G3 Proxy - Enterprise HTTP/HTTPS Forward Proxy

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## G3 Proxy - Enterprise HTTP/HTTPS Forward Proxy

Deploy a fully configured, security-hardened g3proxy forward proxy within minutes of instance launch. g3proxy is the enterprise-grade forward, reverse, and TLS proxy server from the Apache-2.0 licensed ByteDance g3 project, written in Rust for high throughput and memory safety. This image packages it as a systemd appliance that requires username and password authentication from the moment it starts, with sane anti-abuse defaults so it never ships as an open relay.

## Why This Image Over Alternatives

Unlike images that ship a proxy with anonymous access or a shared default credential, this image enforces HTTP proxy authentication from the first boot. A unique proxy username and strong password are generated per instance on first boot and written to a root-only credentials file - anonymous and wrong-credential requests are refused with HTTP 407. The proxy accepts authenticated clients from loopback and private (RFC1918) ranges only by default, denies the cloud metadata and link-local range to block SSRF, and restricts destination ports to standard web ports so it cannot be abused to tunnel to arbitrary services. The proxy port is not exposed by the recommended security group, so nothing is reachable from the internet until you deliberately open and scope it. The Apache-2.0 licence means no vendor lock-in and no licence ambiguity for commercial or SaaS deployments.

## Community and Adoption

g3proxy is developed in the open on GitHub as part of ByteDance's g3 project, with an active community and regular release cycles. This image packages the upstream release into a hardened, production-ready deployment so teams adopt g3proxy on AWS without the overhead of building from source and wiring up authentication and network controls by hand.

## What Is Included

• g3proxy server built from the official upstream source release and run as an unprivileged systemd service
• HTTP and HTTPS (CONNECT) forward proxy on a standard proxy port, with authentication enforced from first boot
• Secure-by-default network policy: private-range ingress ACL, anti-SSRF egress ACL, and standard-web-port-only destination filtering
• Auto-starting service that comes up on boot and rotates its per-instance proxy credential on the first boot

## Secure First Boot Process

1. Launch your instance with this image

2. A one-shot systemd service generates a unique proxy username and a cryptographically strong password

3. The credential is written to a file readable only by root and loaded into the proxy

4. Anonymous and wrong-credential requests are refused - authentication is enforced immediately

No shared or default proxy credential ever ships in the image.

## AWS Integration Points

This image runs on Amazon EC2 instances of any supported type. Pair it with:

• Amazon VPC for network isolation and security group rules controlling SSH access and any deliberately-scoped proxy ingress
• Amazon EBS for durable, resizable root storage
• AWS Systems Manager for patch management and remote session access without opening extra ports

Because the recommended security group opens SSH only, remote proxy access is via an SSH tunnel or a security group rule you add and scope yourself.

## Use Cases

• SaaS platform egress control: A SaaS engineering team routing thousands of outbound API calls through a single auditable proxy point to enforce egress policy and simplify security reviews.
• Fintech egress filtering: Financial services teams meeting PCI-DSS or SOC 2 egress filtering requirements by channeling all outbound HTTPS through an authenticated, port-restricted proxy with metadata-blocking controls.
• DevOps authenticated proxy: Platform teams replacing open-relay Squid instances with a high-performance Rust proxy that generates per-instance credentials automatically, eliminating credential sharing across environments.

## Architecture Overview

The proxy sits inside your VPC private subnet. Clients in the same VPC (or peered VPCs) connect to the proxy port over private IP after authenticating with the instance-specific credential. Outbound traffic exits through the VPC NAT gateway or internet gateway. The recommended security group exposes only SSH (port 22); the proxy port is opened only to specific CIDR ranges you define. An SSH tunnel provides secure remote access without exposing the proxy port publicly.

## Deployment Prerequisites

• Security groups: Allow inbound TCP on port 22 (SSH administration and tunnelling). The proxy port is not exposed publicly by default.
• Instance sizing: A general-purpose m5 instance is recommended; forward-proxy throughput benefits from network bandwidth and CPU but runs comfortably for moderate workloads on smaller types.