ipv6-bridge 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,151 @@
+# IPv6 Bridge
+
+> Local DNS64/NAT64 proxy for IPv6-only networks — access IPv4 sites seamlessly.
+
+IPv4 addresses are exhausted globally. Many ISPs now deploy IPv6-only networks, but millions of websites still only support IPv4. IPv6 Bridge solves this by running a local proxy that translates traffic using DNS64 and NAT64 standards.
+
+## Features
+
+- **Zero dependencies** — pure Node.js, nothing to install
+- **Auto-detection** — starts only when needed (IPv6-only network with broken NAT64)
+- **HTTP & HTTPS** — full proxy support including CONNECT tunneling
+- **RFC compliant** — implements RFC 6052 (DNS64) and RFC 6146 (NAT64)
+- **Cross-platform** — works on Windows, macOS, and Linux
+- **Programmatic API** — use from your Node.js app or the CLI
+
+## Quick Start
+
+### CLI
+
+```bash
+npx ipv6-bridge start
+```
+
+The bridge auto-detects whether it's needed. To force it:
+
+```bash
+FORCE_BRIDGE=1 npx ipv6-bridge start
+```
+
+### Programmatic
+
+```javascript
+const { start, stop } = require('ipv6-bridge');
+
+const server = await start(8080);
+// → returns the server, or null if bridge isn't needed
+
+// Later:
+await stop();
+```
+
+### Install as a Dependency
+
+```bash
+npm install ipv6-bridge
+```
+
+## How It Works
+
+**The "Language Translator" Analogy**
+> Imagine you only speak English (IPv6), but you need to call a business in Japan where they only speak Japanese (IPv4). If you call them directly, you won't understand each other.
+> 
+> This project acts like a live, bilingual phone operator sitting right next to you. When you try to make the call, the software intercepts it, looks up the Japanese translation for the phone number (**DNS64**), and then acts as a middleman translating your English sentences into Japanese and back again in real-time (**NAT64 proxy**). The result is that you have a seamless conversation without even realizing a translation is happening.
+
+### Technical Flow
+
+```text
+Your App → HTTP request → IPv6 Bridge (localhost:8080)
+                               │
+                          DNS64 resolution
+                          example.com → 142.251.32.14 → 64:ff9b::8efb:200e
+                               │
+                          Outbound via IPv6
+                               │
+                          ISP NAT64 Gateway
+                               │
+                          IPv4 Internet (google.com)
+```
+
+1. **Detection** — checks if you're on an IPv6-only network
+2. **DNS64** — resolves hostnames; if only an IPv4 address exists, synthesizes an IPv6 address using the NAT64 prefix (`64:ff9b::`)
+3. **Proxy** — routes HTTP/HTTPS through IPv6; the ISP's NAT64 gateway translates to IPv4
+4. **Response** — data flows back through the same path, transparently
+
+For a deep dive, see [ARCHITECTURE.md](ARCHITECTURE.md).
+
+## Configuration
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `IPV6_BRIDGE_PORT` | `8080` | Proxy listen port |
+| `FORCE_BRIDGE` | _(unset)_ | Start even if not needed |
+| `NAT64_PREFIX` | `64:ff9b::` | Custom NAT64 prefix |
+
+## API
+
+### `start(port?): Promise<http.Server | null>`
+
+Starts the proxy. Returns the server instance, or `null` if the bridge isn't needed.
+
+### `stop(): Promise<void>`
+
+Stops the running bridge.
+
+See [docs/API.md](docs/API.md) for the full API reference.
+
+## Testing
+
+```bash
+npm test
+```
+
+### Demo Application
+
+An interactive diagnostics tool:
+
+```bash
+cd demo-app && npm start
+# Open http://localhost:3000
+```
+
+### Dual-Stack Test Server
+
+Test IPv4 and IPv6 endpoints with real-time logging:
+
+```bash
+cd test-server && node server.js
+```
+
+See [test-server/README.md](test-server/README.md) for details.
+
+## Project Structure
+
+```
+src/
+  cli.js        CLI entry point
+  config.js     Configuration constants
+  detect.js     Network detection
+  dns64.js      DNS64 resolver
+  index.js      Public API (start/stop)
+  proxy.js      HTTP/HTTPS proxy
+tests/          Test suite
+demo-app/       Interactive demo
+test-server/    Dual-stack test server
+examples/       Usage examples
+docs/           Extended documentation
+```
+
+## Standards
+
+- [RFC 6052](https://tools.ietf.org/html/rfc6052) — IPv6 Addressing of IPv4/IPv6 Translators
+- [RFC 6146](https://tools.ietf.org/html/rfc6146) — Stateful NAT64
+- [RFC 6147](https://tools.ietf.org/html/rfc6147) — DNS64
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE)

