Freedom251 › Reverse Proxy Software
SNI Proxy
What SNI Proxy is
SNI Proxy is a self-hosted proxy that routes incoming HTTP and TLS connections according to the hostname in the initial request of a TCP session. It can route HTTPS by hostname without decrypting traffic, so the proxy machine does not need keys or certificates. Routing tables can match exact hostnames or regular expressions, and a fallback server can handle requests whose initial request has no hostname.
A single instance can use multiple listening sockets. Listeners and backend servers can use IPv4, IPv6, or Unix domain sockets, and HAProxy proxy protocol support can pass the original source address to backend servers. The software supports TLS and HTTP, but not HTTP/2 hostname multiplexing or HTTP/3 over QUIC. Hostname and wildcard configuration entries need a build with UDNS. The maintainer recommends using UDNS with a local caching DNS resolver because queries from its single UDP socket can be relatively easy to spoof. The project is deprecated; the maintainer says issue and email responses should not be expected unless a problem is a significant security or reliability concern. SNI Proxy is free and licensed under BSD-2-Clause, with file-based configuration.
Who it suits
SNI Proxy may suit operators who need a self-hosted way to route HTTP or TLS connections by hostname and can work within its protocol limits. It is a poor fit where HTTP/2 hostname multiplexing, HTTP/3 over QUIC, or expected maintainer support is needed.
What it does well
- Routes HTTPS by hostname without decrypting traffic.
- Proxy machine requires no keys or certificates.
- Routing rules support exact names and regular expressions.
- Supports IPv4, IPv6, and Unix domain sockets.
- Free software under the BSD-2-Clause license.
What to know first
- Does not support HTTP/2 hostname multiplexing or HTTP/3 over QUIC.
- Hostname and wildcard entries require a UDNS build.
- The project is deprecated.
- Maintainer responses are not generally expected.
Limits
SNI Proxy does not support HTTP/2 hostname multiplexing or HTTP/3 over QUIC. Hostname and wildcard configuration entries are unavailable without a UDNS build.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| SNI Proxy | Open-source software · BSD-2-Clause license | Free |
As github.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Open the project repository at https://github.com/dlundquist/sniproxy.
- Use a Linux or macOS environment for a self-hosted deployment.
- Configure routing with the file-based configuration method.
- Use a build with UDNS if your configuration needs hostname or wildcard entries.
- Consider the maintainer's recommendation to use UDNS with a local caching DNS resolver.
Verdict
Consider SNI Proxy if you need a free, self-hosted HTTP and TLS hostname router and its limits fit your deployment. Look elsewhere if you require HTTP/2 hostname multiplexing, HTTP/3 over QUIC, or routine maintainer support.
Questions
Does SNI Proxy cost anything?
It is free, open-source software under the BSD-2-Clause license.
Where can I run it?
The listed platforms are Linux, macOS, and self-hosted deployment.
Does it decrypt HTTPS traffic?
No. It routes HTTPS by hostname without decrypting the traffic and requires no keys or certificates on the proxy machine.
Does it support HTTP/2 and HTTP/3?
It does not support HTTP/2 hostname multiplexing or HTTP/3 over QUIC.
Is the project maintained?
The maintainer marked it deprecated. They say users should not expect replies to issues or email requests unless the matter concerns significant security or reliability.
Facts from SNI Proxy's own pages
- Configuration
- Host routing tables can match exact hostnames or regular expressions, and can use a fallback server when the initial request has no hostname. · github.com, 9 Oct 2026
- DNS requirement
- Hostname and wildcard configuration entries require a build with UDNS; those features are unavailable without it. · github.com, 9 Oct 2026
- DNS security note
- The README recommends a local caching DNS resolver with UDNS because its single UDP socket makes queries relatively easy to spoof. · github.com, 9 Oct 2026
- HTTPS routing
- It supports name-based HTTPS proxying without decrypting traffic and requires no keys or certificates on the proxy machine. · github.com, 9 Oct 2026
- License
- The repository identifies its license as BSD-2-Clause. · github.com, 9 Oct 2026
- Listeners
- A single instance can use multiple listening sockets. · github.com, 9 Oct 2026
- Network support
- It supports IPv4, IPv6, and Unix domain sockets for backend servers and listeners. · github.com, 9 Oct 2026
- Platforms
- The README documents Debian or Ubuntu and Fedora or Red Hat packaging, plus best-effort macOS builds; macOS is not a primary target platform. · github.com, 9 Oct 2026
- Project status
- The maintainer marked the project deprecated on 2023-12-13, citing newer alternatives and limitations with HTTP/2 and HTTP/3. · github.com, 9 Oct 2026
- Protocols
- It supports TLS and HTTP, but the maintainer says it does not support HTTP/2 hostname multiplexing or HTTP/3 over QUIC. · github.com, 9 Oct 2026
- Proxy protocol
- It supports the HAProxy proxy protocol to pass the original source address to backend servers. · github.com, 9 Oct 2026
- Purpose
- SNI Proxy routes incoming HTTP and TLS connections using the hostname in the initial request of a TCP session. · github.com, 9 Oct 2026
- Support
- The maintainer says they will monitor issues and email requests, but users should not expect a response unless the issue is a significant security or reliability problem. · github.com, 9 Oct 2026
Where SNI Proxy stands on Freedom251
- Reverse Proxy Software#19 of 33