High-performance HTTP / SOCKS5 proxy gateway for Linux and Windows. Five startup modes, optional external auth and traffic APIs.
Download prebuilt Linux and Windows binaries from GitHub. No compilation required.
agroute-gui.exe includes a desktop UI; agroute.exe is the command-line gateway.
agroute-gui.exe offers a visual interface for listen port, auth modes, start/stop controls, and live logs — no command line required.
Configure listen port, local IP, proxy type, and open / whitelist / password modes in one place.
Start, stop, and save config with clear running status feedback.
Watch proxy activity in real time without opening a separate terminal.
Run ./agroute sps -h to show all flags. Common options:
| Flag | Required | Description |
|---|---|---|
-S | No | Upstream relay type: http or socks5 |
-p | Yes | Listen port(s), e.g. :8080 or :5001-5999 |
-g | Recommended | Public IP; used as local_addr when calling auth API |
-parent | No | Default upstream if auth API does not return upstream |
--auth-url | No | External auth API URL |
--auth-nouser | No | No client password; API decides per connection |
--auth-cache | No | Auth success cache TTL (seconds) |
--auth-fail-cache | No | Auth failure cache TTL (seconds) |
--traffic-url | No | External traffic reporting API URL |
--daemon | No | Run in background |
--forever | No | With --daemon: auto-restart on crash |
--no-detach | No | With --daemon: stay attached (systemd) |
--verbose | No | Full logs |
--quiet | No | Errors only |
--max-conns-rate | No | Global max new connections per second |
--sniff-domain | No | Sniff TLS SNI on HTTP CONNECT |
./agroute sps -h
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP"Production-ready proxy gateway for your infrastructure
HTTP and SOCKS5 on configurable ports.
Open proxy, whitelist API, password, or external API.
Optional async traffic reporting.
Per-user and global connection limits.
Background mode with auto-restart.
Optional domain sniffing on HTTP CONNECT.
Choose the mode that fits your deployment
No --auth-url. Anyone who can reach the port may use the proxy without credentials.
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP"Use --auth-nouser + --auth-url. Your API decides allow/deny per connection.
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP" \
--auth-nouser --auth-url "https://your-api.example.com/auth"Clients must send Proxy-Authorization or SOCKS5 credentials. Returns 407 if missing.
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP"Optional --auth-url sends HTTP GET to your endpoint for each connection.
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP" \
--auth-url "https://your-api.example.com/auth"Optional --traffic-url receives async reports when connections end.
./agroute sps -S http -p ":8080" -g "YOUR_PUBLIC_IP" \
--auth-nouser --traffic-url "https://your-api.example.com/traffic"Query parameters sent with each connection:
| Parameter | Description |
|---|---|
user | Client username |
pass | Client password |
client_addr | Client IP:port |
local_addr | Proxy listen IP:port |
target | Destination URL or host:port |
service | http or socks |
sps | Always 1 |
Response: 200/204 with upstream header to allow; upstream: ERR or non-200 to deny.
| Response Header | Description |
|---|---|
upstream | Upstream proxy URL |
outgoing | Bind source IP hint |
userconns / ipconns | Max concurrent connections |
userrate / iprate | Bandwidth bytes/s per connection |
userqps / ipqps | Max new connections per second |
Async HTTP GET sent when each connection ends. Return 204 No Content.
| Parameter | Description |
|---|---|
act | traffic |
bytes | Total bytes (up + down) |
client_addr | Client IP:port |
server_addr | Proxy service IP:port |
target_addr | Target host or IP:port |
username | Proxy auth username |
upstream | Upstream URL used |
out_local_addr | Outbound TCP local address |
out_remote_addr | Outbound TCP remote address |
id | http or socks |
sniff_domain | TLS SNI (--sniff-domain) |
Use --daemon --forever for production. With systemd, add --no-detach.
./agroute sps -S http -p ":5001-5999" -g "YOUR_PUBLIC_IP" \
--auth-nouser --daemon --forever
# systemd unit: add --no-detachClient connects to agroute-server; server optionally calls your auth API before relaying traffic.
Download the binary, configure your startup mode, and start accepting connections.
Download Binary