@push.rocks/smartproxy 3.28.6 → 3.29.1

package/ts/classes.portproxy.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import { NetworkProxy } from './classes.networkproxy.js';
 
 /** Domain configuration with per-domain allowed port ranges */
 export interface IDomainConfig {
@@ -9,6 +10,10 @@ export interface IDomainConfig {
   portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
   // Allow domain-specific timeout override
   connectionTimeout?: number; // Connection timeout override (ms)
+  
+  // New properties for NetworkProxy integration
+  useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy
+  networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
 }
 
 /** Port proxy settings including global allowed port ranges */
@@ -54,6 +59,9 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
   keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
   extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
+  
+  // New property for NetworkProxy integration
+  networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
 }
 
 /**
@@ -88,6 +96,10 @@ interface IConnectionRecord {
   inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
   incomingTerminationReason?: string | null; // Reason for incoming termination
   outgoingTerminationReason?: string | null; // Reason for outgoing termination
+  
+  // New field for NetworkProxy tracking
+  usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
+  networkProxyIndex?: number; // Which NetworkProxy instance is being used
 }
 
 /**
@@ -336,6 +348,9 @@ export class PortProxy {
   // Connection tracking by IP for rate limiting
   private connectionsByIP: Map<string, Set<string>> = new Map();
   private connectionRateByIP: Map<string, number[]> = new Map();
+  
+  // New property to store NetworkProxy instances
+  private networkProxies: NetworkProxy[] = [];
 
