What Is a Transparent Proxy?

The term is used in two senses, and both are common:

The two usually go together: an intercepting proxy in a school or office is not there to hide anyone, so it forwards the client's address. RFC 3040 also notes an older, stricter meaning from the HTTP specification (its section 2.1), a proxy that does not modify requests or responses, and recommends the term "interception proxy" to avoid the confusion. This page uses "transparent proxy" in the everyday sense: intercepting, and not hiding your IP.

Three requests answer it. Put your proxy's host, port and login in place of the placeholders; for ProxyField, the host and port are gate.proxyfield.io:7000.

# 1. Your real public IP, with no proxy
curl -s https://api.ipify.org

# 2. The IP a website sees through the proxy
curl -s -x http://HOST:PORT -U "<login>:<password>" https://api.ipify.org

# 3. The headers a website receives through the proxy, over plain HTTP
curl -s -x http://HOST:PORT -U "<login>:<password>" "http://httpbin.org/headers?show_env=1"

Look for the IP from step 1 in the output of step 3. Through a transparent proxy, the answer looks like this (illustrative addresses: 203.0.113.25 is you, 198.51.100.7 the proxy):

{
  "headers": {
    "Host": "httpbin.org",
    "User-Agent": "curl/8.5.0",
    "Via": "1.1 proxy.example.net (squid)",
    "X-Forwarded-For": "203.0.113.25, 198.51.100.7",
    "X-Forwarded-Proto": "http"
  }
}

httpbin's own front end adds entries too, such as X-Forwarded-Proto and the connecting proxy's IP at the end of X-Forwarded-For; what matters is whether your step-1 IP appears anywhere.

Forwarded is the standard form of the same information (RFC 7239, 2014): a transparent proxy writes it as Forwarded: for=203.0.113.25;proto=http. MDN shows the de-facto form as X-Forwarded-For: <client>, <proxy1>, <proxy2>, the original client first (MDN: X-Forwarded-For).

Why ?show_env=1. httpbin's source code removes X-Forwarded-For, X-Real-Ip, Via and a few other headers from the /headers answer unless the URL carries show_env (httpbin helpers.py, ENV_HEADERS). Plain /headers therefore shows no forwarding header even through a transparent proxy.

1. The network redirects your traffic. A router, firewall or gateway sends outgoing web traffic, typically TCP port 80, to the proxy instead of the internet. Common methods are NAT redirection on the proxy machine, policy routing from a gateway, and Cisco's WCCP.
2. The proxy reads where you wanted to go. For plain HTTP, the Host header names the site; the proxy connects to it on your behalf.
3. It applies the network's rules: blocks a category, serves a cached copy, requires a login, or logs the visit.
4. It forwards the request, usually adding Via and X-Forwarded-For headers.
5. The answer comes back through the proxy to your device, which never knew a proxy was there.

A plain-HTTP request leaving a school's transparent proxy can look like this:

GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Via: 1.1 gateway.school.example (squid)
X-Forwarded-For: 10.20.30.40

The website connects with the proxy's public IP, and X-Forwarded-For adds the address of the client behind it, here a private address inside the school network. That is the open-source Squid proxy's default behavior: forwarded_for on appends the client's IP, and via on adds the Via header (Squid: forwarded_for; Squid: via). MDN notes that X-Forwarded-For "exposes privacy-sensitive information by design, such as the IP address of the client" (MDN: X-Forwarded-For).

• Content filtering in companies, schools and libraries: blocking site categories and known malware domains for every device on the network, including guests' devices nobody configured.
• Caching at internet providers and in large networks, to save upstream bandwidth on popular files.
• Captive portals: the hotel or airport Wi-Fi page that appears before you can browse is served by intercepting your first request.
• Monitoring and logging of web use under a company's policy.
• Parental controls on home routers and family DNS or filtering services.

What they have in common: the network owner wants every device covered without touching each one. Running one is a network administrator's job; for the other uses of proxies, see what proxies are used for.

