@push.rocks/smartproxy 3.32.2 → 3.34.0

package/ts/classes.portproxy.ts

@@ -10,10 +10,6 @@ export interface IDomainConfig {
   portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
   // Allow domain-specific timeout override
   connectionTimeout?: number; // Connection timeout override (ms)
-  
-  // New properties for NetworkProxy integration
-  useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy
-  networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
 }
 
 /** Port proxy settings including global allowed port ranges */
@@ -54,14 +50,15 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   // Rate limiting and security
   maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
   connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
-  
+
   // Enhanced keep-alive settings
   keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
   keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
   extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
-  
+
   // New property for NetworkProxy integration
-  networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
+  useNetworkProxy?: number[]; // Array of ports to forward to NetworkProxy
+  networkProxyPort?: number; // Port where NetworkProxy is listening (default: 8443)
 }
 
 /**
@@ -90,16 +87,22 @@ interface IConnectionRecord {
   tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
   hasReceivedInitialData: boolean; // Whether initial data has been received
   domainConfig?: IDomainConfig; // Associated domain config for this connection
-  
+
   // Keep-alive tracking
   hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
   inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
   incomingTerminationReason?: string | null; // Reason for incoming termination
   outgoingTerminationReason?: string | null; // Reason for outgoing termination
-  
-  // New field for NetworkProxy tracking
+
+  // NetworkProxy tracking
   usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
-  networkProxyIndex?: number; // Which NetworkProxy instance is being used
+
+  // Renegotiation handler
+  renegotiationHandler?: (chunk: Buffer) => void; // Handler for renegotiation detection
+
+  // Browser connection tracking
+  isBrowserConnection?: boolean; // Whether this connection appears to be from a browser
+  domainSwitches?: number; // Number of times the domain has been switched on this connection
 }
 
 /**
@@ -266,6 +269,29 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
   }
 }
 
+/**
+ * Checks if a TLS record is a proper ClientHello message (more accurate than just checking record type)
+ * @param buffer - Buffer containing the TLS record
+ * @returns true if the buffer contains a proper ClientHello message
+ */
+function isClientHello(buffer: Buffer): boolean {
+  try {
+    if (buffer.length < 9) return false; // Too small for a proper ClientHello
+
+    // Check record type (has to be handshake - 22)
+    if (buffer.readUInt8(0) !== 22) return false;
+
+    // After the TLS record header (5 bytes), check the handshake type (1 for ClientHello)
+    if (buffer.readUInt8(5) !== 1) return false;
+
+    // Basic checks passed, this appears to be a ClientHello
+    return true;
+  } catch (err) {
+    console.log(`Error checking for ClientHello: ${err}`);
+    return false;
+  }
+}
+
 // Helper: Check if a port falls within any of the given port ranges
 const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
   return ranges.some((range) => port >= range.from && port <= range.to);
@@ -348,9 +374,9 @@ export class PortProxy {
   // Connection tracking by IP for rate limiting
   private connectionsByIP: Map<string, Set<string>> = new Map();
   private connectionRateByIP: Map<string, number[]> = new Map();
-  
-  // New property to store NetworkProxy instances
-  private networkProxies: NetworkProxy[] = [];
+
+  // NetworkProxy instance for TLS termination
+  private networkProxy: NetworkProxy | null = null;
 
   constructor(settingsArg: IPortProxySettings) {
     // Set reasonable defaults for all settings
@@ -370,29 +396,49 @@ export class PortProxy {
       // Socket optimization settings
       noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
       keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
-      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds (reduced for responsiveness)
-      maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB to handle large TLS handshakes
+      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds
+      maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB
 
       // Feature flags
       disableInactivityCheck: settingsArg.disableInactivityCheck || false,
       enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined 
-        ? settingsArg.enableKeepAliveProbes : true, // Enable by default
+                            ? settingsArg.enableKeepAliveProbes : true,
       enableDetailedLogging: settingsArg.enableDetailedLogging || false,
       enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
-      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default
+      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
 
       // Rate limiting defaults
-      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
-      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
-      
+      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
+      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
+
       // Enhanced keep-alive settings
-      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default
-      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
+      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
+      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
       extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
+      
+      // NetworkProxy settings
+      networkProxyPort: settingsArg.networkProxyPort || 8443, // Default NetworkProxy port
     };
-    
-    // Store NetworkProxy instances if provided
-    this.networkProxies = settingsArg.networkProxies || [];
+
+    // Initialize NetworkProxy if enabled
+    if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
+      this.initializeNetworkProxy();
+    }
+  }
+
+  /**
+   * Initialize NetworkProxy instance
+   */
+  private initializeNetworkProxy(): void {
+    if (!this.networkProxy) {
+      this.networkProxy = new NetworkProxy({
+        port: this.settings.networkProxyPort!,
+        portProxyIntegration: true,
+        logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info'
+      });
+      
+      console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
+    }
   }
 
