

$ sudo systemctl daemon-reload
$ sudo systemctl restart docker

# verify
$ systemctl show docker --property Environment
Environment=HTTPS_PROXY=http://proxy.domain.com:443 HTTP_PROXY=http://proxy.domain.com:80 NO_PROXY=localhost,127.0.0.1,docker-registry.example.com,.corp
```

### proxy for pip

> \[!TIP|label:paths]
>
> * MS Windows: `%APPDATA%\pip\pip.ini`
> * MacOS: `$HOME/Library/Application Support/pip/pip.conf`
> * Unix: `$HOME/.config/pip/pip.conf`

#### setup [via command line](https://stackoverflow.com/a/69568878/2940319)

```bash
$ pip config set global.proxy http://proxy.domain.com:80
```

#### using directly

```bash
$ pip install --proxy http://proxy.domain.com:80 git-review
```

### proxy for ssh

#### nc

```bash
$ ssh -vT \
      -o "ProxyCommand=nc -X connect -x proxy.domain.com:80 %h %p" \
      -p 22 \
      ssh://remote.git.com
# or
$ ssh -vT \
      -o "ProxyCommand=netcat -X connect -x proxy.domain.com:80 %h %p" \
      -p 22 \
      ssh://remote.git.com

$ cat ~/.ssh/config
Host  github.com
      User                username@domain.com
      ServerAliveInterval 60
      Hostname            ssh.github.com
      Port                443
      ProxyCommand        nc -X connect -x proxy.domain.com:80 %h %p
```

*   for socks5

    ```bash
    ProxyCommand        nc -X 5 -x proxy.domain.com:80 %h %p
    ```

#### corkscrew

```bash
$ brew install corkscrew

$ ssh -vT \
      -o "ProxyCommand=corkscrew proxy.domain.com 80 %h %p" \
      -p 22 \
      ssh://remote.git.com

$ cat ~/.ssh/config
Host  github.com
      User                username@domain.com
      ServerAliveInterval 60
      Hostname            ssh.github.com
      Port                443
      ProxyCommand        corkscrew proxy.domain.com 80 %h %p
```

#### [ncat](https://nmap.org/)

```bash
$ brew install nmap

$ ssh -vT \
      -o "ProxyCommand=ncat --proxy proxy.domain.com:80 --proxy-type http %h %p" \
      -p 22 \
      ssh://remote.git.com

$ cat ~/.ssh/config
Host  github.com
      User                username@domain.com
      ServerAliveInterval 60
      Hostname            ssh.github.com
      Port                443
      ProxyCommand        ncat --proxy proxy.domain.com:80 --proxy-type http %h %p
```

*   for socks5

    ```bash
    ProxyCommand        ncat --proxy proxy.domain.com:80 --proxy-type socks5 %h %p
    ```

#### [connect](https://github.com/gotoh/ssh-connect)

> \[!NOTE] applicable to git for windows

```bash
$ brew install connect

$ ssh -vT \
      -o "ProxyCommand=connect -H proxy.domain.com:80 %h %p" \
      -p 22 \
      ssh://remote.git.com

$ cat ~/.ssh/config
Host  github.com
      User                username@domain.com
      ServerAliveInterval 60
      Hostname            ssh.github.com
      Port                443
      ProxyCommand        connect -H proxy.domain.com:80 %h %p
```

*   for socks5

    ```bash
    ProxyCommand        connect -S proxy.domain.com:80 %h %p
    ```

#### [socat](http://www.dest-unreach.org/socat/)

> \[!NOTE]
>
> * [he socat Command in Linux](https://www.baeldung.com/linux/socat-command)
> * [sit/gitproxy-socat](https://gist.github.com/sit/49288)

### proxy for git

> \[!NOTE|label:references]
>
> * [evantoli/GitConfigHttpProxy.md](https://gist.github.com/evantoli/f8c23a37eb3558ab8765)
> * [Using git with a proxy](https://elinux.org/Using_git_with_a_proxy)
> * [yougg/proxy.md](https://gist.github.com/yougg/5d2b3353fc5e197a0917aae0b3287d64)
> * [evantoli/GitConfigHttpProxy.md](https://gist.github.com/evantoli/f8c23a37eb3558ab8765)
> * [Tutorial: how to use git through a proxy](http://cms-sw.github.io/tutorial-proxy.html)
> * [cms-sw/cms-git-tools](https://github.com/cms-sw/cms-git-tools/blob/master/git-proxy)
> * no ssl verify:
>   * `set GIT_SSL_NO_VERIFY=true`
>   * `echo http{,s} | fmt -1 | xargs -i git config --global {}.sslVerify=false`
> * how to debug:
>   * [https](https://stackoverflow.com/a/128198/2940319) : `GIT_CURL_VERBOSE=1 git ...` or [`GIT_TRACE_CURL=true git ...`](https://stackoverflow.com/a/38285866/2940319)
>   * ssh : `GIT_SSH_COMMAND='ssh -v' git ...` or `git -c sshCommand='ssh -v' ...`
> *   [core.gitproxy](https://gist.github.com/coin8086/7228b177221f6db913933021ac33bb92)
>
>     ```bash
>     A "proxy command" to execute (as command host port) instead of establishing direct connection to the
>     remote server when using the Git protocol for fetching. If the variable value is in the
>     "COMMAND for DOMAIN" format, the command is applied only on hostnames ending with the specified
>     domain string. This variable may be set multiple times and is matched in the given order; the first
>     match wins.
>
>     Can be overridden by the GIT_PROXY_COMMAND environment variable (which always applies universally,
>     without the special "for" handling).
>     ```

#### http.proxy and https.proxy