   constructor(settingsArg: IPortProxySettings) {
     // Set reasonable defaults for all settings
@@ -375,6 +390,506 @@ export class PortProxy {
       keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
       extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
     };
+    
+    // Store NetworkProxy instances if provided
+    this.networkProxies = settingsArg.networkProxies || [];
+  }
+
+  /**
+   * Forwards a TLS connection to a NetworkProxy for handling
+   * @param connectionId - Unique connection identifier
+   * @param socket - The incoming client socket
+   * @param record - The connection record
+   * @param domainConfig - The domain configuration
+   * @param initialData - Initial data chunk (TLS ClientHello)
+   * @param serverName - SNI hostname (if available)
+   */
+  private forwardToNetworkProxy(
+    connectionId: string,
+    socket: plugins.net.Socket,
+    record: IConnectionRecord,
+    domainConfig: IDomainConfig,
+    initialData: Buffer,
+    serverName?: string
+  ): void {
+    // Determine which NetworkProxy to use
+    const proxyIndex = domainConfig.networkProxyIndex !== undefined 
+      ? domainConfig.networkProxyIndex
+      : 0;
+      
+    // Validate the NetworkProxy index
+    if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
+      console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`);
+      // Fall back to direct connection
+      return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData);
+    }
+    
+    const networkProxy = this.networkProxies[proxyIndex];
+    const proxyPort = networkProxy.getListeningPort();
+    const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
+    
+    if (this.settings.enableDetailedLogging) {
+      console.log(
+        `[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}`
+      );
+    }
+    
+    // Create a connection to the NetworkProxy
+    const proxySocket = plugins.net.connect({
+      host: proxyHost,
+      port: proxyPort
+    });
+    
+    // Store the outgoing socket in the record
+    record.outgoing = proxySocket;
+    record.outgoingStartTime = Date.now();
+    record.usingNetworkProxy = true;
+    record.networkProxyIndex = proxyIndex;
+    
+    // Set up error handlers
+    proxySocket.on('error', (err) => {
+      console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
+      this.cleanupConnection(record, 'network_proxy_connect_error');
+    });
+    
+    // Handle connection to NetworkProxy
+    proxySocket.on('connect', () => {
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
+      }
+      
+      // First send the initial data that contains the TLS ClientHello
+      proxySocket.write(initialData);
+      
+      // Now set up bidirectional piping between client and NetworkProxy
+      socket.pipe(proxySocket);
+      proxySocket.pipe(socket);
+      
+      // Setup cleanup handlers
+      proxySocket.on('close', () => {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] NetworkProxy connection closed`);
+        }
+        this.cleanupConnection(record, 'network_proxy_closed');
+      });
+      
+      socket.on('close', () => {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`);
+        }
+        this.cleanupConnection(record, 'client_closed');
+      });
+      
+      // Update activity on data transfer
+      socket.on('data', () => this.updateActivity(record));
+      proxySocket.on('data', () => this.updateActivity(record));
+      
+      if (this.settings.enableDetailedLogging) {
+        console.log(
+          `[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]`
+        );
+      }
+    });
+  }
+  
+  /**
+   * Sets up a direct connection to the target (original behavior)
+   * This is used when NetworkProxy isn't configured or as a fallback
+   */
+  private setupDirectConnection(
+    connectionId: string,
+    socket: plugins.net.Socket,
+    record: IConnectionRecord,
+    domainConfig: IDomainConfig | undefined,
+    serverName?: string,
+    initialChunk?: Buffer,
+    overridePort?: number
+  ): void {
+    // Existing connection setup logic
+    const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
+    const connectionOptions: plugins.net.NetConnectOpts = {
+      host: targetHost,
+      port: overridePort !== undefined ? overridePort : this.settings.toPort,
+    };
+    if (this.settings.preserveSourceIP) {
+      connectionOptions.localAddress = record.remoteIP.replace('::ffff:', '');
+    }
+
+    // Pause the incoming socket to prevent buffer overflows
+    socket.pause();
+
+    // Temporary handler to collect data during connection setup
+    const tempDataHandler = (chunk: Buffer) => {
+      // Track bytes received
+      record.bytesReceived += chunk.length;
+
+      // Check for TLS handshake
+      if (!record.isTLS && isTlsHandshake(chunk)) {
+        record.isTLS = true;
+
+        if (this.settings.enableTlsDebugLogging) {
+          console.log(
+            `[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
+          );
+        }
+      }
+
+      // Check if adding this chunk would exceed the buffer limit
+      const newSize = record.pendingDataSize + chunk.length;
+
+      if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
+        console.log(
+          `[${connectionId}] Buffer limit exceeded for connection from ${record.remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
+        );
+        socket.end(); // Gracefully close the socket
+        return this.initiateCleanupOnce(record, 'buffer_limit_exceeded');
+      }
+
+      // Buffer the chunk and update the size counter
+      record.pendingData.push(Buffer.from(chunk));
+      record.pendingDataSize = newSize;
+      this.updateActivity(record);
+    };
+
+    // Add the temp handler to capture all incoming data during connection setup
+    socket.on('data', tempDataHandler);
+
+    // Add initial chunk to pending data if present
+    if (initialChunk) {
+      record.bytesReceived += initialChunk.length;
+      record.pendingData.push(Buffer.from(initialChunk));
+      record.pendingDataSize = initialChunk.length;
+    }
+
+    // Create the target socket but don't set up piping immediately
+    const targetSocket = plugins.net.connect(connectionOptions);
+    record.outgoing = targetSocket;
+    record.outgoingStartTime = Date.now();
+
+    // Apply socket optimizations
+    targetSocket.setNoDelay(this.settings.noDelay);
+    
+    // Apply keep-alive settings to the outgoing connection as well
+    if (this.settings.keepAlive) {
+      targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
+      
+      // Apply enhanced TCP keep-alive options if enabled
+      if (this.settings.enableKeepAliveProbes) {
+        try {
+          if ('setKeepAliveProbes' in targetSocket) {
+            (targetSocket as any).setKeepAliveProbes(10);
+          }
+          if ('setKeepAliveInterval' in targetSocket) {
+            (targetSocket as any).setKeepAliveInterval(1000);
+          }
+        } catch (err) {
+          // Ignore errors - these are optional enhancements
+          if (this.settings.enableDetailedLogging) {
+            console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
+          }
+        }
+      }
+    }
+
+    // Setup specific error handler for connection phase
+    targetSocket.once('error', (err) => {
+      // This handler runs only once during the initial connection phase
+      const code = (err as any).code;
+      console.log(
+        `[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
+      );
+
+      // Resume the incoming socket to prevent it from hanging
+      socket.resume();
+
+      if (code === 'ECONNREFUSED') {
+        console.log(
+          `[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
+        );
+      } else if (code === 'ETIMEDOUT') {
+        console.log(
+          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
+        );
+      } else if (code === 'ECONNRESET') {
+        console.log(
+          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
+        );
+      } else if (code === 'EHOSTUNREACH') {
+        console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
+      }
+
+      // Clear any existing error handler after connection phase
+      targetSocket.removeAllListeners('error');
+
+      // Re-add the normal error handler for established connections
+      targetSocket.on('error', this.handleError('outgoing', record));
+
+      if (record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'connection_failed';
+        this.incrementTerminationStat('outgoing', 'connection_failed');
+      }
+
+      // Clean up the connection
+      this.initiateCleanupOnce(record, `connection_failed_${code}`);
+    });
+
+    // Setup close handler
+    targetSocket.on('close', this.handleClose('outgoing', record));
+    socket.on('close', this.handleClose('incoming', record));
+
+    // Handle timeouts with keep-alive awareness
+    socket.on('timeout', () => {
+      // For keep-alive connections, just log a warning instead of closing
