G3 Proxy Enterprise Forward and TLS Proxy Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## G3 Proxy - Enterprise HTTP/HTTPS Forward Proxy

Deploy a fully configured, security-hardened g3proxy forward proxy within minutes of instance launch. g3proxy is the enterprise-grade forward, reverse and TLS proxy server from the Apache-2.0 licensed ByteDance g3 project, written in Rust for high throughput and memory safety. This image packages it as a systemd appliance that requires username and password authentication from the moment it starts, with sane anti-abuse defaults so it never ships as an open relay.

## Why This Image Over Alternatives

Unlike images that ship a proxy with anonymous access or a shared default credential, this image enforces HTTP proxy authentication from the first boot. A unique proxy username and strong password are generated per instance on first boot and written to a root-only credentials file - anonymous and wrong-credential requests are refused with HTTP 407. The proxy accepts authenticated clients from loopback and private (RFC1918) ranges only by default, denies the cloud metadata and link-local range to block SSRF, and restricts destination ports to standard web ports so it cannot be abused to tunnel to arbitrary services. The proxy port is not exposed by the recommended security group, so nothing is reachable from the internet until you deliberately open and scope it. The Apache-2.0 licence means no vendor lock-in and no licence ambiguity for commercial or SaaS deployments.

## Community and Adoption

g3proxy is developed in the open on GitHub as part of ByteDance's g3 project, with an active community and regular release cycles. This image packages the upstream release into a hardened, production-ready deployment so teams adopt g3proxy on AWS without the overhead of building from source and wiring up authentication and network controls by hand.

## About cloudimg

cloudimg publishes production-ready, security-hardened open source AMIs on AWS Marketplace, each following a consistent methodology: no default credentials, secure-by-default network policy, automated credential generation at first boot, and unprivileged service isolation. Support engineers are available 24/7.

## What Is Included

• g3proxy server built from the official upstream source release and run as an unprivileged systemd service
• HTTP and HTTPS (CONNECT) forward proxy on a standard proxy port, with authentication enforced from first boot
• Secure-by-default network policy: private-range ingress ACL, anti-SSRF egress ACL, and standard-web-port-only destination filtering
• Auto-starting service that comes up on boot and rotates its per-instance proxy credential on the first boot

## Secure First Boot Process

1. Launch your instance with this image

2. A one-shot systemd service generates a unique proxy username and a cryptographically strong password

3. The credential is written to a file readable only by root and loaded into the proxy

4. Anonymous and wrong-credential requests are refused - authentication is enforced immediately

No shared or default proxy credential ever ships in the image.

## AWS Integration Points

This image runs on Amazon EC2 instances of any supported type. Pair it with:

• Amazon VPC for network isolation and security group rules controlling SSH access and any deliberately-scoped proxy ingress
• Amazon EBS for durable, resizable root storage
• AWS Systems Manager for patch management and remote session access without opening extra ports

Because the recommended security group opens SSH only, remote proxy access is via an SSH tunnel or a security group rule you add and scope yourself - the credentials file and user guide document both.

## Deployment Prerequisites

• Security groups: Allow inbound TCP on port 22 (SSH administration and tunnelling). The proxy port is not exposed publicly by default.
• Instance sizing: A general-purpose m5 instance is recommended; forward-proxy throughput benefits from network bandwidth and CPU but runs comfortably for moderate workloads on smaller types.
• Client access: By default the proxy accepts authenticated clients from private ranges only; widen the ingress ACL to your own client ranges in the YAML config and reload.

## Use Cases

• Centralised egress proxy: Route outbound HTTP/HTTPS traffic from your VPC through a single authenticated, access-controlled proxy with anti-SSRF egress policy.
• Access-controlled forward proxy: Give applications and users an authenticated HTTP/HTTPS proxy with per-instance credentials instead of an open relay.
• Self-hosted proxy alternative: Teams wanting an Apache-2.0, high-performance Rust proxy with no licence ambiguity deploy this image as a drop-in authenticated forward proxy.

## cloudimg Support

24/7 technical support by email and live chat with a one-hour average first response for critical issues.