   /**
@@ -400,71 +446,69 @@ export class PortProxy {
    * @param connectionId - Unique connection identifier
    * @param socket - The incoming client socket
    * @param record - The connection record
-   * @param domainConfig - The domain configuration
    * @param initialData - Initial data chunk (TLS ClientHello)
-   * @param serverName - SNI hostname (if available)
    */
   private forwardToNetworkProxy(
     connectionId: string,
     socket: plugins.net.Socket,
     record: IConnectionRecord,
-    domainConfig: IDomainConfig,
-    initialData: Buffer,
-    serverName?: string
+    initialData: Buffer
   ): void {
-    // Determine which NetworkProxy to use
-    const proxyIndex = domainConfig.networkProxyIndex !== undefined 
-      ? domainConfig.networkProxyIndex
-      : 0;
-      
-    // Validate the NetworkProxy index
-    if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
-      console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`);
+    // Ensure NetworkProxy is initialized
+    if (!this.networkProxy) {
+      console.log(
+        `[${connectionId}] NetworkProxy not initialized. Using fallback direct connection.`
+      );
       // Fall back to direct connection
-      return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData);
+      return this.setupDirectConnection(
+        connectionId,
+        socket,
+        record,
+        undefined,
+        undefined,
+        initialData
+      );
     }
-    
-    const networkProxy = this.networkProxies[proxyIndex];
-    const proxyPort = networkProxy.getListeningPort();
+
+    const proxyPort = this.networkProxy.getListeningPort();
     const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
-    
+
     if (this.settings.enableDetailedLogging) {
       console.log(
-        `[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}`
+        `[${connectionId}] Forwarding TLS connection to NetworkProxy at ${proxyHost}:${proxyPort}`
       );
     }
-    
+
     // Create a connection to the NetworkProxy
     const proxySocket = plugins.net.connect({
       host: proxyHost,
-      port: proxyPort
+      port: proxyPort,
     });
-    
+
     // Store the outgoing socket in the record
     record.outgoing = proxySocket;
     record.outgoingStartTime = Date.now();
     record.usingNetworkProxy = true;
-    record.networkProxyIndex = proxyIndex;
-    
+
     // Set up error handlers
     proxySocket.on('error', (err) => {
       console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
       this.cleanupConnection(record, 'network_proxy_connect_error');
     });
-    
+
     // Handle connection to NetworkProxy
     proxySocket.on('connect', () => {
       if (this.settings.enableDetailedLogging) {
         console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
       }
-      
+
       // First send the initial data that contains the TLS ClientHello
       proxySocket.write(initialData);
-      
+
       // Now set up bidirectional piping between client and NetworkProxy
       socket.pipe(proxySocket);
       proxySocket.pipe(socket);
-      
+
       // Setup cleanup handlers
       proxySocket.on('close', () => {
         if (this.settings.enableDetailedLogging) {
@@ -472,26 +516,28 @@ export class PortProxy {
         }
         this.cleanupConnection(record, 'network_proxy_closed');
       });
-      
+
       socket.on('close', () => {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`);
+          console.log(
+            `[${connectionId}] Client connection closed after forwarding to NetworkProxy`
+          );
         }
         this.cleanupConnection(record, 'client_closed');
       });
-      
+
       // Update activity on data transfer
       socket.on('data', () => this.updateActivity(record));
       proxySocket.on('data', () => this.updateActivity(record));
-      
+
       if (this.settings.enableDetailedLogging) {
         console.log(
-          `[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]`
+          `[${connectionId}] TLS connection successfully forwarded to NetworkProxy`
         );
       }
     });
   }
-  
+
   /**
    * Sets up a direct connection to the target (original behavior)
    * This is used when NetworkProxy isn't configured or as a fallback
@@ -568,11 +614,11 @@ export class PortProxy {
 
     // Apply socket optimizations
     targetSocket.setNoDelay(this.settings.noDelay);
-    
+
     // Apply keep-alive settings to the outgoing connection as well
     if (this.settings.keepAlive) {
       targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-      
+
       // Apply enhanced TCP keep-alive options if enabled
       if (this.settings.enableKeepAliveProbes) {
         try {
@@ -585,7 +631,9 @@ export class PortProxy {
         } catch (err) {
           // Ignore errors - these are optional enhancements
           if (this.settings.enableDetailedLogging) {
-            console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`);
+            console.log(
+              `[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
+            );
           }
         }
       }
@@ -642,19 +690,21 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on incoming keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
         // Don't close the connection - just log
         return;
       }
-      
+
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs(
-          this.settings.socketTimeout || 3600000
-        )}`
+        `[${connectionId}] Timeout on incoming side from ${
+          record.remoteIP
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.incomingTerminationReason === null) {
         record.incomingTerminationReason = 'timeout';
@@ -667,19 +717,21 @@ export class PortProxy {
       // For keep-alive connections, just log a warning instead of closing
       if (record.hasKeepAlive) {
         console.log(
-          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs(
+          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${
+            record.remoteIP
+          } after ${plugins.prettyMs(
             this.settings.socketTimeout || 3600000
           )}. Connection preserved.`
         );
         // Don't close the connection - just log
         return;
       }
-      
+
       // For non-keep-alive connections, proceed with normal cleanup
       console.log(
-        `[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs(
-          this.settings.socketTimeout || 3600000
-        )}`
+        `[${connectionId}] Timeout on outgoing side from ${
+          record.remoteIP
+        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
       );
       if (record.outgoingTerminationReason === null) {
         record.outgoingTerminationReason = 'timeout';
@@ -693,9 +745,11 @@ export class PortProxy {
       // Disable timeouts completely for immortal connections
       socket.setTimeout(0);
       targetSocket.setTimeout(0);
-      
+
       if (this.settings.enableDetailedLogging) {
-        console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`);
+        console.log(
+          `[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
+        );
       }
     } else {
       // Set normal timeouts for other connections
@@ -725,9 +779,7 @@ export class PortProxy {
         const combinedData = Buffer.concat(record.pendingData);
         targetSocket.write(combinedData, (err) => {
           if (err) {
-            console.log(
-              `[${connectionId}] Error writing pending data to target: ${err.message}`
-            );
+            console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
             return this.initiateCleanupOnce(record, 'write_error');
           }
 
