ip/proxy/direct
Type: Directory
Rules that decide which requests go directly to the server when a parent proxy is set with parent-proxy and parent-proxy-port in /ip/proxy. The proxy checks the rules from top to bottom, and the first matching rule decides. A request that matches no rule goes through the parent proxy. Without a parent proxy, every request goes directly to the server and the list has no effect. The matchers work as in /ip/proxy/access. Prefix a matcher value with ! to negate it, for example src-address=!192.168.88.0/24. For an example, see Web Proxy.
<ArgTableRow arg="X" typ="disabled">disabled. The rule is not used. New rules are created enabled.</ArgTableRow>
<ArgTableRow arg="src-address" typ="super { !
, range: alt { ip4: ipRange
, ip6: ip6Prefix
}
}">Address of the client: an IPv4 address, range or prefix, or an IPv6 prefix.</ArgTableRow>
<ArgTableRow arg="dst-address" typ="super { !
, range: alt { ip4: ipRange
, ip6: ip6Prefix
}
}">Address of the server the proxy connects to, which is the resolved address of the host name in the request. Same format as src-address.</ArgTableRow>
<ArgTableRow arg="dst-port" typ="super { !
, ports: multi { ports: range [ .. 65535]
}
}">Port of the server, for HTTPS requests the port of the CONNECT tunnel. A port, a range or a comma-separated list, for example dst-port=!443.</ArgTableRow>
<ArgTableRow arg="local-port" typ="super { !
, port: num [0 .. 65535]
}">Port of the proxy the request arrived on. Use it when port in /ip/proxy lists several ports.</ArgTableRow>
Host name of the request, for HTTPS requests the host of the CONNECT tunnel. The value must match the whole name and is not case-sensitive, so example.com does not match www.example.com.
- Wildcards:
*matches any characters and?one character, for example*.example.com. - A value that starts with
:is a regular expression, which can match any part of the name::mailmatchesmail.example.com. Anchor it with^and$, for example:^www.
Path of the requested URL, including the query string, for example /music/a.mp3?x=1. Wildcards and regular expressions work as in dst-host.
- Wildcards must match the whole path including the query string, so
*.mp3matches/music/a.mp3but not/music/a.mp3?x=1. - The path always starts with
/, so the router refuses a value such asmusic/*, which could never match. - HTTPS requests have no path, so a rule with
pathnever matches them.
<ArgTableRow arg="method" typ="super { !
, method: enum (GET | HEAD | POST | PUT | CONNECT | OPTIONS | DELETE | TRACE)
}">HTTP method of the request: GET, HEAD, POST, PUT, CONNECT, OPTIONS, DELETE or TRACE. Clients of the proxy request HTTPS pages with CONNECT. The methods are defined in RFC 9110.</ArgTableRow>
How the proxy sends a matching request.
allow(default) - Connect directly to the server.deny- Send the request through the parent proxy.
<ArgTableRow arg="hits" typ="num">Number of requests the rule matched. Reset it with reset-counters or reset-counters-all.</ArgTableRow>