+      if (record.hasKeepAlive) {
+        console.log(
+          `[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+            this.settings.socketTimeout || 3600000
+          )}. Connection preserved.`
+        );
+        // Don't close the connection - just log
+        return;
+      }
+      
+      // For non-keep-alive connections, proceed with normal cleanup
+      console.log(
+        `[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs(
+          this.settings.socketTimeout || 3600000
+        )}`
+      );
+      if (record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = 'timeout';
+        this.incrementTerminationStat('incoming', 'timeout');
+      }
+      this.initiateCleanupOnce(record, 'timeout_incoming');
+    });
+
+    targetSocket.on('timeout', () => {
+      // For keep-alive connections, just log a warning instead of closing
+      if (record.hasKeepAlive) {
+        console.log(
+          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+            this.settings.socketTimeout || 3600000
+          )}. Connection preserved.`
+        );
+        // Don't close the connection - just log
+        return;
+      }
+      
+      // For non-keep-alive connections, proceed with normal cleanup
+      console.log(
+        `[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs(
+          this.settings.socketTimeout || 3600000
+        )}`
+      );
+      if (record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'timeout';
+        this.incrementTerminationStat('outgoing', 'timeout');
+      }
+      this.initiateCleanupOnce(record, 'timeout_outgoing');
+    });
+
+    // Set appropriate timeouts, or disable for immortal keep-alive connections
+    if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
+      // Disable timeouts completely for immortal connections
+      socket.setTimeout(0);
+      targetSocket.setTimeout(0);
+      
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
+      }
+    } else {
+      // Set normal timeouts for other connections
+      socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
+      targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
+    }
+
+    // Track outgoing data for bytes counting
+    targetSocket.on('data', (chunk: Buffer) => {
+      record.bytesSent += chunk.length;
+      this.updateActivity(record);
+    });
+
+    // Wait for the outgoing connection to be ready before setting up piping
+    targetSocket.once('connect', () => {
+      // Clear the initial connection error handler
+      targetSocket.removeAllListeners('error');
+
+      // Add the normal error handler for established connections
+      targetSocket.on('error', this.handleError('outgoing', record));
+
+      // Remove temporary data handler
+      socket.removeListener('data', tempDataHandler);
+
+      // Flush all pending data to target
+      if (record.pendingData.length > 0) {
+        const combinedData = Buffer.concat(record.pendingData);
+        targetSocket.write(combinedData, (err) => {
+          if (err) {
+            console.log(
+              `[${connectionId}] Error writing pending data to target: ${err.message}`
+            );
+            return this.initiateCleanupOnce(record, 'write_error');
+          }
+
+          // Now set up piping for future data and resume the socket
+          socket.pipe(targetSocket);
+          targetSocket.pipe(socket);
+          socket.resume(); // Resume the socket after piping is established
+
+          if (this.settings.enableDetailedLogging) {
+            console.log(
+              `[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+                `${
+                  serverName
+                    ? ` (SNI: ${serverName})`
+                    : domainConfig
+                    ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                    : ''
+                }` +
+                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+            );
+          } else {
+            console.log(
+              `Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+                `${
+                  serverName
+                    ? ` (SNI: ${serverName})`
+                    : domainConfig
+                    ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                    : ''
+                }`
+            );
+          }
+        });
+      } else {
+        // No pending data, so just set up piping
+        socket.pipe(targetSocket);
+        targetSocket.pipe(socket);
+        socket.resume(); // Resume the socket after piping is established
+
+        if (this.settings.enableDetailedLogging) {
+          console.log(
+            `[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+              `${
+                serverName
+                  ? ` (SNI: ${serverName})`
+                  : domainConfig
+                  ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                  : ''
+              }` +
+              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+          );
+        } else {
+          console.log(
+            `Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+              `${
+                serverName
+                  ? ` (SNI: ${serverName})`
+                  : domainConfig
+                  ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
+                  : ''
+              }`
+          );
+        }
+      }
+
+      // Clear the buffer now that we've processed it
+      record.pendingData = [];
+      record.pendingDataSize = 0;
+
+      // Add the renegotiation listener for SNI validation
+      if (serverName) {
+        socket.on('data', (renegChunk: Buffer) => {
+          if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+            try {
+              // Try to extract SNI from potential renegotiation
+              const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+              if (newSNI && newSNI !== record.lockedDomain) {
+                console.log(
+                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. Terminating connection.`
+                );
+                this.initiateCleanupOnce(record, 'sni_mismatch');
+              } else if (newSNI && this.settings.enableDetailedLogging) {
+                console.log(
+                  `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
+                );
+              }
+            } catch (err) {
+              console.log(
+                `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
+              );
+            }
+          }
+        });
+      }
+
+      // Set connection timeout with simpler logic
+      if (record.cleanupTimer) {
+        clearTimeout(record.cleanupTimer);
+      }
+      
+      // For immortal keep-alive connections, skip setting a timeout completely
+      if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
+        }
+        // No cleanup timer for immortal connections
+      } 
+      // For extended keep-alive connections, use extended timeout
+      else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
+        const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
+        const safeTimeout = ensureSafeTimeout(extendedTimeout);
+        
+        record.cleanupTimer = setTimeout(() => {
+          console.log(
+            `[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
+              extendedTimeout
+            )}), forcing cleanup.`
+          );
+          this.initiateCleanupOnce(record, 'extended_lifetime');
+        }, safeTimeout);
+        
+        // Make sure timeout doesn't keep the process alive
+        if (record.cleanupTimer.unref) {
+          record.cleanupTimer.unref();
+        }
+        
+        if (this.settings.enableDetailedLogging) {
+          console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
+        }
+      }
+      // For standard connections, use normal timeout
+      else {
+        // Use domain-specific timeout if available, otherwise use default
+        const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
+        const safeTimeout = ensureSafeTimeout(connectionTimeout);
+        
+        record.cleanupTimer = setTimeout(() => {
+          console.log(
+            `[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs(
+              connectionTimeout
+            )}), forcing cleanup.`
+          );
+          this.initiateCleanupOnce(record, 'connection_timeout');
+        }, safeTimeout);
+        
+        // Make sure timeout doesn't keep the process alive
+        if (record.cleanupTimer.unref) {
+          record.cleanupTimer.unref();
+        }
+      }
+
+      // Mark TLS handshake as complete for TLS connections
+      if (record.isTLS) {
+        record.tlsHandshakeComplete = true;
+
+        if (this.settings.enableTlsDebugLogging) {
+          console.log(
+            `[${connectionId}] TLS handshake complete for connection from ${record.remoteIP}`
+          );
+        }
+      }
+    });
   }
 
