@push.rocks/smartproxy 3.28.5 → 3.29.0

package/ts/classes.portproxy.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import { NetworkProxy } from './classes.networkproxy.js';
 
 /** Domain configuration with per-domain allowed port ranges */
 export interface IDomainConfig {
@@ -9,6 +10,10 @@ export interface IDomainConfig {
   portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
   // Allow domain-specific timeout override
   connectionTimeout?: number; // Connection timeout override (ms)
+  
+  // New properties for NetworkProxy integration
+  useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy
+  networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
 }
 
 /** Port proxy settings including global allowed port ranges */
@@ -26,8 +31,8 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   initialDataTimeout?: number; // Timeout for initial data/SNI (ms), default: 60000 (60s)
   socketTimeout?: number; // Socket inactivity timeout (ms), default: 3600000 (1h)
   inactivityCheckInterval?: number; // How often to check for inactive connections (ms), default: 60000 (60s)
-  maxConnectionLifetime?: number; // Default max connection lifetime (ms), default: 3600000 (1h)
-  inactivityTimeout?: number; // Inactivity timeout (ms), default: 3600000 (1h)
+  maxConnectionLifetime?: number; // Default max connection lifetime (ms), default: 86400000 (24h)
+  inactivityTimeout?: number; // Inactivity timeout (ms), default: 14400000 (4h)
 
   gracefulShutdownTimeout?: number; // (ms) maximum time to wait for connections to close during shutdown
   globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
@@ -49,6 +54,14 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   // Rate limiting and security
   maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
   connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
+  
+  // Enhanced keep-alive settings
+  keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
+  keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
+  extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
+  
+  // New property for NetworkProxy integration
+  networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
 }
 
 /**
@@ -77,6 +90,16 @@ interface IConnectionRecord {
   tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
   hasReceivedInitialData: boolean; // Whether initial data has been received
   domainConfig?: IDomainConfig; // Associated domain config for this connection
+  
+  // Keep-alive tracking
+  hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
+  inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
+  incomingTerminationReason?: string | null; // Reason for incoming termination
+  outgoingTerminationReason?: string | null; // Reason for outgoing termination
+  
+  // New field for NetworkProxy tracking
+  usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
+  networkProxyIndex?: number; // Which NetworkProxy instance is being used
 }
 
 /**
@@ -325,6 +348,9 @@ export class PortProxy {
   // Connection tracking by IP for rate limiting
   private connectionsByIP: Map<string, Set<string>> = new Map();
   private connectionRateByIP: Map<string, number[]> = new Map();
+  
+  // New property to store NetworkProxy instances
+  private networkProxies: NetworkProxy[] = [];
 
   constructor(settingsArg: IPortProxySettings) {
     // Set reasonable defaults for all settings
@@ -332,11 +358,11 @@ export class PortProxy {
       ...settingsArg,
       targetIP: settingsArg.targetIP || 'localhost',
 
-      // Timeout settings with safe maximum values
+      // Timeout settings with reasonable defaults
       initialDataTimeout: settingsArg.initialDataTimeout || 60000, // 60 seconds for initial handshake
-      socketTimeout: ensureSafeTimeout(settingsArg.socketTimeout || 2147483647), // Maximum safe value (~24.8 days)
+      socketTimeout: ensureSafeTimeout(settingsArg.socketTimeout || 3600000), // 1 hour socket timeout
       inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval
-      maxConnectionLifetime: ensureSafeTimeout(settingsArg.maxConnectionLifetime || 2147483647), // Maximum safe value (~24.8 days)
+      maxConnectionLifetime: ensureSafeTimeout(settingsArg.maxConnectionLifetime || 86400000), // 24 hours default
       inactivityTimeout: ensureSafeTimeout(settingsArg.inactivityTimeout || 14400000), // 4 hours inactivity timeout
 
       gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
@@ -344,20 +370,526 @@ export class PortProxy {
       // Socket optimization settings
       noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
       keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
-      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 30000, // 30 seconds
+      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds (reduced for responsiveness)
       maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB to handle large TLS handshakes
 
       // Feature flags
       disableInactivityCheck: settingsArg.disableInactivityCheck || false,
-      enableKeepAliveProbes: settingsArg.enableKeepAliveProbes || false,
+      enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined 
+        ? settingsArg.enableKeepAliveProbes : true, // Enable by default
       enableDetailedLogging: settingsArg.enableDetailedLogging || false,
       enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
-      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || true,
+      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default
 