```bash
$ git config --global https.proxy 'http://proxy.domain.com:80'   # using privoxy convert socks to http
$ git config --global http.proxy  'http://proxy.domain.com:80'
$ git config --global https.sslVerify false                       # unable to access '...': Unknown SSL protocol error in connection to ...:443
$ git config --global http.sslVerify false                        # unable to access '...': Unknown SSL protocol error in connection to ...:443
```

*   or [`gitPorxy`](https://mirrors.edge.kernel.org/pub/software/scm/git/docs/git-config.html#EXAMPLES)

    ```bash
    $ cat ~/.gitconfig
    # Proxy settings
    [core]
            gitproxy=proxy-command for kernel.org
            gitproxy=default-proxy ; for all the rest
    ```
*   for specific url

    ```bash
    $ git config --global http.https://github.com http://proxy.domain.com:80
    $ git config --global http.https://chromium.googlesource.com http://proxy.domain.com:80
    ```
*   or

    ```bash
    $ cat ~/.gitconfig
    [http]
      proxy = http://proxy.domain.com:80
    [https]
      proxy = http://proxy.domain.com:80
    [http "https://chromium.googlesource.com"]
      proxy = http://proxy.domain.com:80
    [http "https://github.com"]
      proxy = http://proxy.domain.com:80
    ```
*   [for socks5](https://github.com/521xueweihan/git-tips#git-%E9%85%8D%E7%BD%AE-http-%E5%92%8C-socks-%E4%BB%A3%E7%90%86)

    ```bash
    $ git config --global socks.proxy "proxy.domain.com:80"

    # or
    $ git config --global socks.proxy "socks5://proxy.domain.com:80"
    ```
*   additional usage

    ```bash
    $ cat ~/.gitconfig
    ...
    [url "git@ssh.github.com"]
      insteadOf    = git@github.com
    [url "git@ssh.github.com:"]
      insteadOf    = https://github.com/
    [http]
      sslVerify    = false
      postBuffer   = 524288000
      # sslVersion = tlsv1.1
      # sslVersion = tlsv1.2
      # sslVersion = tlsv1.3
    ...
    ```
*   show current configure

    ```bash
    $ git config --global --get-regexp http.*
    $ git config --global --get-regexp .*proxy.*
    ```
*   unset

    ```bash
    $ git config --global --unset http.proxy
    $ git config --global --unset http.https://github.com

    $ git config --global --unset http.sslVerify
    $ git config --global --unset http.https://domain.com.sslVerify
    ```

#### core.gitproxy

```bash
$ git config --global core.gitproxy https://proxy.domain.com:80
$ git config --global url.git://github.com/.insteadOf git@github.com:
```

#### core.sshCommand

> \[!NOTE]
>
> * [core.sshCommand](https://stackoverflow.com/a/38474137/2940319) since 26 Jun 2016 [commit 3c8ede3](https://github.com/git/git/commit/3c8ede3ff312134e84d1b23a309cd7d2a7c98e9c)
>
> > A new configuration variable `core.sshCommand` has been added to specify what value for `GIT_SSH_COMMAND` to use per repository.

```bash
$ git config --global core.sshCommand "ssh -v -o 'ProxyCommand=connect -H proxy.domain.com:80 %h %p'"

# or
$ git -c core.sshCommand "ssh -v -o 'ProxyCommand=commect -H proxy.domain.com:80 %h %p'" clone git@github.com/marslo/ibook.git
```

### proxy for npm

> \[!NOTE|label:referencs]
>
> * [npm config](https://docs.npmjs.com/cli/v8/using-npm/config)
> * [Is there a way to make npm install (the command) to work behind proxy?](https://stackoverflow.com/a/10304317/2940319)
> * [How to fix SSL certificate error when running Npm on Windows?](https://stackoverflow.com/a/54538095/2940319)

```bash
$ npm config set proxy http://proxy.domain.com:80/
$ npm config set https-proxy http://proxy.domain.com:80/
$ npm config set noproxy '127.0.0.1,noproxy.domain.com'

# optional
$ npm config set strict-ssl false
```

*   or

    ```bash
    $ cat ~/.npmrc
    strict-ssl=false
    proxy=http://proxy.domain.com:80/
    https-proxy=http://proxy.domain.com:80/
    ```

### proxy for nc

> \[!NOTE|label:manual page]
>
> ```bash
> -X proxy_version
>         Requests that nc should use the specified protocol when talking to the proxy server.
>         Supported protocols are:
>         - “4” (SOCKS v.4)
>         - “5” (SOCKS v.5)
>         - “connect” (HTTPS proxy)
>         If the protocol is not specified, SOCKS version 5 is used.
> ```
>
> *   additional
>
>     ```bash
>     -T protocols=all
>     ```