   /**
@@ -532,7 +1047,8 @@ export class PortProxy {
             ` Duration: ${plugins.prettyMs(
               duration
             )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
+            `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
         );
       } else {
         console.log(
@@ -583,6 +1099,81 @@ export class PortProxy {
     this.cleanupConnection(record, reason);
   }
 
+  /**
+   * Creates a generic error handler for incoming or outgoing sockets
+   */
+  private handleError(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
+    return (err: Error) => {
+      const code = (err as any).code;
+      let reason = 'error';
+
+      const now = Date.now();
+      const connectionDuration = now - record.incomingStartTime;
+      const lastActivityAge = now - record.lastActivity;
+
+      if (code === 'ECONNRESET') {
+        reason = 'econnreset';
+        console.log(
+          `[${record.id}] ECONNRESET on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      } else if (code === 'ETIMEDOUT') {
+        reason = 'etimedout';
+        console.log(
+          `[${record.id}] ETIMEDOUT on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      } else {
+        console.log(
+          `[${record.id}] Error on ${side} side from ${record.remoteIP}: ${
+            err.message
+          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
+            lastActivityAge
+          )} ago`
+        );
+      }
+
+      if (side === 'incoming' && record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = reason;
+        this.incrementTerminationStat('incoming', reason);
+      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = reason;
+        this.incrementTerminationStat('outgoing', reason);
+      }
+
+      this.initiateCleanupOnce(record, reason);
+    };
+  }
+
+  /**
+   * Creates a generic close handler for incoming or outgoing sockets
+   */
+  private handleClose(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
+    return () => {
+      if (this.settings.enableDetailedLogging) {
+        console.log(`[${record.id}] Connection closed on ${side} side from ${record.remoteIP}`);
+      }
+
+      if (side === 'incoming' && record.incomingTerminationReason === null) {
+        record.incomingTerminationReason = 'normal';
+        this.incrementTerminationStat('incoming', 'normal');
+      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
+        record.outgoingTerminationReason = 'normal';
+        this.incrementTerminationStat('outgoing', 'normal');
+        // Record the time when outgoing socket closed.
+        record.outgoingClosedTime = Date.now();
+      }
+
+      this.initiateCleanupOnce(record, 'closed_' + side);
+    };
+  }
+
   /**
    * Main method to start the proxy
    */
@@ -651,7 +1242,10 @@ export class PortProxy {
         hasReceivedInitialData: false,
         hasKeepAlive: false, // Will set to true if keep-alive is applied
         incomingTerminationReason: null,
-        outgoingTerminationReason: null
+        outgoingTerminationReason: null,
+        
+        // Initialize NetworkProxy tracking fields
+        usingNetworkProxy: false
       };
       
       // Apply keep-alive settings if enabled
@@ -695,28 +1289,12 @@ export class PortProxy {
       }
 
       let initialDataReceived = false;
-      let incomingTerminationReason: string | null = null;
-      let outgoingTerminationReason: string | null = null;
-
-      // Define initiateCleanupOnce for compatibility
-      const initiateCleanupOnce = (reason: string = 'normal') => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Connection cleanup initiated for ${remoteIP} (${reason})`);
-        }
-        if (incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
-          connectionRecord.incomingTerminationReason = reason;
-          this.incrementTerminationStat('incoming', reason);
-        }
-        this.cleanupConnection(connectionRecord, reason);
-      };
 