       // Rate limiting defaults
       maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
       connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
+      
+      // Enhanced keep-alive settings
+      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default
+      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
+      extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
     };
+    
+    // Store NetworkProxy instances if provided
+    this.networkProxies = settingsArg.networkProxies || [];
+  }
+
+  /**
+   * Forwards a TLS connection to a NetworkProxy for handling
+   * @param connectionId - Unique connection identifier
+   * @param socket - The incoming client socket
+   * @param record - The connection record
+   * @param domainConfig - The domain configuration
+   * @param initialData - Initial data chunk (TLS ClientHello)
+   * @param serverName - SNI hostname (if available)
+   */
+  private forwardToNetworkProxy(
+    connectionId: string,
+    socket: plugins.net.Socket,
+    record: IConnectionRecord,
+    domainConfig: IDomainConfig,
+    initialData: Buffer,
+    serverName?: string
+  ): void {
+    // Determine which NetworkProxy to use
+    const proxyIndex = domainConfig.networkProxyIndex !== undefined 
+      ? domainConfig.networkProxyIndex
+      : 0;
+      
+    // Validate the NetworkProxy index
+    if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
+      console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`);
+      // Fall back to direct connection
+      return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData);
+    }
+    
+    const networkProxy = this.networkProxies[proxyIndex];
+    const proxyPort = networkProxy.getListeningPort();
+    const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
+    
+    if (this.settings.enableDetailedLogging) {
+      console.log(
+        `[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}`
+      );
+    }
+    
+    // Create a connection to the NetworkProxy
+    const proxySocket = plugins.net.connect({
+      host: proxyHost,
+      port: proxyPort
+    });
+    
+    // Store the outgoing socket in the record
+    record.outgoing = proxySocket;
+    record.outgoingStartTime = Date.now();
+    record.usingNetworkProxy = true;
+    record.networkProxyIndex = proxyIndex;
+    
+    // Set up error handlers
+    proxySocket.on('error', (err) => {
+      console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
+      this.cleanupConnection(record, 'network_proxy_connect_error');
+    });
+    
+    // Handle connection to NetworkProxy
+    proxySocket.on('connect', () => {
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
+      }
+      
+      // First send the initial data that contains the TLS ClientHello
+      proxySocket.write(initialData);
+      
+      // Now set up bidirectional piping between client and NetworkProxy
+      socket.pipe(proxySocket);
+      proxySocket.pipe(socket);
+      
+      // Setup cleanup handlers
+      proxySocket.on('close', () => {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] NetworkProxy connection closed`);
+        }
+        this.cleanupConnection(record, 'network_proxy_closed');
+      });
+      
+      socket.on('close', () => {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`);
+        }
+        this.cleanupConnection(record, 'client_closed');
+      });
+      
+      // Update activity on data transfer
+      socket.on('data', () => this.updateActivity(record));
+      proxySocket.on('data', () => this.updateActivity(record));
+      
+      if (this.settings.enableDetailedLogging) {
+        console.log(
+          `[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]`
+        );
+      }
+    });
+  }
+  
+  /**
+   * Sets up a direct connection to the target (original behavior)
+   * This is used when NetworkProxy isn't configured or as a fallback
+   */
+  private setupDirectConnection(
+    connectionId: string,
+    socket: plugins.net.Socket,
+    record: IConnectionRecord,
+    domainConfig: IDomainConfig | undefined,
+    serverName?: string,
+    initialChunk?: Buffer,
+    overridePort?: number
+  ): void {
+    // Existing connection setup logic
+    const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
+    const connectionOptions: plugins.net.NetConnectOpts = {
+      host: targetHost,
+      port: overridePort !== undefined ? overridePort : this.settings.toPort,
+    };
+    if (this.settings.preserveSourceIP) {
+      connectionOptions.localAddress = record.remoteIP.replace('::ffff:', '');
+    }
+
+    // Pause the incoming socket to prevent buffer overflows
+    socket.pause();
+
+    // Temporary handler to collect data during connection setup
+    const tempDataHandler = (chunk: Buffer) => {
+      // Track bytes received
+      record.bytesReceived += chunk.length;
+
+      // Check for TLS handshake
+      if (!record.isTLS && isTlsHandshake(chunk)) {
+        record.isTLS = true;
+
+        if (this.settings.enableTlsDebugLogging) {
+          console.log(
+            `[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
+          );
+        }
+      }
+
+      // Check if adding this chunk would exceed the buffer limit
+      const newSize = record.pendingDataSize + chunk.length;
+
+      if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
+        console.log(
+          `[${connectionId}] Buffer limit exceeded for connection from ${record.remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
+        );
+        socket.end(); // Gracefully close the socket
+        return this.initiateCleanupOnce(record, 'buffer_limit_exceeded');
+      }
+
+      // Buffer the chunk and update the size counter
+      record.pendingData.push(Buffer.from(chunk));
+      record.pendingDataSize = newSize;
+      this.updateActivity(record);
+    };
+
+    // Add the temp handler to capture all incoming data during connection setup
+    socket.on('data', tempDataHandler);
+
+    // Add initial chunk to pending data if present
+    if (initialChunk) {
+      record.bytesReceived += initialChunk.length;
+      record.pendingData.push(Buffer.from(initialChunk));
+      record.pendingDataSize = initialChunk.length;
+    }
+
+    // Create the target socket but don't set up piping immediately
+    const targetSocket = plugins.net.connect(connectionOptions);
+    record.outgoing = targetSocket;
+    record.outgoingStartTime = Date.now();
+
+    // Apply socket optimizations
+    targetSocket.setNoDelay(this.settings.noDelay);
+    
+    // Apply keep-alive settings to the outgoing connection as well
+    if (this.settings.keepAlive) {
+      targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
+      
+      // Apply enhanced TCP keep-alive options if enabled
+      if (this.settings.enableKeepAliveProbes) {
+        try {
+          if ('setKeepAliveProbes' in targetSocket) {
+            (targetSocket as any).setKeepAliveProbes(10);
+          }
+          if ('setKeepAliveInterval' in targetSocket) {
+            (targetSocket as any).setKeepAliveInterval(1000);
+          }
+        } catch (err) {
+          // Ignore errors - these are optional enhancements
+          if (this.settings.enableDetailedLogging) {
+            console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
+          }
+        }
+      }
+    }
+
+    // Setup specific error handler for connection phase
+    targetSocket.once('error', (err) => {
+      // This handler runs only once during the initial connection phase
+      const code = (err as any).code;
+      console.log(
+        `[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
+      );
+
+      // Resume the incoming socket to prevent it from hanging
+      socket.resume();
+
+      if (code === 'ECONNREFUSED') {
+        console.log(
+          `[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
+        );
+      } else if (code === 'ETIMEDOUT') {
+        console.log(
+          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
+        );
+      } else if (code === 'ECONNRESET') {
+        console.log(
+          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
+        );
+      } else if (code === 'EHOSTUNREACH') {
+        console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
+      }
+
+      // Clear any existing error handler after connection phase
+      targetSocket.removeAllListeners('error');
+
+      // Re-add the normal error handler for established connections
+      targetSocket.on('error', this.handleError('outgoing', record));
+
+      if (record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'connection_failed';
+        this.incrementTerminationStat('outgoing', 'connection_failed');
+      }
+
+      // Clean up the connection
+      this.initiateCleanupOnce(record, `connection_failed_${code}`);
+    });
+
+    // Setup close handler
+    targetSocket.on('close', this.handleClose('outgoing', record));
+    socket.on('close', this.handleClose('incoming', record));
+
+    // Handle timeouts with keep-alive awareness