```bash
# with proxy
$ nc -zv -X connect -x proxy.domain.com:80 google.com 443
nc: Proxy error: "HTTP/1.1 200 Connection established"

# without proxy
$ nc -zv google.com 443
nc: connectx to google.com port 443 (tcp) failed: Operation timed out
```

### [proxy for ssl](https://curl.se/docs/sslcerts.html)

> \[!NOTE|label:https proxy] Since version 7.52.0, curl can do HTTPS to the proxy separately from the connection to the server. This TLS connection is handled separately from the server connection so instead of `--insecure` and `--cacert` to control the certificate verification, you use `--proxy-insecure` and `--proxy-cacert`. With these options, you make sure that the TLS connection and the trust of the proxy can be kept totally separate from the TLS connection to the server.

### Q\&A

#### nc : `nc: Proxy error: "HTTP/1.1 200 Connection established"`

*   issue

    ```bash
    $ nc -X connect -x 127.0.0.1:8080 -zv git.domain.com 22
    nc: Proxy error: "HTTP/1.1 200 Connection established"
    ```
*   solution

    ```bash
    $ corkscrew 127.0.0.1 8080 git.domain.com 22
    SSH-2.0-GerritCodeReview_2.16.27-RP-1.10.2.4 (SSHD-CORE-2.0.0)
    ^C

    $ ncat --proxy 127.0.0.1:1087 --proxy-type http sample.gerrit.com 29418
    SSH-2.0-GerritCodeReview_2.16.27-RP-1.10.2.4 (SSHD-CORE-2.0.0)
    ^C

    $ cat ~/.ssh/config
      Host  git.domain.com
            Hostname              git.domain.com
            User                  marslo
            Port                  22
            StrictHostKeyChecking no
            UserKnownHostsFile    ~/.ssh/known_hosts
            ProxyCommand          corkscrew 127.0.0.1 8080 %h %p
            # or
            ProxyCommand          ncat --proxy 127.0.0.1:8080 --proxy-type http %h %p

    # verify in ssh
    $ ssh -vT -o "ProxyCommand=corkscrew 127.0.0.1 8080 %h %p" -p 22 git.domain.com
    ```

### proxy with kubeconfig

> \[!NOTE|label:see also]
>
> * [\* imarslo : Kubectl context and configuration](https://github.com/marslo/ibook/blob/marslo/docs/virtualization/kubernetes/kubeconfig.html#with-proxy)

```bash
$ kubectl config set-cluster <my-cluster-name> --proxy-url=<my-proxy-url>

# i.e.
$ kubectl config set-cluster development --proxy-url=http://proxy.domain.com:8080
```

### proxy with windows

> \[!NOTE]
>
> * [How can we configure the .pac proxy to git](https://github.com/desktop/desktop/issues/5516#issuecomment-417357195)
> * [otahi/pacproxy](https://github.com/otahi/pacproxy)

*   [add/modify](https://stackoverflow.com/a/27160821/2940319)

    ```batch
    > reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1
    > reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d name:port
    > reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyUser /t REG_SZ /d username
    > reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyPass /t REG_SZ /d password
    > netsh winhttp import proxy source=ie
    ```
*   [or](https://stackoverflow.com/a/57613619/2940319)

    ```batch
    > netsh winhttp set proxy proxy-server="socks=localhost:9090" bypass-list="localhost"

    REM show
    > netsh winhttp show proxy

    REM reset
    > netsh winhttp reset proxy
    ```
*   [or](https://stackoverflow.com/q/61575646/2940319)

    ```batch
    > netsh winhttp set proxy 127.0.0.1:1080
    > netsh winhttp set proxy proxy-server="socks=127.0.0.1:9150" bypass-list="127.0.0.1"
    > netsh winhttp set proxy proxy-server="socks=localhost:9150" bypass-list="localhost"
    > netsh winhttp set proxy proxy-server="http=127.0.0.1:1080"  bypass-list="127.0.0.1"
    > netsh winhttp set proxy proxy-server="https=127.0.0.1:1080" bypass-list="127.0.0.1"
    ```
*   check

    ```batch
    $ reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" | find AutoConfigURL
        AutoConfigURL    REG_SZ    http://proxy.domain.com/file.pac

    REM full list
    $ reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
        CertificateRevocation    REG_DWORD    0x1
        DisableCachingOfSSLPages    REG_DWORD    0x0
        IE5_UA_Backup_Flag    REG_SZ    5.0
        PrivacyAdvanced    REG_DWORD    0x1
        SecureProtocols    REG_DWORD    0x800
        User Agent    REG_SZ    Mozilla/5.0 (compatible; MSIE 9.0; Win32)
        SecureProtocolsUpdated    REG_DWORD    0x1
        EnableNegotiate    REG_DWORD    0x1
        ProxyEnable    REG_DWORD    0x0
        MigrateProxy    REG_DWORD    0x1
        AutoConfigURL    REG_SZ    http://proxy.domain.com/file.pac
    ```