@@ -746,7 +798,9 @@ export class PortProxy {
                     ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                     : ''
                 }` +
-                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+                ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                  record.hasKeepAlive ? 'Yes' : 'No'
+                }`
             );
           } else {
             console.log(
@@ -777,7 +831,9 @@ export class PortProxy {
                   ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
                   : ''
               }` +
-              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}`
+              ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+                record.hasKeepAlive ? 'Yes' : 'No'
+              }`
           );
         } else {
           console.log(
@@ -797,82 +853,104 @@ export class PortProxy {
       record.pendingData = [];
       record.pendingDataSize = 0;
 
-      // Add the renegotiation listener for SNI validation
+      // Add the renegotiation handler for SNI validation with strict domain enforcement
       if (serverName) {
-        socket.on('data', (renegChunk: Buffer) => {
-          if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+        // Define a handler for checking renegotiation with improved detection
+        const renegotiationHandler = (renegChunk: Buffer) => {
+          // Only process if this looks like a TLS ClientHello
+          if (isClientHello(renegChunk)) {
             try {
-              // Try to extract SNI from potential renegotiation
+              // Extract SNI from ClientHello
               const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
-              if (newSNI && newSNI !== record.lockedDomain) {
+
+              // Skip if no SNI was found
+              if (!newSNI) return;
+
+              // Handle SNI change during renegotiation - always terminate for domain switches
+              if (newSNI !== record.lockedDomain) {
+                // Log and terminate the connection for any SNI change
                 console.log(
-                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. Terminating connection.`
+                  `[${connectionId}] Renegotiation with different SNI: ${record.lockedDomain} -> ${newSNI}. ` +
+                  `Terminating connection - SNI domain switching is not allowed.`
                 );
                 this.initiateCleanupOnce(record, 'sni_mismatch');
-              } else if (newSNI && this.settings.enableDetailedLogging) {
+              } else if (this.settings.enableDetailedLogging) {
                 console.log(
-                  `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
+                  `[${connectionId}] Renegotiation detected with same SNI: ${newSNI}. Allowing.`
                 );
               }
             } catch (err) {
               console.log(
-                `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
+                `[${connectionId}] Error processing ClientHello: ${err}. Allowing connection to continue.`
               );
             }
           }
-        });
+        };
+
+        // Store the handler in the connection record so we can remove it during cleanup
+        record.renegotiationHandler = renegotiationHandler;
+
+        // Add the listener
+        socket.on('data', renegotiationHandler);
       }
 
       // Set connection timeout with simpler logic
       if (record.cleanupTimer) {
         clearTimeout(record.cleanupTimer);
       }
-      
+
       // For immortal keep-alive connections, skip setting a timeout completely
       if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`);
+          console.log(
+            `[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
+          );
         }
         // No cleanup timer for immortal connections
-      } 
+      }
       // For extended keep-alive connections, use extended timeout
       else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
         const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
         const safeTimeout = ensureSafeTimeout(extendedTimeout);
-        
+
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs(
-              extendedTimeout
-            )}), forcing cleanup.`
+            `[${connectionId}] Keep-alive connection from ${
+              record.remoteIP
+            } exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
           );
           this.initiateCleanupOnce(record, 'extended_lifetime');
         }, safeTimeout);
-        
+
         // Make sure timeout doesn't keep the process alive
         if (record.cleanupTimer.unref) {
           record.cleanupTimer.unref();
         }
-        
+
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`);
+          console.log(
+            `[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
+              extendedTimeout
+            )}`
+          );
         }
       }
       // For standard connections, use normal timeout
       else {
         // Use domain-specific timeout if available, otherwise use default
-        const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
+        const connectionTimeout =
+          record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
         const safeTimeout = ensureSafeTimeout(connectionTimeout);
-        
+
         record.cleanupTimer = setTimeout(() => {
           console.log(
-            `[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs(
-              connectionTimeout
-            )}), forcing cleanup.`
+            `[${connectionId}] Connection from ${
+              record.remoteIP
+            } exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
           );
           this.initiateCleanupOnce(record, 'connection_timeout');
         }, safeTimeout);
-        
+
         // Make sure timeout doesn't keep the process alive
         if (record.cleanupTimer.unref) {
           record.cleanupTimer.unref();
@@ -973,6 +1051,16 @@ export class PortProxy {
       const bytesReceived = record.bytesReceived;
       const bytesSent = record.bytesSent;
 