+    socket.on('timeout', () => {
+      // For keep-alive connections, just log a warning instead of closing
+      if (record.hasKeepAlive) {
+        console.log(
+          `[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+            this.settings.socketTimeout || 3600000
+          )}. Connection preserved.`
+        );
+        // Don't close the connection - just log
+        return;
+      }
+      
+      // For non-keep-alive connections, proceed with normal cleanup
+      console.log(
+        `[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs(
+          this.settings.socketTimeout || 3600000
+        )}`
+      );
+      if (record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = 'timeout';
+        this.incrementTerminationStat('incoming', 'timeout');
+      }
+      this.initiateCleanupOnce(record, 'timeout_incoming');
+    });
+
+    targetSocket.on('timeout', () => {
+      // For keep-alive connections, just log a warning instead of closing
+      if (record.hasKeepAlive) {
+        console.log(
+          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+            this.settings.socketTimeout || 3600000
+          )}. Connection preserved.`
+        );
+        // Don't close the connection - just log
+        return;
+      }
+      
+      // For non-keep-alive connections, proceed with normal cleanup
+      console.log(
+        `[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs(
+          this.settings.socketTimeout || 3600000
+        )}`
+      );
+      if (record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'timeout';
+        this.incrementTerminationStat('outgoing', 'timeout');
+      }
+      this.initiateCleanupOnce(record, 'timeout_outgoing');
+    });
+
+    // Set appropriate timeouts, or disable for immortal keep-alive connections
+    if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
+      // Disable timeouts completely for immortal connections
+      socket.setTimeout(0);
+      targetSocket.setTimeout(0);
+      
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
+      }
+    } else {
+      // Set normal timeouts for other connections
+      socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
+      targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
+    }
+
+    // Track outgoing data for bytes counting
+    targetSocket.on('data', (chunk: Buffer) => {
+      record.bytesSent += chunk.length;
+      this.updateActivity(record);
+    });
+
+    // Wait for the outgoing connection to be ready before setting up piping
+    targetSocket.once('connect', () => {
+      // Clear the initial connection error handler
+      targetSocket.removeAllListeners('error');
+
+      // Add the normal error handler for established connections
+      targetSocket.on('error', this.handleError('outgoing', record));
+
+      // Remove temporary data handler
+      socket.removeListener('data', tempDataHandler);
+
+      // Flush all pending data to target
+      if (record.pendingData.length > 0) {
+        const combinedData = Buffer.concat(record.pendingData);
+        targetSocket.write(combinedData, (err) => {
+          if (err) {
+            console.log(
+              `[${connectionId}] Error writing pending data to target: ${err.message}`
+            );
+            return this.initiateCleanupOnce(record, 'write_error');
+          }
+
+          // Now set up piping for future data and resume the socket
+          socket.pipe(targetSocket);
+          targetSocket.pipe(socket);
+          socket.resume(); // Resume the socket after piping is established
+
+          if (this.settings.enableDetailedLogging) {
+            console.log(
+              `[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+                `${
+                  serverName
+                    ? ` (SNI: ${serverName})`
+                    : domainConfig
+                    ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                    : ''
+                }` +
+                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+            );
+          } else {
+            console.log(
+              `Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+                `${
+                  serverName
+                    ? ` (SNI: ${serverName})`
+                    : domainConfig
+                    ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                    : ''
+                }`
+            );
+          }
+        });
+      } else {
+        // No pending data, so just set up piping
+        socket.pipe(targetSocket);
+        targetSocket.pipe(socket);
+        socket.resume(); // Resume the socket after piping is established
+
+        if (this.settings.enableDetailedLogging) {
+          console.log(
+            `[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+              `${
+                serverName
+                  ? ` (SNI: ${serverName})`
+                  : domainConfig
+                  ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                  : ''
+              }` +
+              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+          );
+        } else {
+          console.log(
+            `Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+              `${
+                serverName
+                  ? ` (SNI: ${serverName})`
+                  : domainConfig
+                  ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                  : ''
+              }`
+          );
+        }
+      }
+
+      // Clear the buffer now that we've processed it
+      record.pendingData = [];
+      record.pendingDataSize = 0;
+
+      // Add the renegotiation listener for SNI validation
+      if (serverName) {
+        socket.on('data', (renegChunk: Buffer) => {
+          if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+            try {
+              // Try to extract SNI from potential renegotiation
+              const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+              if (newSNI && newSNI !== record.lockedDomain) {
+                console.log(
+                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. Terminating connection.`
+                );
+                this.initiateCleanupOnce(record, 'sni_mismatch');
+              } else if (newSNI && this.settings.enableDetailedLogging) {
+                console.log(
+                  `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
+                );
+              }
+            } catch (err) {
+              console.log(
+                `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
+              );
+            }
+          }
+        });
+      }
+
+      // Set connection timeout with simpler logic
+      if (record.cleanupTimer) {
+        clearTimeout(record.cleanupTimer);
+      }
+      
+      // For immortal keep-alive connections, skip setting a timeout completely
+      if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
+        }
+        // No cleanup timer for immortal connections
+      } 
+      // For extended keep-alive connections, use extended timeout
+      else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
+        const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
+        const safeTimeout = ensureSafeTimeout(extendedTimeout);
+        
+        record.cleanupTimer = setTimeout(() => {
+          console.log(
+            `[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
+              extendedTimeout
+            )}), forcing cleanup.`
+          );
+          this.initiateCleanupOnce(record, 'extended_lifetime');
+        }, safeTimeout);
+        
+        // Make sure timeout doesn't keep the process alive
+        if (record.cleanupTimer.unref) {
+          record.cleanupTimer.unref();
+        }
+        
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
+        }
+      }
+      // For standard connections, use normal timeout
+      else {
+        // Use domain-specific timeout if available, otherwise use default
+        const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
+        const safeTimeout = ensureSafeTimeout(connectionTimeout);
+        
+        record.cleanupTimer = setTimeout(() => {
+          console.log(
+            `[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs(
+              connectionTimeout
+            )}), forcing cleanup.`
+          );
+          this.initiateCleanupOnce(record, 'connection_timeout');
+        }, safeTimeout);
+        
+        // Make sure timeout doesn't keep the process alive
+        if (record.cleanupTimer.unref) {
+          record.cleanupTimer.unref();
+        }
+      }
+
+      // Mark TLS handshake as complete for TLS connections
+      if (record.isTLS) {
+        record.tlsHandshakeComplete = true;
+
+        if (this.settings.enableTlsDebugLogging) {
+          console.log(
+            `[${connectionId}] TLS handshake complete for connection from ${record.remoteIP}`
+          );
+        }
+      }
+    });
   }
 
