Show HN: ProxyBridge redirect any Windows TCP/UDP traffic to HTTP/SOCKS5 proxies

ProxyBridge is a lightweight, open-source alternative to Proxifier that provides transparent proxy routing for Windows applications. It redirects TCP and UDP traffic from specific processes through SOCKS5 or HTTP proxies, with the ability to route, block, or allow traffic on a per-application basis. Unlike Proxifier which only logs UDP connections without proxy support, ProxyBridge fully supports both TCP and UDP proxy routing. Working at the kernel level using WinDivert, ProxyBridge is compatible with proxy-unaware applications without requiring any configuration changes.

• Dual interface - Feature-rich GUI and powerful CLI for all use cases
• Process-based traffic control - Route, block, or allow traffic for specific applications
• Universal compatibility - Works with proxy-unaware applications
• Multiple proxy protocols - Supports SOCKS5 and HTTP proxies
• Kernel-level interception - Uses WinDivert for reliable packet capture
• No configuration needed - Applications work without any modifications
• Protocol agnostic - Compatible with TCP and UDP protocols (HTTP/HTTPS, HTTP/3, databases, RDP, SSH, games, DTLS, DNS, etc.)
• Traffic blocking - Block specific applications from accessing the internet or any network (LAN, localhost, etc.)
• Flexible rules - Direct connection, proxy routing, or complete blocking per process
• Advanced rule configuration - Target specific processes, IPs, ports, protocols (TCP/UDP), and hostnames with wildcard support
• Process exclusion - Prevent proxy loops by excluding proxy applications

• Installation
• Usage
  • GUI Application
    • Proxy Settings
    • Process Rules
    • Activity Monitoring
  • Command Line Interface (CLI)
    • Basic Usage
    • Command Line Options
    • Rule Examples
• Use Cases
• Current Limitations
• Things to Note
• How It Works
• Build from Source
• License
• Author
• Credits

1. Download the latest ProxyBridge-Installer-vX.X.X.exe from the Releases page
2. Run the installer with Administrator privileges
3. The installer will:
   • Install ProxyBridge to C:\Program Files\ProxyBridge
   • Add the CLI to your system PATH for easy command-line access
   • Create Start Menu shortcuts for the GUI application
   • Include all required dependencies (WinDivert driver)

Launch ProxyBridge.exe (GUI) with Administrator privileges for an intuitive graphical interface to:

1. Click Proxy tab in the main window
2. Click Proxy Settings from the menu
3. Select Proxy Type (SOCKS5 or HTTP)
4. Enter Proxy IP Address (e.g., 127.0.0.1)
5. Enter Proxy Port (e.g., 1080 for SOCKS5, 8080 for HTTP)
6. (Optional) Enter Proxy Username and Proxy Password for authenticated proxies
7. Click Save Changes

Test Proxy Connection:

1. Click Test Proxy Connection button
2. Enter Destination IP/Host (default: google.com)
3. Enter Destination Port (default: 80)
4. Click Start Test to verify proxy connectivity
5. View test results in the output area

1. Click Proxy tab in the main window

2. Click Proxy Rules from the menu

3. Configure rule parameters:

   Applications:

   • Use * as wildcard for all processes
   • Enter single process: chrome.exe
   • Enter multiple processes (semicolon-separated): firefox.exe; chrome.exe
   • Use Browse button to select process executable from directory

   Target Hosts (Optional):

   • Specific IP: 127.0.0.1
   • Wildcard IP range: 127.0.*.* or 192.168.*.*
   • Multiple IPs: 127.0.0.1; 192.168.1.1
   • IP range: 10.10.1.1-10.10.255.255
   • Leave empty or use * for all hosts

   Target Ports (Optional):

   • Specific ports: 80; 8080
   • Port range: 80-8000
   • Leave empty or use * for all ports

   Protocol:

   • Select TCP, UDP, or Both (TCP + UDP)

   Action:

   • PROXY - Route through configured proxy
   • DIRECT - Allow direct internet access
   • BLOCK - Block all internet access

4. Click Save Rule to apply the configuration

• View real-time connection activity in the Connections tab
• Monitor all system connections including both TCP and UDP protocols
• See connections from all processes, whether they match rules or not
• Track which processes are active and their routing status (PROXY, DIRECT, or BLOCK)
• Search and filter connections using the search box

Note: Adding a rule with action PROXY while no proxy is configured will result in traffic being routed through a direct connection instead. Make sure to configure proxy settings before using PROXY rules.