package/examples/basic-usage.js

@@ -0,0 +1,38 @@
+/**
+ * IPv6 Bridge — Basic Usage Example
+ *
+ * Demonstrates how to integrate IPv6 Bridge into a Node.js application.
+ *
+ * Run:
+ *   node examples/basic-usage.js
+ */
+
+const { start, stop } = require('../src/index');
+
+async function main() {
+  try {
+    console.log('Starting IPv6 Bridge...\n');
+    const server = await start(8080);
+
+    if (server) {
+      const addr = server.address();
+      console.log(`Bridge started on port ${addr.port}`);
+      console.log(`Configure your browser/system proxy to localhost:${addr.port}\n`);
+      console.log('Press Ctrl+C to stop.\n');
+
+      process.on('SIGINT', async () => {
+        console.log('\nShutting down...');
+        await stop();
+        process.exit(0);
+      });
+    } else {
+      console.log('Bridge not needed — you have IPv4 connectivity or working NAT64.');
+      process.exit(0);
+    }
+  } catch (error) {
+    console.error('Error:', error.message);
+    process.exit(1);
+  }
+}
+
+main();

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "ipv6-bridge",
+  "version": "1.0.0",
+  "description": "Local DNS64/NAT64 proxy for IPv6-only networks — access IPv4 sites from IPv6-only environments",
+  "type": "commonjs",
+  "main": "src/index.js",
+  "bin": {
+    "ipv6-bridge": "src/cli.js"
+  },
+  "scripts": {
+    "start": "node src/cli.js start",
+    "test": "node --test tests/*.test.js",
+    "demo": "cd demo-app && npm install && npm start",
+    "prepublishOnly": "npm test"
+  },
+  "keywords": [
+    "ipv6",
+    "ipv4",
+    "nat64",
+    "dns64",
+    "proxy",
+    "networking",
+    "bridge",
+    "translation",
+    "connectivity",
+    "http-proxy",
+    "https-proxy"
+  ],
+  "author": "CS Hari Krishna <csharikrishna1806@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/csharikrishna/ipv6-bridge.git"
+  },
+  "bugs": {
+    "url": "https://github.com/csharikrishna/ipv6-bridge/issues"
+  },
+  "homepage": "https://github.com/csharikrishna/ipv6-bridge#readme",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "src/",
+    "examples/",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "dependencies": {}
+}