   /**
@@ -418,25 +950,6 @@ export class PortProxy {
     this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
   }
 
-  /**
-   * Get connection timeout based on domain config or default settings
-   */
-  private getConnectionTimeout(record: IConnectionRecord): number {
-    // If the connection has a domain-specific timeout, use that with safety check
-    if (record.domainConfig?.connectionTimeout) {
-      return ensureSafeTimeout(record.domainConfig.connectionTimeout);
-    }
-
-    // Use default timeout, potentially randomized with safety check
-    const baseTimeout = this.settings.maxConnectionLifetime!;
-
-    if (this.settings.enableRandomizedTimeouts) {
-      return randomizeTimeout(baseTimeout);
-    }
-
-    return ensureSafeTimeout(baseTimeout);
-  }
-
   /**
    * Cleans up a connection record.
    * Destroys both incoming and outgoing sockets, clears timers, and removes the record.
@@ -534,7 +1047,8 @@ export class PortProxy {
             ` Duration: ${plugins.prettyMs(
               duration
             )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}`
+            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
+            `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
         );
       } else {
         console.log(
@@ -549,6 +1063,11 @@ export class PortProxy {
    */
   private updateActivity(record: IConnectionRecord): void {
     record.lastActivity = Date.now();
+    
+    // Clear any inactivity warning
+    if (record.inactivityWarningIssued) {
+      record.inactivityWarningIssued = false;
+    }
   }
 
   /**
@@ -563,6 +1082,97 @@ export class PortProxy {
     }
     return this.settings.targetIP!;
   }
+  
+  /**
+   * Initiates cleanup once for a connection
+   */
+  private initiateCleanupOnce(record: IConnectionRecord, reason: string = 'normal'): void {
+    if (this.settings.enableDetailedLogging) {
+      console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
+    }
+    
+    if (record.incomingTerminationReason === null || record.incomingTerminationReason === undefined) {
+      record.incomingTerminationReason = reason;
+      this.incrementTerminationStat('incoming', reason);
+    }
+    
+    this.cleanupConnection(record, reason);
+  }
+
+  /**
+   * Creates a generic error handler for incoming or outgoing sockets
+   */
+  private handleError(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
+    return (err: Error) => {
+      const code = (err as any).code;
+      let reason = 'error';
+
+      const now = Date.now();
+      const connectionDuration = now - record.incomingStartTime;
+      const lastActivityAge = now - record.lastActivity;
+
+      if (code === 'ECONNRESET') {
+        reason = 'econnreset';
+        console.log(
+          `[${record.id}] ECONNRESET on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      } else if (code === 'ETIMEDOUT') {
+        reason = 'etimedout';
+        console.log(
+          `[${record.id}] ETIMEDOUT on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      } else {
+        console.log(
+          `[${record.id}] Error on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      }
+
+      if (side === 'incoming' && record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = reason;
+        this.incrementTerminationStat('incoming', reason);
+      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = reason;
+        this.incrementTerminationStat('outgoing', reason);
+      }
+
+      this.initiateCleanupOnce(record, reason);
+    };
+  }
+
+  /**
+   * Creates a generic close handler for incoming or outgoing sockets
+   */
+  private handleClose(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
+    return () => {
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${record.id}] Connection closed on ${side} side from ${record.remoteIP}`);
+      }
+
+      if (side === 'incoming' && record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = 'normal';
+        this.incrementTerminationStat('incoming', 'normal');
+      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'normal';
+        this.incrementTerminationStat('outgoing', 'normal');
+        // Record the time when outgoing socket closed.
+        record.outgoingClosedTime = Date.now();
+      }
+
+      this.initiateCleanupOnce(record, 'closed_' + side);
+    };
+  }
 
