Skip to content
No description, website, or topics provided.
Branch: master
Clone or download
Latest commit d1350a2 Jun 1, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.
huproxyclient Add license stuff May 19, 2017
lib Add license stuff May 19, 2017
.gitignore Rename CONTRIBUTING.MD to Jun 1, 2017
LICENSE Add license stuff May 19, 2017
huproxy.go Add license stuff May 19, 2017


Copyright 2017 Google Inc.

This is not a Google product.

HTTP(S)-Upgrade Proxy — Tunnel anything (but primarily SSH) over HTTP websockets.


The reason for not simply using a SOCKS proxy or similar is that they tend to take up an entire port, while huproxy only takes up a single URL subdirectory.

There's also SSL/SSH multiplexers but they:

  1. Take over the port and front both the web server and SSH, instead of letting the web server be the primary owner of port 443.
  2. For SSH don't look like SSL for packet inspectors, because they're not.
  3. Hide the original client address from the web server (without some interesting iptables magic).
  4. Only allow connecting to the server itself, not treat it as a proxy jumpgate.



Create user

sudo htpasswd -c /etc/nginx/users.proxy thomas

Add config to nginx

map $http_upgrade $connection_upgrade {
    default upgrade;
         '' close;
location /proxy {
    auth_basic "Proxy";
    auth_basic_user_file /etc/nginx/users.proxy;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    # proxy_set_header Connection "upgrade";
    proxy_set_header Connection $connection_upgrade;

Start proxy:



These commands assume that HTTPS is used. If not, then change "wss://" to "ws://".

echo thomas:secretpassword > ~/
chmod 600 ~/
cat >> ~/.ssh/config << EOF
    ProxyCommand /path/to/huproxyclient -auth=@$HOME/ wss://


Or manually with these commands:

ssh -o 'ProxyCommand=./huproxyclient -auth=thomas:secretpassword wss://'
ssh -o 'ProxyCommand=./huproxyclient -auth=@<(echo thomas:secretpassword) wss://'
ssh -o 'ProxyCommand=./huproxyclient -auth=@$HOME/ wss://'
You can’t perform that action at this time.