package/src/cli.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * IPv6 Bridge - Command-Line Interface
+ *
+ * Usage:
+ *   npx ipv6-bridge start          Start the bridge (auto-detects if needed)
+ *   npx ipv6-bridge --help         Show this help message
+ *   npx ipv6-bridge --version      Show version
+ *
+ * Environment variables:
+ *   IPV6_BRIDGE_PORT=<port>        Port to listen on (default: 8080)
+ *   FORCE_BRIDGE=1                 Start even if bridge is not needed
+ *   NAT64_PREFIX=<prefix>          Custom NAT64 prefix (default: 64:ff9b::)
+ *
+ * Stop the bridge with Ctrl+C or SIGTERM.
+ *
+ * @file CLI entry point for IPv6 Bridge
+ */
+
+const { start, stop } = require('./index');
+const { DEFAULT_PORT } = require('./config');
+const { version } = require('../package.json');
+
+const HELP_TEXT = `
+IPv6 Bridge v${version}
+Local DNS64/NAT64 proxy for IPv6-only networks.
+
+Usage:
+  ipv6-bridge start           Start the bridge proxy
+  ipv6-bridge --help, -h      Show this help message
+  ipv6-bridge --version, -v   Show version number
+
+Environment variables:
+  IPV6_BRIDGE_PORT             Port to listen on (default: ${DEFAULT_PORT})
+  FORCE_BRIDGE                 Set to any value to force start
+  NAT64_PREFIX                 Custom NAT64 prefix (default: 64:ff9b::)
+
+Stop the bridge with Ctrl+C or by sending SIGTERM.
+`.trim();
+
+const command = process.argv[2];
+const port = process.env.IPV6_BRIDGE_PORT
+  ? parseInt(process.env.IPV6_BRIDGE_PORT, 10)
+  : DEFAULT_PORT;
+
+if (command === '--help' || command === '-h' || !command) {
+  console.log(HELP_TEXT);
+  process.exit(0);
+}
+
+if (command === '--version' || command === '-v') {
+  console.log(version);
+  process.exit(0);
+}
+
+if (command === 'start') {
+  if (Number.isNaN(port) || port < 1 || port > 65535) {
+    console.error(`Error: Invalid port "${process.env.IPV6_BRIDGE_PORT}". Must be 1-65535.`);
+    process.exit(1);
+  }
+
+  start(port)
+    .then((server) => {
+      if (!server) {
+        process.exit(0);
+      }
+      console.log(`\nIPv6 Bridge running on http://localhost:${port}`);
+      console.log(`Configure your browser/system proxy to localhost:${port}\n`);
+    })
+    .catch((err) => {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    });
+
+  // Graceful shutdown on SIGINT (Ctrl+C) and SIGTERM (container/daemon stop)
+  function shutdown() {
+    console.log('\nStopping IPv6 Bridge...');
+    stop().then(() => process.exit(0));
+  }
+
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+
+  // Catch unhandled errors to prevent silent crashes
+  process.on('uncaughtException', (err) => {
+    console.error('Uncaught exception:', err.message);
+    stop().then(() => process.exit(1));
+  });
+
+  process.on('unhandledRejection', (reason) => {
+    console.error('Unhandled rejection:', reason);
+    stop().then(() => process.exit(1));
+  });
+} else {
+  console.error(`Unknown command: "${command}"\n`);
+  console.log(HELP_TEXT);
+  process.exit(1);
+}

package/src/config.js

@@ -0,0 +1,42 @@
+/**
+ * IPv6 Bridge - Configuration
+ *
+ * RFC 6052 Well-Known NAT64 Prefix and network test constants.
+ * All values can be overridden via environment variables.
+ *
+ * @module config
+ */
+
+module.exports = {
+  /**
+   * NAT64 Prefix (RFC 6052)
+   *
+   * The well-known prefix used to synthesize IPv6 addresses from IPv4.
+   * Override with the NAT64_PREFIX environment variable if your ISP
+   * uses a non-standard prefix.
+   *
+   * Example: 192.0.2.1 → 64:ff9b::c000:0201
+   *
+   * @see https://tools.ietf.org/html/rfc6052#section-2.1
+   */
+  NAT64_PREFIX: process.env.NAT64_PREFIX || '64:ff9b::',
+
+  /**
+   * Default port for the proxy server.
+   * Override with the IPV6_BRIDGE_PORT environment variable.
+   */
+  DEFAULT_PORT: 8080,
+
+  /**
+   * Test URL for IPv6 connectivity detection.
+   * Must be a server with IPv6 support.
+   */
+  IPV6_GOOGLE: 'http://ipv6.google.com',
+
+  /**
+   * Hostname for NAT64 availability testing.
+   * An IPv4-only hostname that should be reachable via NAT64
+   * if the ISP gateway is properly configured.
+   */
+  IPV4_GOOGLE: 'ipv4.google.com',
+};

