Windows Service

Windows Service

By default, proxyforward's engine runs inside the GUI — close the window and the tunnel goes down. That's fine for a desktop, and wrong for a server.

Installed as a Windows service, the engine runs headless in the background: it starts at boot, survives logout, and restarts itself if it crashes. The GUI then becomes a viewer that attaches to it.

This is the right answer for a gateway on a VPS, and for any machine you want to just work after a reboot. (It is also the answer to "how do I autostart?" — the ui.autostart setting does nothing, see Not Yet Implemented.)

Install it

From the GUI: Settings → System → Windows service → Install.

From the command line (elevates via UAC):

proxyforward service install
proxyforward service start

Other subcommands: stop, uninstall. There are no flags — in particular there is no --role; see CLI Reference.

The service is registered to start automatically at boot and to restart on failure.

Where the config goes

Installing seeds the service's config from yours: your %APPDATA%\proxyforward\config.toml is copied to %ProgramData%\proxyforward\config.toml, which is what the service reads from then on. So pair first, get the tunnel working, then install the service.

	Path
Your user config	%APPDATA%\proxyforward\
The service's config	%ProgramData%\proxyforward\

The role comes from that config file. The service doesn't ask which role to run — it runs whatever the config says.

Everything else lives beside it, in the same directory: the gateway's certificate, the analytics database, and the logs. Note this means the service has its own analytics database — stats collected before you installed the service stay in your user directory.

One process owns the ports

There is exactly one engine at a time. It serves a named pipe (\\.\pipe\proxyforward), and that pipe is how ownership is decided:

• Service running, then you open the GUI → the GUI finds the pipe and attaches as a thin client. It shows you live data and can control the engine, but the service owns the config and the ports. Some settings go read-only, and the app tells you why.
• No service → the GUI runs the engine itself.
• Two engines → impossible. The second one fails to take the pipe and exits. This is deliberate: two processes fighting over port 25565 is a much worse failure than one clean refusal.

The pipe is local-only and its permissions admit only Administrators, SYSTEM and the interactive user — it is not a network surface.

Changing settings while the service owns them

Edit them in the GUI as usual; the app will tell you the service owns the setup, and that changes apply once the service stops and the app runs the engine itself. To make a change take effect immediately in the service, change it and restart the service:

proxyforward service stop
proxyforward service start

Uninstalling

proxyforward service stop
proxyforward service uninstall

This removes the service, not your data. %ProgramData%\proxyforward\ — including the config, the certificate and the analytics database — is left where it is. Delete it by hand if you want it gone.