🚀 Abdal 4iProto Proxy

📌 Language: English | فارسی

---

🎯 Why This Software Was Created

Abdal 4iProto Proxy is a high-performance, transparent TCP/UDP proxy designed to sit in front of backend services (including Abdal 4iProto Server) and forward traffic safely and efficiently.

It solves a practical networking problem:

• You need a protocol-agnostic relay that does not inspect or rewrite application payloads
• You want independent TCP and UDP forwarding paths
• You need basic security controls (connection limits, IP filtering, flood protection at application level)
• You may chain multiple proxy instances: Client → Proxy A → Proxy B → Target

For Abdal 4iProto SSH/direct-udpip traffic, this proxy treats the stream as plain TCP bytes and forwards them unchanged. Separately, it also provides a full native RAW UDP relay for applications that send real UDP datagrams.

---

🌐 Part of the Abdal 4iProto Ecosystem

Abdal 4iProto Proxy is a component of the broader Abdal 4iProto ecosystem.
It is designed to work alongside Abdal 4iProto Client/Server as a transparent hop, without becoming an application-layer parser for 4iProto itself.

Bringing this proxy into the 4iProto ecosystem has several important effects:

🕵️ Hiding the original client IP from the destination

The destination usually sees the IP of the last proxy or the 4iProto server, not the user’s direct public IP.

🧩 Harder traffic attribution

Linking observed traffic back to the real origin typically requires correlating a multi-hop path, not a single endpoint.

🧱 Network separation per hop

Each hop only observes its own inbound and outbound relationship. No single intermediate node necessarily sees the full end-to-end path.

🔐 Content security for 4iProto traffic

When traffic travels inside SSH/4iProto, proxies only relay encrypted payloads. They are not supposed to parse, inspect, or modify that content.

📈 Higher analysis cost with Multi-Hop

Chaining multiple proxies increases the cost and complexity of traffic analysis, correlation, and path reconstruction.

Typical ecosystem path:

4iProto Client
      |
      v
Proxy Hop A  --->  Proxy Hop B  --->  Proxy Hop C
      |
      v
4iProto Server / Final Target

---

✨ Features

🔁 Core Proxying

• ✅ Independent TCP proxy (TCP → TCP)
• ✅ Independent UDP proxy (UDP → UDP)
• ✅ Enable/disable TCP and UDP separately via config
• ✅ Multi-port listening on both protocols
• ✅ Transparent, binary-safe forwarding (no payload rewriting)
• ✅ Compatible with chained proxy deployments

📡 TCP Path

• ✅ Full-duplex TCP relay
• ✅ Idle timeout support
• ✅ Protocol-agnostic byte-stream forwarding
• ✅ Suitable for SSH / 4iProto TCP tunnels without parsing SSH or direct-udpip

📦 UDP Path

• ✅ Session-based stateful UDP associations (Client IP + Source Port)
• ✅ One persistent upstream socket per association (NAT-friendly)
• ✅ Multi-response UDP support (1 request → N responses)
• ✅ Exact datagram preservation (including zero-length datagrams)
• ✅ Large receive buffer (65535 bytes) to reduce truncation risk
• ✅ Identity-safe session lifecycle (old workers cannot destroy replacement sessions)

🛡️ Security

• ✅ Max connections per IP
• ✅ Max total connections
• ✅ Application-level connection flood auto-blacklist
• ✅ Static whitelist / blacklist (IP or CIDR)
• ✅ Dynamic blacklist with TTL
• ✅ Optional loop-prevention checks

⚙️ Operations

• ✅ JSON configuration file
• ✅ Colored console logging
• ✅ Graceful shutdown
• ✅ Windows / Linux service install support
• ✅ Cross-platform Go build

---

🧠 How It Works

                     +-> TCP relay -> Target TCP
Client -> Proxy -----|
                     +-> UDP relay -> Target UDP

Path A — Abdal 4iProto over TCP

4iProto Client
      |
      | SSH/TCP (may contain direct-udpip inside)
      v
Abdal 4iProto Proxy
      |
      | unchanged TCP byte stream
      v
Abdal 4iProto Server

The proxy does not parse SSH, does not implement direct-udpip, and does not add/remove framing.

Path B — Native RAW UDP

UDP Application
      |
      | native UDP datagrams
      v
Abdal 4iProto Proxy
      |
      | unchanged UDP datagrams
      v
UDP Target / next proxy hop

Each client endpoint creates one UDP association. Packets are forwarded verbatim. Upstream responses are continuously relayed back to the same client endpoint.

---

🛠️ How to Use

1️⃣ Requirements

• Go 1.21+ (for building from source)
• A writable directory for the binary and config file

2️⃣ Build

go build -o abdal-4iproto-proxy .

