Tinyproxy ConnectPort: Destination Port vs Listener Port
Diagnose Tinyproxy CONNECT destination-port restrictions without confusing them with the listener port.
ConnectPort checks the destination requested inside CONNECT, not the listener accepting the client:
| Example number | Role |
|---|---|
| 8888 | Tinyproxy's incoming listener. |
| 443 | A common HTTPS destination port. |
| 80 in a rejected CONNECT | The destination the client actually asked to tunnel. |
An explicit allowance for the common HTTPS destination is:
ConnectPort 443Retain authentication and client restrictions. The Tinyproxy manual defines both an absent port list and the special CONNECT-disable setting. Removing a restrictive list can broaden access.
If the requested port surprises you, read the CONNECT authority and preceding sequence. Plain HTTP on port 80 does not require CONNECT merely because a proxy is involved. A client may intentionally tunnel another service or use an unintended mode; do not assume every CONNECT to port 80 came from a website redirect.
A legitimate extra HTTPS port needs its own narrow allowance. Opening every destination hides whether the client made the intended request. Keep the actual target separate from the proxy listener before changing policy.