package/src/detect.js

@@ -0,0 +1,77 @@
+/**
+ * IPv6 Bridge - Network Detection
+ *
+ * Detects whether the system is on an IPv6-only network and whether
+ * the bridge is needed to reach IPv4-only servers.
+ *
+ * @module detect
+ */
+
+const http = require('http');
+const { resolveIPv6 } = require('./dns64');
+const { IPV6_GOOGLE, IPV4_GOOGLE } = require('./config');
+
+/**
+ * Test if the network has IPv6 connectivity.
+ *
+ * Connects to an IPv6-capable server to verify that IPv6 is available.
+ *
+ * @returns {Promise<boolean>} true if IPv6 is available
+ */
+async function hasIPv6() {
+  return new Promise((resolve) => {
+    const req = http.get(IPV6_GOOGLE, { family: 6 }, (res) => {
+      // Consume response body to free resources
+      res.resume();
+      resolve(res.statusCode === 200);
+    });
+    req.on('error', () => resolve(false));
+    req.setTimeout(5000, () => {
+      req.destroy();
+      resolve(false);
+    });
+  });
+}
+
+/**
+ * Determine if the bridge is needed.
+ *
+ * The bridge is needed when:
+ * 1. IPv6 is available, AND
+ * 2. IPv4 servers are NOT reachable via the ISP's NAT64 gateway
+ *
+ * @returns {Promise<boolean>} true if bridge is needed
+ */
+async function needsBridge() {
+  const hasV6 = await hasIPv6();
+  if (!hasV6) {
+    // No IPv6 means we're on IPv4 or a broken network.
+    // Either way, the bridge can't help.
+    return false;
+  }
+
+  try {
+    const ipv6 = await resolveIPv6(IPV4_GOOGLE);
+    if (!ipv6 || ipv6.length === 0) {
+      return true;
+    }
+
+    // Try connecting to the synthesized IPv6 address.
+    // If this works, the ISP has a working NAT64 gateway.
+    return new Promise((resolve) => {
+      const req = http.get(`http://[${ipv6[0]}]`, { family: 6 }, (res) => {
+        res.resume();
+        resolve(res.statusCode !== 200);
+      });
+      req.on('error', () => resolve(true));
+      req.setTimeout(5000, () => {
+        req.destroy();
+        resolve(true);
+      });
+    });
+  } catch {
+    return true;
+  }
+}
+
+module.exports = { hasIPv6, needsBridge };

package/src/dns64.js

@@ -0,0 +1,90 @@
+/**
+ * IPv6 Bridge - DNS64 Resolver
+ *
+ * Implements DNS64 (RFC 6052) for synthesizing IPv6 addresses from IPv4.
+ *
+ * @module dns64
+ */
+
+const dns = require('dns').promises;
+const { NAT64_PREFIX } = require('./config');
+
+/**
+ * Detect the IP version of an address string.
+ *
+ * @param {string} addr - Address or hostname to check
+ * @returns {'ipv4'|'ipv6'|'hostname'|null} Address type
+ */
+function detectIPVersion(addr) {
+  if (!addr) return null;
+
+  // IPv4: dotted decimal (0-255 per octet)
+  if (/^(\d{1,3}\.){3}\d{1,3}$/.test(addr)) {
+    const parts = addr.split('.').map(Number);
+    if (parts.every((p) => p >= 0 && p <= 255)) {
+      return 'ipv4';
+    }
+  }
+
+  // IPv6: colon-delimited hex (includes :: shorthand)
+  if (/^[a-f0-9:]+$/i.test(addr) && addr.includes(':')) {
+    return 'ipv6';
+  }
+
+  // Everything else is a hostname
+  return 'hostname';
+}
+
+/**
+ * Convert an IPv4 address to IPv6 using the NAT64 prefix (RFC 6052).
+ *
+ * The IPv4 address is embedded in the lower 32 bits of the IPv6 address:
+ *   192.0.2.1 → 64:ff9b::c000:0201
+ *
+ * @param {string} ipv4 - IPv4 address (e.g., '192.0.2.1')
+ * @returns {string} IPv6 address with NAT64 prefix
+ * @throws {Error} If the input is not a valid IPv4 address
+ */
+function ipv4ToIPv6(ipv4) {
+  if (!ipv4 || typeof ipv4 !== 'string') {
+    throw new Error('ipv4ToIPv6: address must be a non-empty string');
+  }
+
+  const parts = ipv4.split('.').map(Number);
+  if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
+    throw new Error(`ipv4ToIPv6: invalid IPv4 address "${ipv4}"`);
+  }
+
+  const hex1 = ((parts[0] << 8) | parts[1]).toString(16).padStart(4, '0');
+  const hex2 = ((parts[2] << 8) | parts[3]).toString(16).padStart(4, '0');
+  return `${NAT64_PREFIX}${hex1}:${hex2}`;
+}
+
+/**
+ * Resolve a hostname to IPv6 addresses using DNS64 (RFC 6052).
+ *
+ * 1. Try native AAAA resolution first.
+ * 2. Fall back to A resolution and synthesize IPv6 via NAT64 prefix.
+ *
+ * @param {string} hostname - Domain name to resolve
+ * @returns {Promise<string[]>} Array of IPv6 addresses
+ * @throws {Error} If DNS resolution fails completely
+ */
+async function resolveIPv6(hostname) {
+  try {
+    const resolver = dns.resolve6(hostname);
+    const timeout = new Promise((_, reject) =>
+      setTimeout(() => reject(new Error('DNS timeout')), 5000)
+    );
+    return await Promise.race([resolver, timeout]);
+  } catch {
+    try {
+      const ipv4 = await dns.resolve4(hostname);
+      return ipv4.map(ipv4ToIPv6);
+    } catch (err) {
+      throw new Error(`DNS resolution failed for ${hostname}: ${err.message}`);
+    }
+  }
+}
+
+module.exports = { ipv4ToIPv6, resolveIPv6, detectIPVersion };