   /**
    * Main method to start the proxy
@@ -609,25 +1219,7 @@ export class PortProxy {
 
       // Apply socket optimizations
       socket.setNoDelay(this.settings.noDelay);
-      if (this.settings.keepAlive) {
-        socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-      }
-
-      // Apply enhanced TCP options if available
-      if (this.settings.enableKeepAliveProbes) {
-        try {
-          // These are platform-specific and may not be available
-          if ('setKeepAliveProbes' in socket) {
-            (socket as any).setKeepAliveProbes(10);
-          }
-          if ('setKeepAliveInterval' in socket) {
-            (socket as any).setKeepAliveInterval(1000);
-          }
-        } catch (err) {
-          // Ignore errors - these are optional enhancements
-        }
-      }
-
+      
       // Create a unique connection ID and record
       const connectionId = generateConnectionId();
       const connectionRecord: IConnectionRecord = {
@@ -648,7 +1240,37 @@ export class PortProxy {
         isTLS: false,
         tlsHandshakeComplete: false,
         hasReceivedInitialData: false,
+        hasKeepAlive: false, // Will set to true if keep-alive is applied
+        incomingTerminationReason: null,
+        outgoingTerminationReason: null,
+        
+        // Initialize NetworkProxy tracking fields
+        usingNetworkProxy: false
       };
+      
+      // Apply keep-alive settings if enabled
+      if (this.settings.keepAlive) {
+        socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
+        connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
+        
+        // Apply enhanced TCP keep-alive options if enabled
+        if (this.settings.enableKeepAliveProbes) {
+          try {
+            // These are platform-specific and may not be available
+            if ('setKeepAliveProbes' in socket) {
+              (socket as any).setKeepAliveProbes(10); // More aggressive probing
+            }
+            if ('setKeepAliveInterval' in socket) {
+              (socket as any).setKeepAliveInterval(1000); // 1 second interval between probes
+            }
+          } catch (err) {
+            // Ignore errors - these are optional enhancements
+            if (this.settings.enableDetailedLogging) {
+              console.log(`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`);
+            }
+          }
+        }
+      }
 
       // Track connection by IP
       this.trackConnectionByIP(remoteIP, connectionId);
@@ -656,7 +1278,9 @@ export class PortProxy {
 
       if (this.settings.enableDetailedLogging) {
         console.log(
-          `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`
+          `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
+          `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
+          `Active connections: ${this.connectionRecords.size}`
         );
       } else {
         console.log(
@@ -665,35 +1289,16 @@ export class PortProxy {
       }
 
       let initialDataReceived = false;
-      let incomingTerminationReason: string | null = null;
-      let outgoingTerminationReason: string | null = null;
-
-      // Local function for cleanupOnce
-      const cleanupOnce = () => {
-        this.cleanupConnection(connectionRecord);
-      };
-
-      // Define initiateCleanupOnce for compatibility
-      const initiateCleanupOnce = (reason: string = 'normal') => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Connection cleanup initiated for ${remoteIP} (${reason})`);
-        }
-        if (incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
-          this.incrementTerminationStat('incoming', reason);
-        }
-        cleanupOnce();
-      };
 
-      // Helper to reject an incoming connection
+      // Define helpers for rejecting connections
       const rejectIncomingConnection = (reason: string, logMessage: string) => {
         console.log(`[${connectionId}] ${logMessage}`);
         socket.end();
-        if (incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
+        if (connectionRecord.incomingTerminationReason === null) {
+          connectionRecord.incomingTerminationReason = reason;
           this.incrementTerminationStat('incoming', reason);
         }
-        cleanupOnce();
+        this.cleanupConnection(connectionRecord, reason);
       };
 
       // Set an initial timeout for SNI data if needed
@@ -704,12 +1309,12 @@ export class PortProxy {
             console.log(
               `[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
             );
-            if (incomingTerminationReason === null) {
-              incomingTerminationReason = 'initial_timeout';
+            if (connectionRecord.incomingTerminationReason === null) {
+              connectionRecord.incomingTerminationReason = 'initial_timeout';
               this.incrementTerminationStat('incoming', 'initial_timeout');
             }
             socket.end();
-            cleanupOnce();
+            this.cleanupConnection(connectionRecord, 'initial_timeout');
           }
         }, this.settings.initialDataTimeout!);
 
@@ -722,9 +1327,7 @@ export class PortProxy {
         connectionRecord.hasReceivedInitialData = true;
       }
 
-      socket.on('error', (err: Error) => {
-        console.log(`[${connectionId}] Incoming socket error from ${remoteIP}: ${err.message}`);
-      });
+      socket.on('error', this.handleError('incoming', connectionRecord));
 
       // Track data for bytes counting
       socket.on('data', (chunk: Buffer) => {
@@ -745,73 +1348,8 @@ export class PortProxy {
         }
       });
 
