What is a TCP Proxy?

If you’re keen to learn more about TCP proxy servers, including how they work, their common use cases, configuration steps, benefits, and more, this guide is for you. By the end, you will have all the information you need to get started using these proxies. Let’s dive in!

Key Takeaways

• Typical workflow: It forwards raw traffic at the transport layer (Layer 4) without inspecting application-layer data.
• Supported protocols: Unlike HTTP proxies, TCP proxy servers work with any TCP-based protocol, including databases, SSH, game servers, IoT, and more. These features can make it more versatile and ideal for a wide range of use cases.
• Forwarding vs reverse proxies: A forwarding proxy routes outbound client traffic while a reverse proxy sits in front of servers and handles incoming connect requests.
• Other capabilities: Transmission Control Protocol proxy servers can transparently pass TLS traffic end-to-end, or terminate it themselves using SNI-based multiplexing
• Protocol header: The PROXY protocol header preserves the original client IP when traffic passes through a TCP proxy to a backend
• Common use cases: These include database exposure, load balancing, anonymous scraping, SSH bastions, and game server hosting
• Configuration is straightforward: Define a listen port, set a target host:port, and start the proxy. Nginx, HAProxy, and Envoy all support this configuration natively
• Performance vs other types: A TCP proxy is faster than HTTP proxies due to zero application-layer parsing. The downside is that they don’t offer URL-level controls or header rewriting

What is a TCP Proxy?

It is a server that forwards raw Transmission Control Protocol traffic between a client and a target server (such as websites and web applications) at the transport layer, without inspecting application-layer data. It is also often referred to as a stream proxy.

Simply put, it is a pass-through relay for TCP-based connections such as HTTP, database protocols, SSH, or anything else running over TCP. The support for all kinds of traffic is what makes these proxies very versatile and used for different kinds of applications in the real world. 

How a TCP Proxy Differs From an HTTP Proxy

An HTTP proxy operates at the application layers (Layer 7) — it parses HTTP requests, headers, and URLs, and can apply access controls based on them. It only supports web traffic. A proxy TCP on the other hand operates at the network layer (Layer 4) and only sees connections, byte streams, and port numbers. URL-based filtering and header manipulation are not possible at this layer, which can be a limitation for some use cases. 

TCP Proxy vs TCP Reverse Proxy

The key difference between the two is mainly the direction of the traffic. A forwarding TCP proxy handles outbound connections on behalf of clients. A reverse stream proxy on the other hand sits in front of servers and accepts incoming connections on their behalf. 

Load balancing is the most common reverse proxy use case, enabling incoming connections to be distributed across backend replicas to maintain performance and reliability. For most everyday users, forwarding proxies are what you will likely use. 

How Does a TCP Proxy Work?

• The client connects to the proxy server’s listen port. 
• The proxy opens a second connection to the target server, then shuttles bytes in both directions until either side closes. 
• It never parses the content. The same process works identically for any TCP-based protocol.

The Role of Ports and IP Addressing

The IP address and port are the two most crucial components in traffic routing and networking in general. The proxy binds to a specific port, and that port maps to a configured target service. A single host can expose multiple services by binding to different TCP ports such as port 5432 to PostgreSQL, port 6379 to Redis, and so on. 

The IP address is the server address — it is what devices and networks on the internet use to know where traffic should be forwarded when they receive it. One way to think about it is like a postal address: just as a letter needs a physical address to reach the right building, data packets need an IP address to reach the right device on the internet.

TCP Proxy and TLS Traffic

In pass-through mode, the proxy forwards the encrypted TLS stream without terminating it — end-to-end encryption stays intact. Alternatively, it can terminate TLS itself using its own certificate. SNI-based multiplexing lets a single routing server route multiple TLS services on one port without decrypting traffic.

TCP Proxy Protocol Explained

When a routing server forwards a connection, the backend sees the proxy’s IP, not the client’s. The PROXY protocol fixes this by prepending a small ASCII header to the TCP stream containing the real client IP and port. HAProxy, Nginx, and Envoy all support it natively. Masking the client’s IP address makes its traffic more private and anonymous, which enables bypassing any location or IP-based restrictions.

Common Use Cases

Some of the common use cases include Exposing Databases and Internal Services Publicly. Databases like PostgreSQL, MySQL, Redis, and MongoDB use raw TCP binary protocols, which can’t be effectively handled by HTTP proxies. A TCP proxy provides controlled external access without exposing the database host directly.

Load Balancing TCP Connections

A reverse proxy distributes incoming connections across backend replicas using round-robin or least-connections algorithms. HAProxy and Envoy are the common choices for this pattern. Load balancing ensures that servers receive traffic based on factors like their health and the current load they’re handling.  

Anonymizing Outbound Traffic and Scraping

A forwarding stream proxy routes client traffic through an intermediate IP, which improves anonymity. This anonymity enables other useful applications like geo-targeting and scraping web pages that require IP masking to be more effective. ProxyWing offers residential and datacenter IPs for routing TCP traffic through clean IPs across 190+ countries. Our IP pool has over 70M IPs to choose from giving you more location flexibility. 

Game Servers, SSH, and IoT Protocols

Game servers, SSH bastions, and IoT brokers running MQTT or AMQP all run over TCP and benefit from a proxy layer for access control or IP masking. Masking the IP enables accessing geo-restricted games (or features) or sending SSH traffic to servers with certain geo-restrictions. 

How to Configure a TCP Proxy

• Define a listen port: This is the port the proxy binds to and accepts incoming connections on
• Set the target: This is the destination host and port to forward connections to
• Start the proxy: Apply the config and open the listener

Nginx handles TCP traffic routing via the stream module (separate from the http block):

stream {

    server {

        listen 5432;

        proxy_pass db.internal:5432;

    }

}

HAProxy uses a frontend/backend block with mode tcp:

frontend tcp_front

    bind *:5432

    mode tcp

    default_backend tcp_back

backend tcp_back

    mode tcp

    server db1 db.internal:5432

Envoy uses a listener with a TCP proxy filter in its YAML config:

listeners:

  – address:

      socket_address: { address: 0.0.0.0, port_value: 5432 }

    filter_chains:

      – filters:

          – name: envoy.filters.network.tcp_proxy

            typed_config:

              cluster: db_cluster

All three are production-grade open-source options that you can choose from based on which one you find more convenient and relevant to your environment. Nginx is the simplest to set up, HAProxy is preferred for load balancing, and Envoy suits more complex service mesh environments.

Choosing the TCP Right Provider

One of the most important decisions that will affect your experience is the service provider you choose. For scraping and automation, ProxyWing offers 70M+ IPs for residential and datacenter proxies with clean IPs, enabling city-level targeting and reliable throughput across 190+ countries. Check out their TCP proxies.

Benefits and Limitations 

Benefits

• Works for any TCP-based service and not just HTTP, which makes it more versatile
• Faster than HTTP proxies since it doesn’t involve parsing overhead
• Supports TLS pass-through

Limitations

• No URL-level access controls or header rewriting
• Cannot cache responses
• No visibility into application-layer content

TCP vs HTTP: Which One Do You Need?

The choice between these two depends on the kind of project you intend to handle:

• Use an HTTP routing service if your service speaks HTTP/HTTPS and you need URL-level controls or header rewriting. This is mainly meant for web web requests.
• Use a TCP proxy server if you need to forward database connections, handle custom protocols, or pass TLS end-to-end. For non-web traffic, TCP is always the most practical choice of the two. 

ProxyWing supports both proxy types with residential and datacenter IPs across 190+ countries.