3️⃣ Configure

Edit abdal-4iproto-proxy.json:

{
  "server_ip": "192.168.10.10",
  "enable_tcp_proxy": true,
  "enable_udp_proxy": true,
  "tcp_ports": [42690],
  "udp_ports": [42690],
  "security": {
    "max_connections_per_ip": 50,
    "max_total_connections": 2000,
    "enable_connection_flood_protection": true,
    "tcp_idle_timeout_seconds": 300,
    "udp_association_timeout_seconds": 60,
    "enable_loop_prevention": true,
    "blacklist_entry_ttl_seconds": 3600
  },
  "access_control": {
    "whitelist": ["10.0.0.0/8"],
    "blacklist": ["1.2.3.4"]
  }
}

4️⃣ Run

./abdal-4iproto-proxy

Or with a custom config path:

./abdal-4iproto-proxy -config /path/to/abdal-4iproto-proxy.json

5️⃣ Service Mode

# Install as system service
./abdal-4iproto-proxy -install-service

# Run as service
./abdal-4iproto-proxy -service

# Uninstall service
./abdal-4iproto-proxy -uninstall-service

---

⚙️ Configuration Reference

Key	Description
server_ip	Upstream/target server IP or hostname
enable_tcp_proxy	Independently enable/disable TCP proxy
enable_udp_proxy	Independently enable/disable UDP proxy
tcp_ports	Local TCP listen ports to forward
udp_ports	Local UDP listen ports to forward
max_connections_per_ip	Per-IP active connection/session limit
max_total_connections	Global active connection/session limit
enable_connection_flood_protection	Auto-blacklist IPs that hit per-IP limits
tcp_idle_timeout_seconds	TCP idle timeout
udp_association_timeout_seconds	RAW UDP association idle timeout
enable_loop_prevention	Detect obvious localhost proxy loops
blacklist_entry_ttl_seconds	Dynamic blacklist lifetime
access_control.whitelist	Always-allowed IPs/CIDRs
access_control.blacklist	Always-blocked IPs/CIDRs

Useful examples

• TCP only: "enable_tcp_proxy": true, "enable_udp_proxy": false
• UDP only: "enable_tcp_proxy": false, "enable_udp_proxy": true
• Both: keep both flags true

⚠️ udp_association_timeout_seconds belongs to this proxy’s RAW UDP associations.
It is not the Abdal 4iProto Server SSH direct-udpip idle timeout.

---

🧩 Architecture Notes

• TCP and UDP implementations are independent
• Disabling one protocol does not remove or break the other
• UDP is generic Layer-4 relay logic (no 4iProto framing inside UDP code)
• Security counters apply to TCP connections and UDP associations

---

🐛 Reporting Issues

If you encounter any issues or have configuration problems, please reach out via email at Prof.Shafiei@Gmail.com. You can also report issues on GitLab or GitHub.

❤️ Donation

If you find this project helpful and would like to support further development, please consider making a donation:

• Donate Here

🤵 Programmer

Handcrafted with Passion by Ebrahim Shafiei (EbraSha)

• E-Mail: Prof.Shafiei@Gmail.com
• Telegram: @ProfShafiei

📜 License

This project is licensed under the GNU AGPLv3 with additional terms as permitted by Section 7 of the AGPLv3. See LICENSE for the complete text including additional terms.

Summary of Your Rights and Obligations

• ✅ You may use, study, modify, and redistribute this software under the terms of AGPLv3.
• ✅ You may create derivative works, provided you comply with the attribution and renaming requirements below.
• ⚠️ Network use triggers source disclosure obligations (AGPLv3 §13). If you run a modified version of this software as a network service, you must offer the modified source code to its users.
• ⚠️ The names "Abdal 4iProto Proxy", "Abdal", "EbraSha", "Abdal Security Group", "Nahaanbin CyberSecurity Company" and associated logos are trademarks of Ebrahim Shafiei (EbraSha) and are NOT covered by the AGPLv3 license.
• ⚠️ Forks and modified versions MUST be renamed to a name that is not confusingly similar to the Project Brand, and may NOT reuse the original branding, logos, or visual identity.
• ⚠️ All author attributions, copyright notices, "About" screens, credit lines, and identifying information MUST be preserved in any modified version. Removal or obfuscation is a material violation of the License.
• ⚠️ Modified versions must clearly indicate they are modified and must not be represented as the official version.

For details, see the Additional Terms section in the LICENSE file.

Commercial / Trademark Licensing

For commercial licensing, trademark licensing, or permissions beyond the scope of AGPLv3, please contact:

• Author: Ebrahim Shafiei (EbraSha)
• Team: Abdal Security Group
• Company: Nahaanbin CyberSecurity Company
• Email: Prof.Shafiei@gmail.com
• Repository: https://github.com/ebrasha/abdal-4iproto-proxy

Reporting License Violations

If you discover a fork, distribution, or commercial use that violates these terms (such as removed attribution, reused branding, or unauthorized trademark use), please report it via the contact above.