-      const handleError = (side: 'incoming' | 'outgoing') => (err: Error) => {
-        const code = (err as any).code;
-        let reason = 'error';
-
-        const now = Date.now();
-        const connectionDuration = now - connectionRecord.incomingStartTime;
-        const lastActivityAge = now - connectionRecord.lastActivity;
-
-        if (code === 'ECONNRESET') {
-          reason = 'econnreset';
-          console.log(
-            `[${connectionId}] ECONNRESET on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        } else if (code === 'ETIMEDOUT') {
-          reason = 'etimedout';
-          console.log(
-            `[${connectionId}] ETIMEDOUT on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        } else {
-          console.log(
-            `[${connectionId}] Error on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        }
-
-        if (side === 'incoming' && incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
-          this.incrementTerminationStat('incoming', reason);
-        } else if (side === 'outgoing' && outgoingTerminationReason === null) {
-          outgoingTerminationReason = reason;
-          this.incrementTerminationStat('outgoing', reason);
-        }
-
-        initiateCleanupOnce(reason);
-      };
-
-      const handleClose = (side: 'incoming' | 'outgoing') => () => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Connection closed on ${side} side from ${remoteIP}`);
-        }
-
-        if (side === 'incoming' && incomingTerminationReason === null) {
-          incomingTerminationReason = 'normal';
-          this.incrementTerminationStat('incoming', 'normal');
-        } else if (side === 'outgoing' && outgoingTerminationReason === null) {
-          outgoingTerminationReason = 'normal';
-          this.incrementTerminationStat('outgoing', 'normal');
-          // Record the time when outgoing socket closed.
-          connectionRecord.outgoingClosedTime = Date.now();
-        }
-
-        initiateCleanupOnce('closed_' + side);
-      };
-
       /**
-       * Sets up the connection to the target host.
+       * Sets up the connection to the target host or NetworkProxy.
        * @param serverName - The SNI hostname (unused when forcedDomain is provided).
        * @param initialChunk - Optional initial data chunk.
        * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
@@ -834,7 +1372,8 @@ export class PortProxy {
         connectionRecord.hasReceivedInitialData = true;
 
         // Check if this looks like a TLS handshake
-        if (initialChunk && isTlsHandshake(initialChunk)) {
+        const isTlsHandshakeDetected = initialChunk && isTlsHandshake(initialChunk);
+        if (isTlsHandshakeDetected) {
           connectionRecord.isTLS = true;
 
           if (this.settings.enableTlsDebugLogging) {
@@ -879,6 +1418,23 @@ export class PortProxy {
               )}`
             );
           }
+          
+          // Check if we should forward this to a NetworkProxy
+          if (
+            isTlsHandshakeDetected && 
+            domainConfig.useNetworkProxy === true && 
+            initialChunk && 
+            this.networkProxies.length > 0
+          ) {
+            return this.forwardToNetworkProxy(
+              connectionId,
+              socket,
+              connectionRecord,
+              domainConfig,
+              initialChunk,
+              serverName
+            );
+          }
         } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
           if (
             !isGlobIPAllowed(
@@ -894,317 +1450,16 @@ export class PortProxy {
           }
         }
 
