/usr/bin/smokescreen

NAME:
   smokescreen - A simple HTTP proxy that prevents SSRF and can restrict destinations

USAGE:
   smokescreen [global options]

VERSION:
   v0.1.1-0.20261103182740-5b4b7aabca9b

GLOBAL OPTIONS:
   --config-file FILE                                                                       Load configuration from FILE.  Command line options override values in the file.
   --listen-ip IP                                                                           Listen on interface with address IP.
                                                                                              This argument is ignored when running under Einhorn. (default: any)
   --listen-port PORT                                                                       Listen on port PORT.
                                                                                              This argument is ignored when running under Einhorn. (default: 4750)
   --timeout DURATION                                                                       Time out after DURATION when connecting. (default: 10s)
   --proxy-protocol                                                                         Enable PROXY protocol support.
   --allow-self-connections                                                                 Allow connections to local interface addresses on all ports, subject to normal IP and ACL checks (default: false).
   --most-specific-ip-rules                                                                 Resolve overlapping IP rules by longest prefix, then port specificity; deny wins ties (default: false).
   --deny-range RANGE [ --deny-range RANGE ]                                                Add RANGE(in CIDR notation) to list of blocked IP ranges.  Repeatable.
   --unsafe-ip-filter-bypassed-domain string [ --unsafe-ip-filter-bypassed-domain string ]  Bypass IP filters for destination hostname or *.domain glob; ACL and self-connection checks still apply. Trust this domain's DNS. Repeatable.
   --allow-range RANGE [ --allow-range RANGE ]                                              Add RANGE (in CIDR notation) to list of allowed IP ranges.  Repeatable.
   --deny-address string [ --deny-address string ]                                          Add IP[:PORT] to list of blocked IPs.  Repeatable.
   --allow-address string [ --allow-address string ]                                        Add IP[:PORT] to list of allowed IPs.  Repeatable.
   --egress-acl-file FILE                                                                   Validate egress traffic against FILE
   --expose-prometheus-metrics                                                              Expose metrics via prometheus.
   --prometheus-metrics-format string                                                       Prometheus metrics format: legacy, dual, or v2. Requires --expose-prometheus-metrics. (default: "legacy")
   --prometheus-endpoint ENDPOINT                                                           Expose prometheus metrics on ENDPOINT. Requires --expose-prometheus-metrics to be set. (default: "/metrics")
   --prometheus-listen-ip string                                                            Listen for prometheus metrics on interface with address IP. Requires --expose-prometheus-metrics to be set. (default: "0.0.0.0")
   --prometheus-port PORT                                                                   Expose prometheus metrics on PORT. Requires --expose-prometheus-metrics to be set. (default: "9810")
   --resolver-address ADDRESS [ --resolver-address ADDRESS ]                                Make DNS requests to ADDRESS (IP:port). Repeatable. Each DNS exchange picks an address at random.
   --statsd-address ADDRESS                                                                 Send metrics to statsd at ADDRESS (IP:port). (default: "127.0.0.1:8200")
   --metric-tag KEY=VALUE                                                                   Add default metric tag KEY=VALUE to every metric. Repeatable; replaces metrics_tags from --config-file.
   --tls-server-bundle-file FILE                                                            Authenticate to clients using key and certs from FILE
   --tls-client-ca-file FILE [ --tls-client-ca-file FILE ]                                  Validate client certificates using Certificate Authority from FILE
   --tls-crl-file FILE [ --tls-crl-file FILE ]                                              Verify validity of client certificates against Certificate Revocation List from FILE
   --additional-error-message-on-deny MESSAGE                                               Display MESSAGE in the HTTP response if proxying request is denied
   --disable-acl-policy-action POLICY ACTION [ --disable-acl-policy-action POLICY ACTION ]  Disable usage of a POLICY ACTION such as "open" in the egress ACL
   --stats-socket-dir DIR                                                                   Enable connection tracking. Will expose one UDS in DIR going by the name of "track-{pid}.sock".
                                                                                              This should be an absolute path with all symlinks, if any, resolved.
   --stats-socket-file-mode FILE_MODE                                                       Set the filemode to FILE_MODE on the statistics socket (default: "700")
   --unsafe-allow-private-ranges                                                            Allow private ip ranges by default
   --upstream-http-proxy-addr string                                                        Set Smokescreen's upstream HTTP proxy address
   --upstream-https-proxy-addr string                                                       Set Smokescreen's upstream HTTPS proxy address
   --max-concurrent-requests int                                                            Maximum number of requests that can be processed simultaneously.
                                                                                              0 = unlimited (default). (default: 0)
   --max-request-rate float                                                                 Maximum number of requests per second.
                                                                                              0 = unlimited (default). (default: 0)
   --max-request-burst int                                                                  Maximum burst capacity for rate limiting.
                                                                                              Must be greater than max-request-rate when specified.
                                                                                              Omit to use default (2x max-request-rate). (default: -1)
   --max-concurrent-connect-tunnels int                                                     Maximum number of concurrent CONNECT tunnels.
                                                                                              Unlike max-concurrent-requests, this limits actual long-lived connections.
                                                                                              0 = unlimited (default). (default: 0)
   --dns-timeout duration                                                                   Maximum time to wait for DNS resolution. (default: 5s)
   --help, -h                                                                               show help
   --version, -v                                                                            print the version