+      // Remove the renegotiation handler if present
+      if (record.renegotiationHandler && record.incoming) {
+        try {
+          record.incoming.removeListener('data', record.renegotiationHandler);
+          record.renegotiationHandler = undefined;
+        } catch (err) {
+          console.log(`[${record.id}] Error removing renegotiation handler: ${err}`);
+        }
+      }
+
       try {
         if (!record.incoming.destroyed) {
           // Try graceful shutdown first, then force destroy after a short timeout
@@ -1047,8 +1135,11 @@ export class PortProxy {
             ` Duration: ${plugins.prettyMs(
               duration
             )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
-            `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
+            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
+              record.hasKeepAlive ? 'Yes' : 'No'
+            }` +
+            `${record.usingNetworkProxy ? ', Using NetworkProxy' : ''}` +
+            `${record.domainSwitches ? `, Domain switches: ${record.domainSwitches}` : ''}`
         );
       } else {
         console.log(
@@ -1063,7 +1154,7 @@ export class PortProxy {
    */
   private updateActivity(record: IConnectionRecord): void {
     record.lastActivity = Date.now();
-    
+
     // Clear any inactivity warning
     if (record.inactivityWarningIssued) {
       record.inactivityWarningIssued = false;
@@ -1082,7 +1173,7 @@ export class PortProxy {
     }
     return this.settings.targetIP!;
   }
-  
+
   /**
    * Initiates cleanup once for a connection
    */
@@ -1090,12 +1181,15 @@ export class PortProxy {
     if (this.settings.enableDetailedLogging) {
       console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
     }
-    
-    if (record.incomingTerminationReason === null || record.incomingTerminationReason === undefined) {
+
+    if (
+      record.incomingTerminationReason === null ||
+      record.incomingTerminationReason === undefined
+    ) {
       record.incomingTerminationReason = reason;
       this.incrementTerminationStat('incoming', reason);
     }
-    
+
     this.cleanupConnection(record, reason);
   }
 
@@ -1184,6 +1278,12 @@ export class PortProxy {
       return;
     }
 
+    // Start NetworkProxy if configured
+    if (this.networkProxy) {
+      await this.networkProxy.start();
+      console.log(`NetworkProxy started on port ${this.settings.networkProxyPort}`);
+    }
+
     // Define a unified connection handler for all listening ports.
     const connectionHandler = (socket: plugins.net.Socket) => {
       if (this.isShuttingDown) {
@@ -1219,7 +1319,7 @@ export class PortProxy {
 
       // Apply socket optimizations
       socket.setNoDelay(this.settings.noDelay);
-      
+
       // Create a unique connection ID and record
       const connectionId = generateConnectionId();
       const connectionRecord: IConnectionRecord = {
@@ -1243,16 +1343,20 @@ export class PortProxy {
         hasKeepAlive: false, // Will set to true if keep-alive is applied
         incomingTerminationReason: null,
         outgoingTerminationReason: null,
-        
-        // Initialize NetworkProxy tracking fields
-        usingNetworkProxy: false
+
+        // Initialize NetworkProxy tracking
+        usingNetworkProxy: false,
+
+        // Initialize browser connection tracking
+        isBrowserConnection: false,
+        domainSwitches: 0, 
       };
-      
+
       // Apply keep-alive settings if enabled
       if (this.settings.keepAlive) {
         socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
         connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
-        
+
         // Apply enhanced TCP keep-alive options if enabled
         if (this.settings.enableKeepAliveProbes) {
           try {
@@ -1266,7 +1370,9 @@ export class PortProxy {
           } catch (err) {
             // Ignore errors - these are optional enhancements
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`);
+              console.log(
+                `[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
+              );
             }
           }
         }
@@ -1279,8 +1385,8 @@ export class PortProxy {
       if (this.settings.enableDetailedLogging) {
         console.log(
           `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
-          `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
-          `Active connections: ${this.connectionRecords.size}`
+            `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
+            `Active connections: ${this.connectionRecords.size}`
         );
       } else {
         console.log(
@@ -1288,23 +1394,16 @@ export class PortProxy {
         );
       }
 
-      let initialDataReceived = false;
+      // Check if this connection should be forwarded directly to NetworkProxy based on port
+      const shouldUseNetworkProxy = this.settings.useNetworkProxy && 
+                                    this.settings.useNetworkProxy.includes(localPort);
 
-      // Define helpers for rejecting connections
-      const rejectIncomingConnection = (reason: string, logMessage: string) => {
-        console.log(`[${connectionId}] ${logMessage}`);
-        socket.end();
-        if (connectionRecord.incomingTerminationReason === null) {
-          connectionRecord.incomingTerminationReason = reason;
-          this.incrementTerminationStat('incoming', reason);
-        }
-        this.cleanupConnection(connectionRecord, reason);
-      };
+      if (shouldUseNetworkProxy) {
+        // For NetworkProxy ports, we want to capture the TLS handshake and forward directly
+        let initialDataReceived = false;
 
-      // Set an initial timeout for SNI data if needed
-      let initialTimeout: NodeJS.Timeout | null = null;
-      if (this.settings.sniEnabled) {
-        initialTimeout = setTimeout(() => {
+        // Set an initial timeout for handshake data
+        let initialTimeout: NodeJS.Timeout | null = setTimeout(() => {
           if (!initialDataReceived) {
             console.log(
               `[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
@@ -1322,278 +1421,331 @@ export class PortProxy {
         if (initialTimeout.unref) {
           initialTimeout.unref();
         }
-      } else {
-        initialDataReceived = true;
-        connectionRecord.hasReceivedInitialData = true;
-      }
 
-      socket.on('error', this.handleError('incoming', connectionRecord));
+        socket.on('error', this.handleError('incoming', connectionRecord));
 
-      // Track data for bytes counting
-      socket.on('data', (chunk: Buffer) => {
-        connectionRecord.bytesReceived += chunk.length;
-        this.updateActivity(connectionRecord);
+        // First data handler to capture initial TLS handshake for NetworkProxy
+        socket.once('data', (chunk: Buffer) => {
+          // Clear the initial timeout since we've received data
+          if (initialTimeout) {
+            clearTimeout(initialTimeout);
+            initialTimeout = null;
+          }
 