-        const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
-        const connectionOptions: plugins.net.NetConnectOpts = {
-          host: targetHost,
-          port: overridePort !== undefined ? overridePort : this.settings.toPort,
-        };
-        if (this.settings.preserveSourceIP) {
-          connectionOptions.localAddress = remoteIP.replace('::ffff:', '');
-        }
-
-        // Pause the incoming socket to prevent buffer overflows
-        socket.pause();
-
-        // Temporary handler to collect data during connection setup
-        const tempDataHandler = (chunk: Buffer) => {
-          // Track bytes received
-          connectionRecord.bytesReceived += chunk.length;
-
-          // Check for TLS handshake
-          if (!connectionRecord.isTLS && isTlsHandshake(chunk)) {
-            connectionRecord.isTLS = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
-              );
-            }
-          }
-
-          // Check if adding this chunk would exceed the buffer limit
-          const newSize = connectionRecord.pendingDataSize + chunk.length;
-
-          if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
-            console.log(
-              `[${connectionId}] Buffer limit exceeded for connection from ${remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
-            );
-            socket.end(); // Gracefully close the socket
-            return initiateCleanupOnce('buffer_limit_exceeded');
-          }
-
-          // Buffer the chunk and update the size counter
-          connectionRecord.pendingData.push(Buffer.from(chunk));
-          connectionRecord.pendingDataSize = newSize;
-          this.updateActivity(connectionRecord);
-        };
-
-        // Add the temp handler to capture all incoming data during connection setup
-        socket.on('data', tempDataHandler);
-
-        // Add initial chunk to pending data if present
-        if (initialChunk) {
-          connectionRecord.bytesReceived += initialChunk.length;
-          connectionRecord.pendingData.push(Buffer.from(initialChunk));
-          connectionRecord.pendingDataSize = initialChunk.length;
-        }
-
-        // Create the target socket but don't set up piping immediately
-        const targetSocket = plugins.net.connect(connectionOptions);
-        connectionRecord.outgoing = targetSocket;
-        connectionRecord.outgoingStartTime = Date.now();
-
-        // Apply socket optimizations
-        targetSocket.setNoDelay(this.settings.noDelay);
-        if (this.settings.keepAlive) {
-          targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-        }
-
-        // Apply enhanced TCP options if available
-        if (this.settings.enableKeepAliveProbes) {
-          try {
-            if ('setKeepAliveProbes' in targetSocket) {
-              (targetSocket as any).setKeepAliveProbes(10);
-            }
-            if ('setKeepAliveInterval' in targetSocket) {
-              (targetSocket as any).setKeepAliveInterval(1000);
-            }
-          } catch (err) {
-            // Ignore errors - these are optional enhancements
-          }
-        }
-
-        // Setup specific error handler for connection phase
-        targetSocket.once('error', (err) => {
-          // This handler runs only once during the initial connection phase
-          const code = (err as any).code;
-          console.log(
-            `[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
-          );
-
-          // Resume the incoming socket to prevent it from hanging
-          socket.resume();
-
-          if (code === 'ECONNREFUSED') {
-            console.log(
-              `[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
-            );
-          } else if (code === 'ETIMEDOUT') {
-            console.log(
-              `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
-            );
-          } else if (code === 'ECONNRESET') {
-            console.log(
-              `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
-            );
-          } else if (code === 'EHOSTUNREACH') {
-            console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
-          }
-
-          // Clear any existing error handler after connection phase
-          targetSocket.removeAllListeners('error');
-
-          // Re-add the normal error handler for established connections
-          targetSocket.on('error', handleError('outgoing'));
-
-          if (outgoingTerminationReason === null) {
-            outgoingTerminationReason = 'connection_failed';
-            this.incrementTerminationStat('outgoing', 'connection_failed');
-          }
-
-          // Clean up the connection
-          initiateCleanupOnce(`connection_failed_${code}`);
-        });
-
-        // Setup close handler
-        targetSocket.on('close', handleClose('outgoing'));
-        socket.on('close', handleClose('incoming'));
-
-        // Handle timeouts
-        socket.on('timeout', () => {
-          console.log(
-            `[${connectionId}] Timeout on incoming side from ${remoteIP} after ${plugins.prettyMs(
-              this.settings.socketTimeout || 3600000
-            )}`
-          );
-          if (incomingTerminationReason === null) {
-            incomingTerminationReason = 'timeout';
-            this.incrementTerminationStat('incoming', 'timeout');
-          }
-          initiateCleanupOnce('timeout_incoming');
-        });
-
-        targetSocket.on('timeout', () => {
-          console.log(
-            `[${connectionId}] Timeout on outgoing side from ${remoteIP} after ${plugins.prettyMs(
-              this.settings.socketTimeout || 3600000
-            )}`
-          );
-          if (outgoingTerminationReason === null) {
-            outgoingTerminationReason = 'timeout';
-            this.incrementTerminationStat('outgoing', 'timeout');
-          }
-          initiateCleanupOnce('timeout_outgoing');
-        });
-
-        // Set appropriate timeouts using the configured value with safety
-        socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-        targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-
-        // Track outgoing data for bytes counting
-        targetSocket.on('data', (chunk: Buffer) => {
-          connectionRecord.bytesSent += chunk.length;
-          this.updateActivity(connectionRecord);
-        });
-
-        // Wait for the outgoing connection to be ready before setting up piping
-        targetSocket.once('connect', () => {
-          // Clear the initial connection error handler
-          targetSocket.removeAllListeners('error');
-
-          // Add the normal error handler for established connections
-          targetSocket.on('error', handleError('outgoing'));
-
-          // Remove temporary data handler
-          socket.removeListener('data', tempDataHandler);
-
-          // Flush all pending data to target
-          if (connectionRecord.pendingData.length > 0) {
-            const combinedData = Buffer.concat(connectionRecord.pendingData);
-            targetSocket.write(combinedData, (err) => {
-              if (err) {
-                console.log(
-                  `[${connectionId}] Error writing pending data to target: ${err.message}`
-                );
-                return initiateCleanupOnce('write_error');
-              }
-
-              // Now set up piping for future data and resume the socket
-              socket.pipe(targetSocket);
-              targetSocket.pipe(socket);
-              socket.resume(); // Resume the socket after piping is established
-
-              if (this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                    `${
-                      serverName
-                        ? ` (SNI: ${serverName})`
-                        : forcedDomain
-                        ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                        : ''
-                    }` +
-                    ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}`
-                );
-              } else {
-                console.log(
-                  `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                    `${
-                      serverName
-                        ? ` (SNI: ${serverName})`
-                        : forcedDomain
-                        ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                        : ''
-                    }`
-                );
-              }
-            });
-          } else {
-            // No pending data, so just set up piping
-            socket.pipe(targetSocket);
-            targetSocket.pipe(socket);
-            socket.resume(); // Resume the socket after piping is established
-
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                  `${
-                    serverName
-                      ? ` (SNI: ${serverName})`
-                      : forcedDomain
-                      ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                      : ''
-                  }` +
-                  ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}`
-              );
-            } else {
-              console.log(
-                `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                  `${
-                    serverName
-                      ? ` (SNI: ${serverName})`
-                      : forcedDomain
-                      ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                      : ''
-                  }`
-              );
-            }
-          }
-
-          // Clear the buffer now that we've processed it
-          connectionRecord.pendingData = [];
-          connectionRecord.pendingDataSize = 0;
-
-          // Add the renegotiation listener for SNI validation
-          if (serverName) {
-            socket.on('data', (renegChunk: Buffer) => {
-              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
-                try {
-                  // Try to extract SNI from potential renegotiation
-                  const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
-                  if (newSNI && newSNI !== connectionRecord.lockedDomain) {
-                    console.log(
-                      `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${connectionRecord.lockedDomain}. Terminating connection.`
-                    );
-                    initiateCleanupOnce('sni_mismatch');
-                  } else if (newSNI && this.settings.enableDetailedLogging) {
-                    console.log(
-                      `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
-                    );
-                  }
-                } catch (err) {
-                  console.log(
-                    `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
-                  );
-                }
-              }
-            });
-          }
-
-          // Set connection timeout
-          if (connectionRecord.cleanupTimer) {
-            clearTimeout(connectionRecord.cleanupTimer);
-          }
-
-          // Set timeout based on domain config or default with safety check
-          const connectionTimeout = this.getConnectionTimeout(connectionRecord);
-          const safeTimeout = ensureSafeTimeout(connectionTimeout); // Ensure timeout is safe
-          
-          connectionRecord.cleanupTimer = setTimeout(() => {
-            console.log(
-              `[${connectionId}] Connection from ${remoteIP} exceeded max lifetime (${plugins.prettyMs(
-                connectionTimeout
-              )}), forcing cleanup.`
-            );
-            initiateCleanupOnce('connection_timeout');
-          }, safeTimeout);
-
-          // Make sure timeout doesn't keep the process alive
-          if (connectionRecord.cleanupTimer.unref) {
-            connectionRecord.cleanupTimer.unref();
-          }
-
-          // Mark TLS handshake as complete for TLS connections
-          if (connectionRecord.isTLS) {
-            connectionRecord.tlsHandshakeComplete = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake complete for connection from ${remoteIP}`
-              );
-            }
-          }
-        });
+        // If we didn't forward to NetworkProxy, proceed with direct connection
+        return this.setupDirectConnection(
+          connectionId,
+          socket,
+          connectionRecord,
+          domainConfig,
+          serverName,
+          initialChunk,
+          overridePort
+        );
       };
 