-      // Helper to reject an incoming connection
+      // Define helpers for rejecting connections
       const rejectIncomingConnection = (reason: string, logMessage: string) => {
         console.log(`[${connectionId}] ${logMessage}`);
         socket.end();
-        if (incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
+        if (connectionRecord.incomingTerminationReason === null) {
           connectionRecord.incomingTerminationReason = reason;
           this.incrementTerminationStat('incoming', reason);
         }
@@ -731,8 +1309,7 @@ export class PortProxy {
             console.log(
               `[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
             );
-            if (incomingTerminationReason === null) {
-              incomingTerminationReason = 'initial_timeout';
+            if (connectionRecord.incomingTerminationReason === null) {
               connectionRecord.incomingTerminationReason = 'initial_timeout';
               this.incrementTerminationStat('incoming', 'initial_timeout');
             }
@@ -750,9 +1327,7 @@ export class PortProxy {
         connectionRecord.hasReceivedInitialData = true;
       }
 
-      socket.on('error', (err: Error) => {
-        console.log(`[${connectionId}] Incoming socket error from ${remoteIP}: ${err.message}`);
-      });
+      socket.on('error', this.handleError('incoming', connectionRecord));
 
       // Track data for bytes counting
       socket.on('data', (chunk: Buffer) => {
@@ -773,77 +1348,8 @@ export class PortProxy {
         }
       });
 
-      const handleError = (side: 'incoming' | 'outgoing') => (err: Error) => {
-        const code = (err as any).code;
-        let reason = 'error';
-
-        const now = Date.now();
-        const connectionDuration = now - connectionRecord.incomingStartTime;
-        const lastActivityAge = now - connectionRecord.lastActivity;
-
-        if (code === 'ECONNRESET') {
-          reason = 'econnreset';
-          console.log(
-            `[${connectionId}] ECONNRESET on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        } else if (code === 'ETIMEDOUT') {
-          reason = 'etimedout';
-          console.log(
-            `[${connectionId}] ETIMEDOUT on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        } else {
-          console.log(
-            `[${connectionId}] Error on ${side} side from ${remoteIP}: ${
-              err.message
-            }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-              lastActivityAge
-            )} ago`
-          );
-        }
-
-        if (side === 'incoming' && incomingTerminationReason === null) {
-          incomingTerminationReason = reason;
-          connectionRecord.incomingTerminationReason = reason;
-          this.incrementTerminationStat('incoming', reason);
-        } else if (side === 'outgoing' && outgoingTerminationReason === null) {
-          outgoingTerminationReason = reason;
-          connectionRecord.outgoingTerminationReason = reason;
-          this.incrementTerminationStat('outgoing', reason);
-        }
-
-        initiateCleanupOnce(reason);
-      };
-
-      const handleClose = (side: 'incoming' | 'outgoing') => () => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Connection closed on ${side} side from ${remoteIP}`);
-        }
-
-        if (side === 'incoming' && incomingTerminationReason === null) {
-          incomingTerminationReason = 'normal';
-          connectionRecord.incomingTerminationReason = 'normal';
-          this.incrementTerminationStat('incoming', 'normal');
-        } else if (side === 'outgoing' && outgoingTerminationReason === null) {
-          outgoingTerminationReason = 'normal';
-          connectionRecord.outgoingTerminationReason = 'normal';
-          this.incrementTerminationStat('outgoing', 'normal');
-          // Record the time when outgoing socket closed.
-          connectionRecord.outgoingClosedTime = Date.now();
-        }
-
-        initiateCleanupOnce('closed_' + side);
-      };
-
       /**
-       * Sets up the connection to the target host.
+       * Sets up the connection to the target host or NetworkProxy.
        * @param serverName - The SNI hostname (unused when forcedDomain is provided).
        * @param initialChunk - Optional initial data chunk.
        * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
@@ -866,7 +1372,8 @@ export class PortProxy {
         connectionRecord.hasReceivedInitialData = true;
 
         // Check if this looks like a TLS handshake
-        if (initialChunk && isTlsHandshake(initialChunk)) {
+        const isTlsHandshakeDetected = initialChunk && isTlsHandshake(initialChunk);
+        if (isTlsHandshakeDetected) {
           connectionRecord.isTLS = true;
 
           if (this.settings.enableTlsDebugLogging) {
@@ -911,6 +1418,23 @@ export class PortProxy {
               )}`
             );
           }
+          
+          // Check if we should forward this to a NetworkProxy
+          if (
+            isTlsHandshakeDetected && 
+            domainConfig.useNetworkProxy === true && 
+            initialChunk && 
+            this.networkProxies.length > 0
+          ) {
+            return this.forwardToNetworkProxy(
+              connectionId,
+              socket,
+              connectionRecord,
+              domainConfig,
+              initialChunk,
+              serverName
+            );
+          }
         } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
           if (
             !isGlobIPAllowed(
@@ -926,393 +1450,16 @@ export class PortProxy {
           }
         }
 
