Bridge SOCKS Clients to an HTTP CONNECT Parent with 3proxy

The application requires SOCKS. Your approved upstream service accepts HTTP CONNECT. Putting the HTTP endpoint into the application's SOCKS field does not translate between the protocols.

A gateway can accept SOCKS from the application, read its requested destination, and ask the HTTP parent for a CONNECT tunnel to that destination. It then relays the application stream through the tunnel.

SOCKS application → SOCKS-facing gateway → HTTP CONNECT parent → destination

Make each interface explicit

For a gateway supporting this arrangement, its parent type matters. The 3proxy documentation distinguishes a connect parent from a parent used as an ordinary HTTP forwarding proxy.

With an existing 3proxy user and authentication setup, a local-only routing fragment can take this form:

auth strong
allow alex
parent 1000 connect parent.example.net 8080
socks -i127.0.0.1 -p1080

This fragment assumes the account is already defined. It does not add any credentials the HTTP parent itself requires, and it does not replace the existing access policy. For public destinations on a route permitting an unauthenticated public HTTP parent, the HTTP proxy list offers host and port candidates. Keep parent credentials absent for that branch and confirm permission for the actual target; the gateway's own account remains local. The parent rule is associated with the preceding allow rule under 3proxy's documented configuration model.

The application uses the local SOCKS endpoint. The gateway uses HTTP CONNECT toward the parent. The parent still decides whether the requested destination host and port are allowed.

Ordinary TCP stream tunneling is the useful scope here. A SOCKS5 UDP association does not become supported simply because the front listener accepts SOCKS5. An HTTP CONNECT parent does not automatically provide the required UDP relay.

HTTPS can remain end-to-end inside this path; translation between proxy interfaces does not require impersonating the destination website. Authentication to the gateway, authentication to the parent, and website authentication remain different credentials and exchanges.