-        // Check for TLS handshake if this is the first chunk
-        if (!connectionRecord.isTLS && isTlsHandshake(chunk)) {
-          connectionRecord.isTLS = true;
+          initialDataReceived = true;
+          connectionRecord.hasReceivedInitialData = true;
 
-          if (this.settings.enableTlsDebugLogging) {
-            console.log(
-              `[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
-            );
-            // Try to extract SNI and log detailed debug info
-            extractSNI(chunk, true);
+          // Check if this looks like a TLS handshake
+          if (isTlsHandshake(chunk)) {
+            connectionRecord.isTLS = true;
+            
+            // Forward directly to NetworkProxy without SNI processing
+            this.forwardToNetworkProxy(connectionId, socket, connectionRecord, chunk);
+          } else {
+            // If not TLS, use normal direct connection
+            console.log(`[${connectionId}] Non-TLS connection on NetworkProxy port ${localPort}`);
+            this.setupDirectConnection(connectionId, socket, connectionRecord, undefined, undefined, chunk);
           }
-        }
-      });
-
-      /**
-       * Sets up the connection to the target host or NetworkProxy.
-       * @param serverName - The SNI hostname (unused when forcedDomain is provided).
-       * @param initialChunk - Optional initial data chunk.
-       * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
-       * @param overridePort - If provided, use this port for the outgoing connection.
-       */
-      const setupConnection = (
-        serverName: string,
-        initialChunk?: Buffer,
-        forcedDomain?: IDomainConfig,
-        overridePort?: number
-      ) => {
-        // Clear the initial timeout since we've received data
-        if (initialTimeout) {
-          clearTimeout(initialTimeout);
-          initialTimeout = null;
-        }
+        });
+        
+      } else {
+        // For non-NetworkProxy ports, proceed with normal processing
+
+        // Define helpers for rejecting connections
+        const rejectIncomingConnection = (reason: string, logMessage: string) => {
+          console.log(`[${connectionId}] ${logMessage}`);
+          socket.end();
+          if (connectionRecord.incomingTerminationReason === null) {
+            connectionRecord.incomingTerminationReason = reason;
+            this.incrementTerminationStat('incoming', reason);
+          }
+          this.cleanupConnection(connectionRecord, reason);
+        };
 
-        // Mark that we've received initial data
-        initialDataReceived = true;
-        connectionRecord.hasReceivedInitialData = true;
+        let initialDataReceived = false;
 
-        // Check if this looks like a TLS handshake
-        const isTlsHandshakeDetected = initialChunk && isTlsHandshake(initialChunk);
-        if (isTlsHandshakeDetected) {
-          connectionRecord.isTLS = true;
+        // Set an initial timeout for SNI data if needed
+        let initialTimeout: NodeJS.Timeout | null = null;
+        if (this.settings.sniEnabled) {
+          initialTimeout = setTimeout(() => {
+            if (!initialDataReceived) {
+              console.log(
+                `[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
+              );
+              if (connectionRecord.incomingTerminationReason === null) {
+                connectionRecord.incomingTerminationReason = 'initial_timeout';
+                this.incrementTerminationStat('incoming', 'initial_timeout');
+              }
+              socket.end();
+              this.cleanupConnection(connectionRecord, 'initial_timeout');
+            }
+          }, this.settings.initialDataTimeout!);
 
-          if (this.settings.enableTlsDebugLogging) {
-            console.log(
-              `[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`
-            );
+          // Make sure timeout doesn't keep the process alive
+          if (initialTimeout.unref) {
+            initialTimeout.unref();
           }
+        } else {
+          initialDataReceived = true;
+          connectionRecord.hasReceivedInitialData = true;
         }
 