       // --- PORT RANGE-BASED HANDLING ---
@@ -1367,7 +1622,7 @@ export class PortProxy {
         console.log(
           `PortProxy -> OK: Now listening on port ${port}${
             this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''
-          }`
+          }${this.networkProxies.length > 0 ? ' (NetworkProxy integration enabled)' : ''}`
         );
       });
       this.netServers.push(server);
@@ -1385,6 +1640,8 @@ export class PortProxy {
       let nonTlsConnections = 0;
       let completedTlsHandshakes = 0;
       let pendingTlsHandshakes = 0;
+      let keepAliveConnections = 0;
+      let networkProxyConnections = 0;
 
       // Create a copy of the keys to avoid modification during iteration
       const connectionIds = [...this.connectionRecords.keys()];
@@ -1404,6 +1661,14 @@ export class PortProxy {
         } else {
           nonTlsConnections++;
         }
+        
+        if (record.hasKeepAlive) {
+          keepAliveConnections++;
+        }
+        
+        if (record.usingNetworkProxy) {
+          networkProxyConnections++;
+        }
 
         maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
         if (record.outgoingStartTime) {
@@ -1440,19 +1705,58 @@ export class PortProxy {
           );
         }
 
-        // Skip inactivity check if disabled
-        if (!this.settings.disableInactivityCheck) {
-          // Inactivity check with configurable timeout
-          const inactivityThreshold = this.settings.inactivityTimeout!;
-
+        // Skip inactivity check if disabled or for immortal keep-alive connections
+        if (!this.settings.disableInactivityCheck && 
+            !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')) {
+          
           const inactivityTime = now - record.lastActivity;
-          if (inactivityTime > inactivityThreshold && !record.connectionClosed) {
-            console.log(
-              `[${id}] Inactivity check: No activity on connection from ${
-                record.remoteIP
-              } for ${plugins.prettyMs(inactivityTime)}.`
-            );
-            this.cleanupConnection(record, 'inactivity');
+          
+          // Use extended timeout for extended-treatment keep-alive connections
+          let effectiveTimeout = this.settings.inactivityTimeout!;
+          if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
+            const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
+            effectiveTimeout = effectiveTimeout * multiplier;
+          }
+          
+          if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
+            // For keep-alive connections, issue a warning first
+            if (record.hasKeepAlive && !record.inactivityWarningIssued) {
+              console.log(
+                `[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                `Will close in 10 minutes if no activity.`
+              );
+              
+              // Set warning flag and add grace period
+              record.inactivityWarningIssued = true;
+              record.lastActivity = now - (effectiveTimeout - 600000);
+              
+              // Try to stimulate activity with a probe packet
+              if (record.outgoing && !record.outgoing.destroyed) {
+                try {
+                  record.outgoing.write(Buffer.alloc(0));
+                  
+                  if (this.settings.enableDetailedLogging) {
+                    console.log(`[${id}] Sent probe packet to test keep-alive connection`);
+                  }
+                } catch (err) {
+                  console.log(`[${id}] Error sending probe packet: ${err}`);
+                }
+              }
+            } else {
+              // For non-keep-alive or after warning, close the connection
+              console.log(
+                `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
+                `for ${plugins.prettyMs(inactivityTime)}.` +
+                (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
+              );
+              this.cleanupConnection(record, 'inactivity');
+            }
+          } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
+            // If activity detected after warning, clear the warning
+            if (this.settings.enableDetailedLogging) {
+              console.log(`[${id}] Connection activity detected after inactivity warning, resetting warning`);
+            }
+            record.inactivityWarningIssued = false;
           }
         }
       }
@@ -1460,7 +1764,8 @@ export class PortProxy {
       // Log detailed stats periodically
       console.log(
         `Active connections: ${this.connectionRecords.size}. ` +
-          `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), Non-TLS=${nonTlsConnections}. ` +
+          `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
+          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
           `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
             maxOutgoing
           )}. ` +
@@ -1477,6 +1782,21 @@ export class PortProxy {
     }
   }
 
+  /**
+   * Add or replace NetworkProxy instances
+   */
+  public setNetworkProxies(networkProxies: NetworkProxy[]): void {
+    this.networkProxies = networkProxies;
+    console.log(`Updated NetworkProxy instances: ${this.networkProxies.length} proxies configured`);
+  }
+
+  /**
+   * Get a list of configured NetworkProxy instances
+   */
+  public getNetworkProxies(): NetworkProxy[] {
+    return this.networkProxies;
+  }
+
   /**
    * Gracefully shut down the proxy
    */