The CLI provides powerful automation and scripting capabilities with rule-based traffic control:

Format: process:hosts:ports:protocol:action

• process - Process name(s): chrome.exe, chrome.exe;firefox.exe, steam*.exe, or *
• hosts - Target IP/hostname(s): *, 192.168.1.1, 192.168.*.*, 10.10.1.1-10.10.255.255, or 192.168.1.1;10.10.10.10
• ports - Target port(s): *, 443, 80;443;8080, 80-8000, or 80;443;8000-9000
• protocol - TCP, UDP, or BOTH
• action - PROXY, DIRECT, or BLOCK

Examples:

Notes:

• After installation, the CLI is available from any terminal (no .\ prefix needed)
• Process names are case-insensitive
• Use * as the process name to set a default action for all traffic
• Press Ctrl+C to stop ProxyBridge

• Redirect proxy-unaware applications (games, desktop apps) through InterceptSuite/Burp Suite for security testing
• Route specific applications through Tor,SOCKS5 or HTTP proxies
• Intercept and analyze traffic from applications that don't support proxy configuration
• Test application behavior under different network conditions
• Analyze protocols and communication patterns

• IPv4 only (IPv6 not supported)

• DNS Traffic Handling: DNS traffic on TCP and UDP port 53 is handled separately from proxy rules. Even if you configure rules for port 53, they will be ignored. Instead, DNS routing is controlled by the DNS via Proxy option in the Proxy menu (enabled by default). When enabled, all DNS queries are routed through the proxy; when disabled, DNS queries use direct connection.

• Automatic Direct Routing: Certain IP addresses automatically use direct connection regardless of proxy rules. This includes:

  • Localhost addresses (127...*)
  • Broadcast and multicast addresses
  • These IPs are used by various processes (curl, Firefox, NVIDIA drivers, Windows services) and system components. Note that Windows loopback traffic uses its own method that bypasses the network interface card (NIC), which currently doesn't support proxy routing due to technical limitations with WinDivert at the network layer.

• UDP Proxy Requirements: UDP traffic only works when a SOCKS5 proxy is configured. If an HTTP proxy server is configured, ProxyBridge will ignore UDP proxy rules and route UDP traffic as direct connection instead. This limitation does not affect UDP rules with BLOCK or DIRECT actions.

  Important UDP Considerations:

  • Configuring a SOCKS5 proxy does not guarantee UDP will work. Most SOCKS5 proxies do not support UDP traffic, including SSH SOCKS5 proxies.
  • The SOCKS5 proxy must support UDP ASSOCIATE command. If ProxyBridge fails to establish a UDP association with the SOCKS5 proxy, packets will fail to connect.
  • Many UDP applications use HTTP/3 and DTLS protocols. Even if your SOCKS5 proxy supports UDP ASSOCIATE, ensure it can handle DTLS and HTTP/3 UDP traffic, as they require separate handling beyond raw UDP packets.
  • Testing UDP/HTTP3/DTLS Support: If you need to test UDP, HTTP/3, and DTLS support with a SOCKS5 proxy, try Nexus Proxy - a proxy application created specifically to test ProxyBridge with advanced UDP protocols.

ProxyBridge use Windivert to inspect all TCP/UDP packets and use rules from user to perform action on them

Case 1: Packet does not match any rules

Case 2: Packet match with proxy rule

Traffic Flow:

1. Applications Generate Traffic - User-mode applications (Chrome, Discord, Games, Services) create TCP/UDP packets
2. Kernel Interception - WinDivert.sys driver intercepts ALL outbound packets at kernel level
3. User-Mode Delivery - WinDivert.dll receives intercepted packets and delivers them to ProxyBridge
4. Rule Evaluation - ProxyBridge inspects each packet and applies configured rules:
   • BLOCK → Packet is dropped (no network access)
   • DIRECT → Packet is re-injected unchanged (direct connection)
   • NO MATCH → Packet is re-injected unchanged (direct connection)
   • PROXY → Packet destination is modified to TCP/UDP relay servers (34010/34011)
5. Proxy Processing - For PROXY-matched packets:
   • Relay servers store original destination IP and port
   • Convert raw TCP/UDP to SOCKS5/HTTP proxy protocol
   • Perform proxy authentication and forward to proxy server
6. Proxy Forwarding - Proxy server (Burp Suite/InterceptSuite) forwards traffic to original destination
7. Response Handling - Return traffic flows back through relay servers, which restore original source IP/port before re-injection

Key Points:

• All packet manipulation happens transparently - applications remain completely unaware
• WinDivert operates at kernel level for reliable interception before packets reach the network
• ProxyBridge rule engine provides granular control over which traffic gets proxied
• TCP/UDP relay servers handle protocol conversion between raw sockets and proxy protocols

• Windows 7 or later (64-bit)
• Administrator privileges (required for WinDivert driver)
• WinDivert 2.2.2-A or later
• GCC (MinGW-w64) or MSVC compiler

If you prefer to build ProxyBridge from source:

1. Download WinDivert 2.2.2-A from the official website
2. Extract WinDivert to a known location (e.g., C:\WinDivert-2.2.2-A)
3. Clone or download ProxyBridge source code
4. Compile using one of the methods below:

5. Run ProxyBridge.exe with Administrator privileges

MIT License - See LICENSE file for details

Sourav Kalal / InterceptSuite

This project is built on top of WinDivert by basil00. WinDivert is a powerful Windows packet capture and manipulation library that makes kernel-level packet interception possible. Special thanks to the WinDivert project for providing such a robust foundation.

Based on the StreamDump example from WinDivert: https://reqrypt.org/samples/streamdump.html