-        // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
-        const domainConfig = forcedDomain
-          ? forcedDomain
-          : serverName
-          ? this.settings.domainConfigs.find((config) =>
-              config.domains.some((d) => plugins.minimatch(serverName, d))
-            )
-          : undefined;
-
-        // Save domain config in connection record
-        connectionRecord.domainConfig = domainConfig;
-
-        // IP validation is skipped if allowedIPs is empty
-        if (domainConfig) {
-          const effectiveAllowedIPs: string[] = [
-            ...domainConfig.allowedIPs,
-            ...(this.settings.defaultAllowedIPs || []),
-          ];
-          const effectiveBlockedIPs: string[] = [
-            ...(domainConfig.blockedIPs || []),
-            ...(this.settings.defaultBlockedIPs || []),
-          ];
-
-          // Skip IP validation if allowedIPs is empty
-          if (
-            domainConfig.allowedIPs.length > 0 &&
-            !isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)
-          ) {
-            return rejectIncomingConnection(
-              'rejected',
-              `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(
-                ', '
-              )}`
-            );
-          }
-          
-          // Check if we should forward this to a NetworkProxy
-          if (
-            isTlsHandshakeDetected && 
-            domainConfig.useNetworkProxy === true && 
-            initialChunk && 
-            this.networkProxies.length > 0
-          ) {
-            return this.forwardToNetworkProxy(
-              connectionId,
-              socket,
-              connectionRecord,
-              domainConfig,
-              initialChunk,
-              serverName
-            );
+        socket.on('error', this.handleError('incoming', connectionRecord));
+
+        // Track data for bytes counting
+        socket.on('data', (chunk: Buffer) => {
+          connectionRecord.bytesReceived += chunk.length;
+          this.updateActivity(connectionRecord);
+
+          // Check for TLS handshake if this is the first chunk
+          if (!connectionRecord.isTLS && isTlsHandshake(chunk)) {
+            connectionRecord.isTLS = true;
+
+            if (this.settings.enableTlsDebugLogging) {
+              console.log(
+                `[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
+              );
+              // Try to extract SNI and log detailed debug info
+              extractSNI(chunk, true);
+            }
           }
-        } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
-          if (
-            !isGlobIPAllowed(
-              remoteIP,
-              this.settings.defaultAllowedIPs,
-              this.settings.defaultBlockedIPs || []
-            )
-          ) {
-            return rejectIncomingConnection(
-              'rejected',
-              `Connection rejected: IP ${remoteIP} not allowed by default allowed list`
-            );
+        });
+
+        /**
+         * Sets up the connection to the target host.
+         * @param serverName - The SNI hostname (unused when forcedDomain is provided).
+         * @param initialChunk - Optional initial data chunk.
+         * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
+         * @param overridePort - If provided, use this port for the outgoing connection.
+         */
+        const setupConnection = (
+          serverName: string,
+          initialChunk?: Buffer,
+          forcedDomain?: IDomainConfig,
+          overridePort?: number
+        ) => {
+          // Clear the initial timeout since we've received data
+          if (initialTimeout) {
+            clearTimeout(initialTimeout);
+            initialTimeout = null;
           }
-        }
 
-        // If we didn't forward to NetworkProxy, proceed with direct connection
-        return this.setupDirectConnection(
-          connectionId,
-          socket,
-          connectionRecord,
-          domainConfig,
-          serverName,
-          initialChunk,
-          overridePort
-        );
-      };
+          // Mark that we've received initial data
+          initialDataReceived = true;
+          connectionRecord.hasReceivedInitialData = true;
 
-      // --- PORT RANGE-BASED HANDLING ---
-      // Only apply port-based rules if the incoming port is within one of the global port ranges.
-      if (
-        this.settings.globalPortRanges &&
-        isPortInRanges(localPort, this.settings.globalPortRanges)
-      ) {
-        if (this.settings.forwardAllGlobalRanges) {
-          if (
-            this.settings.defaultAllowedIPs &&
-            this.settings.defaultAllowedIPs.length > 0 &&
-            !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
-          ) {
-            console.log(
-              `[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`
-            );
-            socket.end();
-            return;
-          }
-          if (this.settings.enableDetailedLogging) {
-            console.log(
-              `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
-            );
+          // Check if this looks like a TLS handshake
+          const isTlsHandshakeDetected = initialChunk && isTlsHandshake(initialChunk);
+          if (isTlsHandshakeDetected) {
+            connectionRecord.isTLS = true;
+
+            if (this.settings.enableTlsDebugLogging) {
+              console.log(
+                `[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`
+              );
+            }
           }
-          setupConnection(
-            '',
-            undefined,
-            {
-              domains: ['global'],
-              allowedIPs: this.settings.defaultAllowedIPs || [],
-              blockedIPs: this.settings.defaultBlockedIPs || [],
-              targetIPs: [this.settings.targetIP!],
-              portRanges: [],
-            },
-            localPort
-          );
-          return;
-        } else {
-          // Attempt to find a matching forced domain config based on the local port.
-          const forcedDomain = this.settings.domainConfigs.find(
-            (domain) =>
-              domain.portRanges &&
-              domain.portRanges.length > 0 &&
-              isPortInRanges(localPort, domain.portRanges)
-          );
-          if (forcedDomain) {
+
+          // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
+          const domainConfig = forcedDomain
+            ? forcedDomain
+            : serverName
+            ? this.settings.domainConfigs.find((config) =>
+                config.domains.some((d) => plugins.minimatch(serverName, d))
+              )
+            : undefined;
+
+          // Save domain config in connection record
+          connectionRecord.domainConfig = domainConfig;
+
+          // IP validation is skipped if allowedIPs is empty
+          if (domainConfig) {
             const effectiveAllowedIPs: string[] = [
-              ...forcedDomain.allowedIPs,
+              ...domainConfig.allowedIPs,
               ...(this.settings.defaultAllowedIPs || []),
             ];
             const effectiveBlockedIPs: string[] = [
-              ...(forcedDomain.blockedIPs || []),
+              ...(domainConfig.blockedIPs || []),
               ...(this.settings.defaultBlockedIPs || []),
             ];
-            if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
-              console.log(
-                `[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(
+
+            // Skip IP validation if allowedIPs is empty
+            if (
+              domainConfig.allowedIPs.length > 0 &&
+              !isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)
+            ) {
+              return rejectIncomingConnection(
+                'rejected',
+                `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(
                   ', '
-                )} on port ${localPort}.`
+                )}`
+              );
+            }
+          } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
+            if (
+              !isGlobIPAllowed(
+                remoteIP,
+                this.settings.defaultAllowedIPs,
+                this.settings.defaultBlockedIPs || []
+              )
+            ) {
+              return rejectIncomingConnection(
+                'rejected',
+                `Connection rejected: IP ${remoteIP} not allowed by default allowed list`
+              );
+            }
+          }
+
+          // Save the initial SNI
+          if (serverName) {
+            connectionRecord.lockedDomain = serverName;
+          }
+
+          // Set up the direct connection
+          return this.setupDirectConnection(
+            connectionId,
+            socket,
+            connectionRecord,
+            domainConfig,
+            serverName,
+            initialChunk,
+            overridePort
+          );
+        };
+
+        // --- PORT RANGE-BASED HANDLING ---
+        // Only apply port-based rules if the incoming port is within one of the global port ranges.
+        if (
+          this.settings.globalPortRanges &&
+          isPortInRanges(localPort, this.settings.globalPortRanges)
+        ) {
+          if (this.settings.forwardAllGlobalRanges) {
+            if (
+              this.settings.defaultAllowedIPs &&
+              this.settings.defaultAllowedIPs.length > 0 &&
+              !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
+            ) {
+              console.log(
+                `[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`
               );
               socket.end();
               return;
             }
             if (this.settings.enableDetailedLogging) {
               console.log(
-                `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(
-                  ', '
-                )}.`
+                `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
               );
             }
-            setupConnection('', undefined, forcedDomain, localPort);
+            setupConnection(
+              '',
+              undefined,
+              {
+                domains: ['global'],
+                allowedIPs: this.settings.defaultAllowedIPs || [],
+                blockedIPs: this.settings.defaultBlockedIPs || [],
+                targetIPs: [this.settings.targetIP!],
+                portRanges: [],
+              },
+              localPort
+            );
             return;
+          } else {
+            // Attempt to find a matching forced domain config based on the local port.
+            const forcedDomain = this.settings.domainConfigs.find(
+              (domain) =>
+                domain.portRanges &&
+                domain.portRanges.length > 0 &&
+                isPortInRanges(localPort, domain.portRanges)
+            );
+            if (forcedDomain) {
+              const effectiveAllowedIPs: string[] = [
+                ...forcedDomain.allowedIPs,
+                ...(this.settings.defaultAllowedIPs || []),
+              ];
+              const effectiveBlockedIPs: string[] = [
+                ...(forcedDomain.blockedIPs || []),
+                ...(this.settings.defaultBlockedIPs || []),
+              ];
+              if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
+                console.log(
+                  `[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(
+                    ', '
+                  )} on port ${localPort}.`
+                );
+                socket.end();
+                return;
+              }
+              if (this.settings.enableDetailedLogging) {
+                console.log(
+                  `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(
+                    ', '
+                  )}.`
+                );
+              }
+              setupConnection('', undefined, forcedDomain, localPort);
+              return;
+            }
+            // Fall through to SNI/default handling if no forced domain config is found.
           }
-          // Fall through to SNI/default handling if no forced domain config is found.
         }
-      }
 