-        const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
-        const connectionOptions: plugins.net.NetConnectOpts = {
-          host: targetHost,
-          port: overridePort !== undefined ? overridePort : this.settings.toPort,
-        };
-        if (this.settings.preserveSourceIP) {
-          connectionOptions.localAddress = remoteIP.replace('::ffff:', '');
-        }
-
-        // Pause the incoming socket to prevent buffer overflows
-        socket.pause();
-
-        // Temporary handler to collect data during connection setup
-        const tempDataHandler = (chunk: Buffer) => {
-          // Track bytes received
-          connectionRecord.bytesReceived += chunk.length;
-
-          // Check for TLS handshake
-          if (!connectionRecord.isTLS && isTlsHandshake(chunk)) {
-            connectionRecord.isTLS = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
-              );
-            }
-          }
-
-          // Check if adding this chunk would exceed the buffer limit
-          const newSize = connectionRecord.pendingDataSize + chunk.length;
-
-          if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
-            console.log(
-              `[${connectionId}] Buffer limit exceeded for connection from ${remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
-            );
-            socket.end(); // Gracefully close the socket
-            return initiateCleanupOnce('buffer_limit_exceeded');
-          }
-
-          // Buffer the chunk and update the size counter
-          connectionRecord.pendingData.push(Buffer.from(chunk));
-          connectionRecord.pendingDataSize = newSize;
-          this.updateActivity(connectionRecord);
-        };
-
-        // Add the temp handler to capture all incoming data during connection setup
-        socket.on('data', tempDataHandler);
-
-        // Add initial chunk to pending data if present
-        if (initialChunk) {
-          connectionRecord.bytesReceived += initialChunk.length;
-          connectionRecord.pendingData.push(Buffer.from(initialChunk));
-          connectionRecord.pendingDataSize = initialChunk.length;
-        }
-
-        // Create the target socket but don't set up piping immediately
-        const targetSocket = plugins.net.connect(connectionOptions);
-        connectionRecord.outgoing = targetSocket;
-        connectionRecord.outgoingStartTime = Date.now();
-
-        // Apply socket optimizations
-        targetSocket.setNoDelay(this.settings.noDelay);
-        
-        // Apply keep-alive settings to the outgoing connection as well
-        if (this.settings.keepAlive) {
-          targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-          
-          // Apply enhanced TCP keep-alive options if enabled
-          if (this.settings.enableKeepAliveProbes) {
-            try {
-              if ('setKeepAliveProbes' in targetSocket) {
-                (targetSocket as any).setKeepAliveProbes(10);
-              }
-              if ('setKeepAliveInterval' in targetSocket) {
-                (targetSocket as any).setKeepAliveInterval(1000);
-              }
-            } catch (err) {
-              // Ignore errors - these are optional enhancements
-              if (this.settings.enableDetailedLogging) {
-                console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
-              }
-            }
-          }
-        }
-
-        // Setup specific error handler for connection phase
-        targetSocket.once('error', (err) => {
-          // This handler runs only once during the initial connection phase
-          const code = (err as any).code;
-          console.log(
-            `[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
-          );
-
-          // Resume the incoming socket to prevent it from hanging
-          socket.resume();
-
-          if (code === 'ECONNREFUSED') {
-            console.log(
-              `[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
-            );
-          } else if (code === 'ETIMEDOUT') {
-            console.log(
-              `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
-            );
-          } else if (code === 'ECONNRESET') {
-            console.log(
-              `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
-            );
-          } else if (code === 'EHOSTUNREACH') {
-            console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
-          }
-
-          // Clear any existing error handler after connection phase
-          targetSocket.removeAllListeners('error');
-
-          // Re-add the normal error handler for established connections
-          targetSocket.on('error', handleError('outgoing'));
-
-          if (outgoingTerminationReason === null) {
-            outgoingTerminationReason = 'connection_failed';
-            connectionRecord.outgoingTerminationReason = 'connection_failed';
-            this.incrementTerminationStat('outgoing', 'connection_failed');
-          }
-
-          // Clean up the connection
-          initiateCleanupOnce(`connection_failed_${code}`);
-        });
-
-        // Setup close handler
-        targetSocket.on('close', handleClose('outgoing'));
-        socket.on('close', handleClose('incoming'));
-
-        // Handle timeouts with keep-alive awareness
-        socket.on('timeout', () => {
-          // For keep-alive connections, just log a warning instead of closing
-          if (connectionRecord.hasKeepAlive) {
-            console.log(
-              `[${connectionId}] Timeout event on incoming keep-alive connection from ${remoteIP} after ${plugins.prettyMs(
-                this.settings.socketTimeout || 3600000
-              )}. Connection preserved.`
-            );
-            // Don't close the connection - just log
-            return;
-          }
-          
-          // For non-keep-alive connections, proceed with normal cleanup
-          console.log(
-            `[${connectionId}] Timeout on incoming side from ${remoteIP} after ${plugins.prettyMs(
-              this.settings.socketTimeout || 3600000
-            )}`
-          );
-          if (incomingTerminationReason === null) {
-            incomingTerminationReason = 'timeout';
-            connectionRecord.incomingTerminationReason = 'timeout';
-            this.incrementTerminationStat('incoming', 'timeout');
-          }
-          initiateCleanupOnce('timeout_incoming');
-        });
-
-        targetSocket.on('timeout', () => {
-          // For keep-alive connections, just log a warning instead of closing
-          if (connectionRecord.hasKeepAlive) {
-            console.log(
-              `[${connectionId}] Timeout event on outgoing keep-alive connection from ${remoteIP} after ${plugins.prettyMs(
-                this.settings.socketTimeout || 3600000
-              )}. Connection preserved.`
-            );
-            // Don't close the connection - just log
-            return;
-          }
-          
-          // For non-keep-alive connections, proceed with normal cleanup
-          console.log(
-            `[${connectionId}] Timeout on outgoing side from ${remoteIP} after ${plugins.prettyMs(
-              this.settings.socketTimeout || 3600000
-            )}`
-          );
-          if (outgoingTerminationReason === null) {
-            outgoingTerminationReason = 'timeout';
-            connectionRecord.outgoingTerminationReason = 'timeout';
-            this.incrementTerminationStat('outgoing', 'timeout');
-          }
-          initiateCleanupOnce('timeout_outgoing');
-        });
-
-        // Set appropriate timeouts, or disable for immortal keep-alive connections
-        if (connectionRecord.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
-          // Disable timeouts completely for immortal connections
-          socket.setTimeout(0);
-          targetSocket.setTimeout(0);
-          
-          if (this.settings.enableDetailedLogging) {
-            console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
-          }
-        } else {
-          // Set normal timeouts for other connections
