Proxifier

Description

Most applications that connect to the internet do not have any proxy settings built into them. They connect directly which means that if you need to route an application’s traffic through a proxy server (to bypass geographic restrictions, to route through a corporate network, to anonymize the connection) you either need the application to support proxying natively or you have nothing. Proxifier solves this by intercepting any application’s network connections at the operating system level and redirecting them through a proxy server regardless of whether the application has any proxy awareness at all.

Initex Software created Proxifier and made it available for Windows in 2004, with support for MacOS added later. The software is aimed at users who require very fine-grained control over how particular applications connect — sending one program through a VPN-like proxy while allowing other programs to connect directly, or sending traffic through a SOCKS5 proxy that is required by a corporate firewall.

DEVELOPMENT

The problem Proxifier solves: The issue of proxying has been consistent since the early days of corporate networks: companies route internet-bound traffic through proxy servers for security (monitoring), content filtering and access control. Applications that don’t support proxy configuration — games, chat clients, custom internal tools, legacy software — can’t comply with that network policy automatically. IT administrators used Proxifier to bring non-compliant applications into compliance without having to make changes to the applications themselves.

The use case for consumers grew as VPNs and SOCKS5 proxy services became widely available. Users running Tor or SSH tunnels or commercial proxy services found Proxifier allowed them to have specific applications go through other services without affecting the rest of the system. A user could set up a browser through one proxy for privacy, while using a game client on the direct connection to prevent latency, with everything being controlled through Proxifier’s rule system.

Version 3 on Windows and on the current version for Mac improved the interface and introduced portable mode so that Proxifier could be used without installation by running it from a USB drive. Version 4 on Windows added support for the use of an HTTP proxy in addition to SOCKS4 and 5.

Application Level Proxy Rules

Proxifier’s rule system has a proxy behavior per application rule. Rules match by process name, target hostname or target IP address range. A rule could say like this: any connection coming from chrome.exe will go through proxy A. any connection coming from game.exe will connect directly. any connection to *.internal.company.com will use proxy B. rules stack with priority order. catch-all rule at the bottom of the stack handles anything that’s not matched by specific rules. This granularity allows one machine to send different applications through different proxies at the same time.

SOCKS4, SOCKS5 and HTTP Proxy Support

Proxifier connects to Socks4, socks5, and http proxy servers. SOCKS5 supports authentication, and it supports TCP and UDP traffic. SOCKS4 is an older protocol that is supported for compatibility with older proxy servers. HTTP CONNECT proxy support — available in Windows version 4 — covers the type of proxy used by most corporate firewalls and many commercial proxy services.

Proxy Chains

Multiple proxy servers are chained together, so that the traffic passes through them in sequence. A chain may send traffic through a local corporate proxy and after that through an external anonymizing proxy. Each hop in the chain encrypts the connection separately and the last proxy’s IP address is all that is visible to the final destination server. Chains combine proxy types — SOCKS5 into SOCKS5, or HTTP into SOCKS5 — as the connection architecture demands.

DNS Resolution

Proxifier extends the default DNS resolver of a system and handles DNS queries via the proxy server instead of via the system’s default DNS resolver. This avoids the problem of DNS leaks, where hostname lookups bypass the proxy and expose browsing destinations to the local network or ISP. Remote DNS resolution is configurable on a per rule set basis.

Connection Log

A real-time log displays all intercepted connections with application name, target hostname, proxy used, bytes sent/received and time taken by the connection. The log is useful in diagnosing connection failures, checking that rules are routing traffic as expected and monitoring which applications are making unexpected connections.

Portable Mode

Windows users can use Proxifier on a USB drive without installing it on the host system. Portable mode saves all settings in the application directory instead of the Windows registry so that no configuration data is left on the host machine when the drive is removed.