Dynamic forward proxy

Attention

HTTP dynamic forward proxy support should be considered alpha and not production ready.

The following is a complete configuration that configures both the dynamic forward proxy HTTP filter as well as the dynamic forward proxy cluster. Both filter and cluster must be configured together and point to the same DNS cache parameters for Envoy to operate as an HTTP dynamic forward proxy.

This filter supports host rewrite via the virtual host’s per_filter_config or the route’s per_filter_config. This can be used to rewrite the host header with the provided value before DNS lookup, thus allowing to route traffic to the rewritten host when forwarding. See the example below within the configured routes.

Note

Configuring a tls_context on the cluster with trusted_ca certificates instructs Envoy to use TLS when connecting to upstream hosts and verify the certificate chain. Additionally, Envoy will automatically perform SAN verification for the resolved host name as well as specify the host name via SNI.

  1. admin:
  2. access_log_path: /tmp/admin_access.log
  3. address:
  4. socket_address:
  5. protocol: TCP
  6. address: 127.0.0.1
  7. port_value: 9901
  8. static_resources:
  9. listeners:
  10. - name: listener_0
  11. address:
  12. socket_address:
  13. protocol: TCP
  14. address: 0.0.0.0
  15. port_value: 10000
  16. filter_chains:
  17. - filters:
  18. - name: envoy.filters.network.http_connection_manager
  19. typed_config:
  20. "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
  21. stat_prefix: ingress_http
  22. route_config:
  23. name: local_route
  24. virtual_hosts:
  25. - name: local_service
  26. domains: ["*"]
  27. routes:
  28. - match:
  29. prefix: "/force-host-rewrite"
  30. route:
  31. cluster: dynamic_forward_proxy_cluster
  32. per_filter_config:
  33. envoy.filters.http.dynamic_forward_proxy:
  34. host_rewrite: www.example.org
  35. - match:
  36. prefix: "/"
  37. route:
  38. cluster: dynamic_forward_proxy_cluster
  39. http_filters:
  40. - name: envoy.filters.http.dynamic_forward_proxy
  41. typed_config:
  42. "@type": type.googleapis.com/envoy.config.filter.http.dynamic_forward_proxy.v2alpha.FilterConfig
  43. dns_cache_config:
  44. name: dynamic_forward_proxy_cache_config
  45. dns_lookup_family: V4_ONLY
  46. - name: envoy.filters.http.router
  47. clusters:
  48. - name: dynamic_forward_proxy_cluster
  49. connect_timeout: 1s
  50. lb_policy: CLUSTER_PROVIDED
  51. cluster_type:
  52. name: envoy.clusters.dynamic_forward_proxy
  53. typed_config:
  54. "@type": type.googleapis.com/envoy.config.cluster.dynamic_forward_proxy.v2alpha.ClusterConfig
  55. dns_cache_config:
  56. name: dynamic_forward_proxy_cache_config
  57. dns_lookup_family: V4_ONLY
  58. transport_socket:
  59. name: envoy.transport_sockets.tls
  60. typed_config:
  61. "@type": type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
  62. common_tls_context:
  63. validation_context:
  64. trusted_ca: {filename: /etc/ssl/certs/ca-certificates.crt}

Statistics

The dynamic forward proxy DNS cache outputs statistics in the dns_cache..* namespace.

Name

Type

Description

dns_query_attempt

Counter

Number of DNS query attempts.

dns_query_success

Counter

Number of DNS query successes.

dns_query_failure

Counter

Number of DNS query failures.

host_address_changed

Counter

Number of DNS queries that resulted in a host address change.

host_added

Counter

Number of hosts that have been added to the cache.

host_removed

Counter

Number of hosts that have been removed from the cache.

num_hosts

Gauge

Number of hosts that are currently in the cache.