-      // --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
-      if (this.settings.sniEnabled) {
-        initialDataReceived = false;
+        // --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
+        if (this.settings.sniEnabled) {
+          initialDataReceived = false;
 
-        socket.once('data', (chunk: Buffer) => {
-          if (initialTimeout) {
-            clearTimeout(initialTimeout);
-            initialTimeout = null;
-          }
+          socket.once('data', (chunk: Buffer) => {
+            if (initialTimeout) {
+              clearTimeout(initialTimeout);
+              initialTimeout = null;
+            }
 
-          initialDataReceived = true;
+            initialDataReceived = true;
 
-          // Try to extract SNI
-          let serverName = '';
+            // Try to extract SNI
+            let serverName = '';
 
-          if (isTlsHandshake(chunk)) {
-            connectionRecord.isTLS = true;
+            if (isTlsHandshake(chunk)) {
+              connectionRecord.isTLS = true;
 
-            if (this.settings.enableTlsDebugLogging) {
+              if (this.settings.enableTlsDebugLogging) {
+                console.log(
+                  `[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`
+                );
+              }
+
+              serverName = extractSNI(chunk, this.settings.enableTlsDebugLogging) || '';
+            }
+
+            // Lock the connection to the negotiated SNI.
+            connectionRecord.lockedDomain = serverName;
+
+            if (this.settings.enableDetailedLogging) {
               console.log(
-                `[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`
+                `[${connectionId}] Received connection from ${remoteIP} with SNI: ${
+                  serverName || '(empty)'
+                }`
               );
             }
 
-            serverName = extractSNI(chunk, this.settings.enableTlsDebugLogging) || '';
-          }
-
-          // Lock the connection to the negotiated SNI.
-          connectionRecord.lockedDomain = serverName;
+            setupConnection(serverName, chunk);
+          });
+        } else {
+          initialDataReceived = true;
+          connectionRecord.hasReceivedInitialData = true;
 
-          if (this.settings.enableDetailedLogging) {
-            console.log(
-              `[${connectionId}] Received connection from ${remoteIP} with SNI: ${
-                serverName || '(empty)'
-              }`
+          if (
+            this.settings.defaultAllowedIPs &&
+            this.settings.defaultAllowedIPs.length > 0 &&
+            !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
+          ) {
+            return rejectIncomingConnection(
+              'rejected',
+              `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`
             );
           }
 
-          setupConnection(serverName, chunk);
-        });
-      } else {
-        initialDataReceived = true;
-        connectionRecord.hasReceivedInitialData = true;
-
-        if (
-          this.settings.defaultAllowedIPs &&
-          this.settings.defaultAllowedIPs.length > 0 &&
-          !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
-        ) {
-          return rejectIncomingConnection(
-            'rejected',
-            `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`
-          );
+          setupConnection('');
         }
-
-        setupConnection('');
       }
     };
 