-          socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-          targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-        }
-
-        // Track outgoing data for bytes counting
-        targetSocket.on('data', (chunk: Buffer) => {
-          connectionRecord.bytesSent += chunk.length;
-          this.updateActivity(connectionRecord);
-        });
-
-        // Wait for the outgoing connection to be ready before setting up piping
-        targetSocket.once('connect', () => {
-          // Clear the initial connection error handler
-          targetSocket.removeAllListeners('error');
-
-          // Add the normal error handler for established connections
-          targetSocket.on('error', handleError('outgoing'));
-
-          // Remove temporary data handler
-          socket.removeListener('data', tempDataHandler);
-
-          // Flush all pending data to target
-          if (connectionRecord.pendingData.length > 0) {
-            const combinedData = Buffer.concat(connectionRecord.pendingData);
-            targetSocket.write(combinedData, (err) => {
-              if (err) {
-                console.log(
-                  `[${connectionId}] Error writing pending data to target: ${err.message}`
-                );
-                return initiateCleanupOnce('write_error');
-              }
-
-              // Now set up piping for future data and resume the socket
-              socket.pipe(targetSocket);
-              targetSocket.pipe(socket);
-              socket.resume(); // Resume the socket after piping is established
-
-              if (this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                    `${
-                      serverName
-                        ? ` (SNI: ${serverName})`
-                        : forcedDomain
-                        ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                        : ''
-                    }` +
-                    ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Yes' : 'No'}`
-                );
-              } else {
-                console.log(
-                  `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                    `${
-                      serverName
-                        ? ` (SNI: ${serverName})`
-                        : forcedDomain
-                        ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                        : ''
-                    }`
-                );
-              }
-            });
-          } else {
-            // No pending data, so just set up piping
-            socket.pipe(targetSocket);
-            targetSocket.pipe(socket);
-            socket.resume(); // Resume the socket after piping is established
-
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                  `${
-                    serverName
-                      ? ` (SNI: ${serverName})`
-                      : forcedDomain
-                      ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                      : ''
-                  }` +
-                  ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Yes' : 'No'}`
-              );
-            } else {
-              console.log(
-                `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-                  `${
-                    serverName
-                      ? ` (SNI: ${serverName})`
-                      : forcedDomain
-                      ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
-                      : ''
-                  }`
-              );
-            }
-          }
-
-          // Clear the buffer now that we've processed it
-          connectionRecord.pendingData = [];
-          connectionRecord.pendingDataSize = 0;
-
-          // Add the renegotiation listener for SNI validation
-          if (serverName) {
-            socket.on('data', (renegChunk: Buffer) => {
-              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
-                try {
-                  // Try to extract SNI from potential renegotiation
-                  const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
-                  if (newSNI && newSNI !== connectionRecord.lockedDomain) {
-                    console.log(
-                      `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${connectionRecord.lockedDomain}. Terminating connection.`
-                    );
-                    initiateCleanupOnce('sni_mismatch');
-                  } else if (newSNI && this.settings.enableDetailedLogging) {
-                    console.log(
-                      `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
-                    );
-                  }
-                } catch (err) {
-                  console.log(
-                    `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
-                  );
-                }
-              }
-            });
-          }
-
-          // Set connection timeout with simpler logic
-          if (connectionRecord.cleanupTimer) {
-            clearTimeout(connectionRecord.cleanupTimer);
-          }
-          
-          // For immortal keep-alive connections, skip setting a timeout completely
-          if (connectionRecord.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
-            if (this.settings.enableDetailedLogging) {
-              console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
-            }
-            // No cleanup timer for immortal connections
-          } 
-          // For extended keep-alive connections, use extended timeout
-          else if (connectionRecord.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
-            const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
-            const safeTimeout = ensureSafeTimeout(extendedTimeout);
-            
-            connectionRecord.cleanupTimer = setTimeout(() => {
-              console.log(
-                `[${connectionId}] Keep-alive connection from ${remoteIP} exceeded extended lifetime (${plugins.prettyMs(
-                  extendedTimeout
-                )}), forcing cleanup.`
-              );
-              initiateCleanupOnce('extended_lifetime');
-            }, safeTimeout);
-            
-            // Make sure timeout doesn't keep the process alive
-            if (connectionRecord.cleanupTimer.unref) {
-              connectionRecord.cleanupTimer.unref();
-            }
-            
-            if (this.settings.enableDetailedLogging) {
-              console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
-            }
-          }
-          // For standard connections, use normal timeout
-          else {
-            // Use domain-specific timeout if available, otherwise use default
-            const connectionTimeout = connectionRecord.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
-            const safeTimeout = ensureSafeTimeout(connectionTimeout);
-            
-            connectionRecord.cleanupTimer = setTimeout(() => {
-              console.log(
-                `[${connectionId}] Connection from ${remoteIP} exceeded max lifetime (${plugins.prettyMs(
-                  connectionTimeout
-                )}), forcing cleanup.`
-              );
-              initiateCleanupOnce('connection_timeout');
-            }, safeTimeout);
-            
-            // Make sure timeout doesn't keep the process alive
-            if (connectionRecord.cleanupTimer.unref) {
-              connectionRecord.cleanupTimer.unref();
-            }
-          }
-
-          // Mark TLS handshake as complete for TLS connections
-          if (connectionRecord.isTLS) {
-            connectionRecord.tlsHandshakeComplete = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake complete for connection from ${remoteIP}`
-              );
-            }
-          }
-        });
+        // If we didn't forward to NetworkProxy, proceed with direct connection
+        return this.setupDirectConnection(
+          connectionId,
+          socket,
+          connectionRecord,
+          domainConfig,
+          serverName,
+          initialChunk,
+          overridePort
+        );
       };
 