Not the content, unless it decrypts it. An HTTPS connection is encrypted between your browser and the site, so an intercepting proxy sees only the destination's host name and port and the volume of data. It can block or allow by host name, but it can't read pages, add headers or cache them.

To read HTTPS, the proxy has to do TLS interception: it presents its own certificate for each site, which the devices accept only if the network's root certificate is installed on them, as on managed company laptops. Squid's documentation describes its ssl-bump mode as decrypting "HTTPS messages as they pass through Squid", "becoming the man-in-the-middle" (Squid: http_port). If you see an unfamiliar issuer on a site's certificate, such as your company's name instead of a public certificate authority, your HTTPS traffic is being inspected. More on this in what an SSL proxy is.

The check above tests a proxy you set yourself. To find one the network put in your path without telling you:

1. Compare HTTP and HTTPS. Most intercepting proxies handle only plain HTTP. Open the same IP-check service over both and compare. With httpbin, for example:

   ShellCopy Shell code

   curl -s http://httpbin.org/ip
   curl -s https://httpbin.org/ip

   httpbin's /ip answers with the X-Forwarded-For value when the request carries one, and with the connecting address otherwise (httpbin helpers.py). If the HTTP answer shows two addresses, or a different IP than the HTTPS answer, something on the path is proxying your HTTP traffic.

2. Look at the headers the site receives. Request a plain-HTTP page that echoes all headers, on a server you control (a short echo script is in the elite proxy guide). Via, X-Forwarded-For or Forwarded that your browser didn't send mean a proxy added them. Public echo services may hide them: httpbin's /headers shows them only with ?show_env=1.

3. Check certificate issuers on a few HTTPS sites in your browser. A network-issued certificate means TLS interception.

4. Watch for odd behavior: a block page with your network's logo, a login prompt from the network, or stale cached pages.

If your own settings show no proxy but these checks find one, it is transparent. To see what your device is set to, see how to find your proxy server.

A non-transparent proxy is simply the other column: one the client is configured to use. In the stricter RFC sense, it also means a proxy that changes requests or responses, for example by compressing images or removing headers.

• No help with HTTPS unless every device trusts the network's certificate, which in turn breaks apps that pin their certificates.
• Login problems. Because the browser thinks it talks to the site, proxy authentication doesn't work the usual way; connection-based schemes such as NTLM are known to fail behind interception (Wikipedia: Proxy server).
• Privacy. Users may not know their traffic is filtered and logged, and their IP is passed on to websites.
• A single point of failure for the whole network's web access.
• Security bugs of their own: in February 2009, the CERT Coordination Center warned that intercepting proxies which decide where to connect from HTTP header values "may be used by an attacker to relay connections" (CERT VU#435052).

On a Linux machine that runs Squid and receives the network's web traffic, interception takes one Squid line and a few firewall rules. Squid's wiki gives this example (Squid wiki: Linux traffic interception using REDIRECT):

# squid.conf: a normal port plus a port for intercepted traffic
http_port 3128
http_port 3129 intercept

# on the Squid machine (replace with its IP): don't loop Squid's own traffic,
# send other port-80 traffic to the intercept port, block direct access to it
SQUIDIP=192.168.0.2
SQUIDPORT=3129
iptables -t nat -A PREROUTING -s $SQUIDIP -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port $SQUIDPORT
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t mangle -A PREROUTING -p tcp --dport $SQUIDPORT -j DROP

Squid's http_port reference adds that the intercept mode disables authentication on that port. To intercept from a separate gateway, Squid's wiki recommends policy routing to the Squid box instead of NAT on the gateway. Run interception only on a network you manage, and tell its users that their traffic is filtered.

If what you need is the opposite, other IPs for your own apps, you don't need a transparent proxy: an explicit proxy service is set in the app. ProxyField's gateway is gate.proxyfield.io:7000, over HTTP, HTTPS or SOCKS5.

Need explicit proxies with IPs by country or city? ProxyField residential proxies: 412M+ IPs in 195+ countries, per-request rotation or sticky sessions up to 36 h. Start with the Easy Trial: 1 GB for $2.95, no subscription.