@@ -1619,10 +1771,11 @@ export class PortProxy {
         console.log(`Server Error on port ${port}: ${err.message}`);
       });
       server.listen(port, () => {
+        const isNetworkProxyPort = this.settings.useNetworkProxy?.includes(port);
         console.log(
           `PortProxy -> OK: Now listening on port ${port}${
-            this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''
-          }${this.networkProxies.length > 0 ? ' (NetworkProxy integration enabled)' : ''}`
+            this.settings.sniEnabled && !isNetworkProxyPort ? ' (SNI passthrough enabled)' : ''
+          }${isNetworkProxyPort ? ' (NetworkProxy forwarding enabled)' : ''}`
         );
       });
       this.netServers.push(server);
@@ -1642,6 +1795,7 @@ export class PortProxy {
       let pendingTlsHandshakes = 0;
       let keepAliveConnections = 0;
       let networkProxyConnections = 0;
+      let domainSwitchedConnections = 0;
 
       // Create a copy of the keys to avoid modification during iteration
       const connectionIds = [...this.connectionRecords.keys()];
@@ -1661,20 +1815,23 @@ export class PortProxy {
         } else {
           nonTlsConnections++;
         }
-        
+
         if (record.hasKeepAlive) {
           keepAliveConnections++;
         }
-        
+
         if (record.usingNetworkProxy) {
           networkProxyConnections++;
         }
 
+        if (record.domainSwitches && record.domainSwitches > 0) {
+          domainSwitchedConnections++;
+        }
+
         maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
         if (record.outgoingStartTime) {
           maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
         }
-
         // Parity check: if outgoing socket closed and incoming remains active
         if (
           record.outgoingClosedTime &&
@@ -1706,35 +1863,38 @@ export class PortProxy {
         }
 
         // Skip inactivity check if disabled or for immortal keep-alive connections
-        if (!this.settings.disableInactivityCheck && 
-            !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')) {
-          
+        if (
+          !this.settings.disableInactivityCheck &&
+          !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
+        ) {
           const inactivityTime = now - record.lastActivity;
-          
+
           // Use extended timeout for extended-treatment keep-alive connections
           let effectiveTimeout = this.settings.inactivityTimeout!;
           if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
             const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
             effectiveTimeout = effectiveTimeout * multiplier;
           }
-          
+
           if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
             // For keep-alive connections, issue a warning first
             if (record.hasKeepAlive && !record.inactivityWarningIssued) {
               console.log(
-                `[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
-                `Will close in 10 minutes if no activity.`
+                `[${id}] Warning: Keep-alive connection from ${
+                  record.remoteIP
+                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
+                  `Will close in 10 minutes if no activity.`
               );
-              
+
               // Set warning flag and add grace period
               record.inactivityWarningIssued = true;
               record.lastActivity = now - (effectiveTimeout - 600000);
-              
+
               // Try to stimulate activity with a probe packet
               if (record.outgoing && !record.outgoing.destroyed) {
                 try {
                   record.outgoing.write(Buffer.alloc(0));
-                  
+
                   if (this.settings.enableDetailedLogging) {
                     console.log(`[${id}] Sent probe packet to test keep-alive connection`);
                   }
@@ -1746,15 +1906,17 @@ export class PortProxy {
               // For non-keep-alive or after warning, close the connection
               console.log(
                 `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
-                `for ${plugins.prettyMs(inactivityTime)}.` +
-                (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
+                  `for ${plugins.prettyMs(inactivityTime)}.` +
+                  (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
               );
               this.cleanupConnection(record, 'inactivity');
             }
           } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
             // If activity detected after warning, clear the warning
             if (this.settings.enableDetailedLogging) {
-              console.log(`[${id}] Connection activity detected after inactivity warning, resetting warning`);
+              console.log(
+                `[${id}] Connection activity detected after inactivity warning, resetting warning`
+              );
             }
             record.inactivityWarningIssued = false;
           }
@@ -1765,7 +1927,8 @@ export class PortProxy {
       console.log(
         `Active connections: ${this.connectionRecords.size}. ` +
           `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
-          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
+          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}, ` +
+          `DomainSwitched=${domainSwitchedConnections}. ` +
           `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
             maxOutgoing
           )}. ` +
@@ -1782,21 +1945,6 @@ export class PortProxy {
     }
   }
 
-  /**
-   * Add or replace NetworkProxy instances
-   */
-  public setNetworkProxies(networkProxies: NetworkProxy[]): void {
-    this.networkProxies = networkProxies;
-    console.log(`Updated NetworkProxy instances: ${this.networkProxies.length} proxies configured`);
-  }
-
-  /**
-   * Get a list of configured NetworkProxy instances
-   */
-  public getNetworkProxies(): NetworkProxy[] {
-    return this.networkProxies;
-  }
-
   /**
    * Gracefully shut down the proxy
    */
@@ -1888,6 +2036,16 @@ export class PortProxy {
       }
     }
 
+    // Stop NetworkProxy if it was started
+    if (this.networkProxy) {
+      try {
+        await this.networkProxy.stop();
+        console.log('NetworkProxy stopped successfully');
+      } catch (err) {
+        console.log(`Error stopping NetworkProxy: ${err}`);
+      }
+    }
+
     // Clear all tracking maps
     this.connectionRecords.clear();
     this.domainTargetIndices.clear();