       // --- PORT RANGE-BASED HANDLING ---
@@ -1475,7 +1622,7 @@ export class PortProxy {
         console.log(
           `PortProxy -> OK: Now listening on port ${port}${
             this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''
-          }`
+          }${this.networkProxies.length > 0 ? ' (NetworkProxy integration enabled)' : ''}`
         );
       });
       this.netServers.push(server);
@@ -1494,6 +1641,7 @@ export class PortProxy {
       let completedTlsHandshakes = 0;
       let pendingTlsHandshakes = 0;
       let keepAliveConnections = 0;
+      let networkProxyConnections = 0;
 
       // Create a copy of the keys to avoid modification during iteration
       const connectionIds = [...this.connectionRecords.keys()];
@@ -1517,6 +1665,10 @@ export class PortProxy {
         if (record.hasKeepAlive) {
           keepAliveConnections++;
         }
+        
+        if (record.usingNetworkProxy) {
+          networkProxyConnections++;
+        }
 
         maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
         if (record.outgoingStartTime) {
@@ -1613,7 +1765,7 @@ export class PortProxy {
       console.log(
         `Active connections: ${this.connectionRecords.size}. ` +
           `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
-          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}. ` +
+          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
           `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
             maxOutgoing
           )}. ` +
@@ -1630,6 +1782,21 @@ export class PortProxy {
     }
   }
 
+  /**
+   * Add or replace NetworkProxy instances
+   */
+  public setNetworkProxies(networkProxies: NetworkProxy[]): void {
+    this.networkProxies = networkProxies;
+    console.log(`Updated NetworkProxy instances: ${this.networkProxies.length} proxies configured`);
+  }
+
+  /**
+   * Get a list of configured NetworkProxy instances
+   */
+  public getNetworkProxies(): NetworkProxy[] {
+    return this.networkProxies;
+  }
+
   /**
    * Gracefully shut down the proxy
    */