package/src/index.js

@@ -0,0 +1,62 @@
+/**
+ * IPv6 Bridge - Main Entry Point
+ *
+ * Coordinates bridge startup and shutdown. The bridge consists of:
+ *
+ * 1. Detection (detect.js): Checks if the bridge is needed.
+ * 2. DNS64 Resolver (dns64.js): Synthesizes IPv6 addresses from IPv4.
+ * 3. Proxy (proxy.js): HTTP/HTTPS proxy with NAT64 routing.
+ *
+ * @module ipv6-bridge
+ */
+
+const { createProxy } = require('./proxy');
+const { needsBridge } = require('./detect');
+
+let activeServer = null;
+
+/**
+ * Start the IPv6 bridge.
+ *
+ * @param {number} [port=8080] - Port to listen on
+ * @returns {Promise<http.Server|null>} Server instance if started, null if not needed
+ * @throws {Error} If already running or startup fails
+ */
+async function start(port = 8080) {
+  if (activeServer) {
+    throw new Error('IPv6 Bridge is already running');
+  }
+
+  // Step 1: Detect if bridge is needed
+  const needed = await needsBridge();
+  if (!needed && !process.env.FORCE_BRIDGE) {
+    console.log('IPv6 bridge not needed — you have dual-stack or working NAT64.');
+    return null;
+  }
+
+  if (!needed) {
+    console.log('IPv6 bridge not needed, but FORCE_BRIDGE is set — starting anyway.');
+  }
+
+  // Step 2: Start the proxy server
+  activeServer = await createProxy(port);
+  return activeServer;
+}
+
+/**
+ * Stop the IPv6 bridge.
+ *
+ * @returns {Promise<void>} Resolves when the server has closed
+ */
+function stop() {
+  if (!activeServer) return Promise.resolve();
+
+  return new Promise((resolve) => {
+    activeServer.close(() => {
+      activeServer = null;
+      resolve();
+    });
+  });
+}
+
+module.exports = { start, stop };

package/src/proxy.js

@@ -0,0 +1,141 @@
+/**
+ * IPv6 Bridge - HTTP/HTTPS Proxy
+ *
+ * Implements application-level NAT64 (RFC 6146) by intercepting HTTP/HTTPS
+ * requests, resolving hostnames via DNS64, and routing through IPv6.
+ *
+ * @module proxy
+ */
+
+const http = require('http');
+const net = require('net');
+const { resolveIPv6, detectIPVersion } = require('./dns64');
+const { DEFAULT_PORT } = require('./config');
+
+/**
+ * Resolve a target host to an IPv6 address if needed.
+ *
+ * @param {string} hostname - The hostname or IP to resolve
+ * @returns {Promise<{host: string, family: number}>} Resolved host and IP family
+ */
+async function resolveTarget(hostname) {
+  const ipVersion = detectIPVersion(hostname);
+
+  if (ipVersion === 'ipv6') {
+    return { host: hostname, family: 6 };
+  }
+
+  // For both IPv4 addresses and hostnames, use DNS64 resolution
+  // to get an IPv6 address with the NAT64 prefix.
+  try {
+    const ipv6Addresses = await resolveIPv6(hostname);
+    if (ipv6Addresses && ipv6Addresses.length > 0) {
+      return { host: ipv6Addresses[0], family: 6 };
+    }
+  } catch {
+    // Fall through to direct connection
+  }
+
+  return { host: hostname, family: 4 };
+}
+
+/**
+ * Create an HTTP/HTTPS proxy server with NAT64 support.
+ *
+ * @param {number} port - Port to listen on (default: 8080)
+ * @returns {Promise<http.Server>} Resolves with the server once it's listening
+ */
+function createProxy(port = DEFAULT_PORT) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer(async (req, res) => {
+      try {
+        const url = new URL(`http://${req.headers.host}${req.url}`);
+        const hostname = url.hostname;
+        const { host: targetHost, family: ipFamily } = await resolveTarget(hostname);
+
+        const options = {
+          hostname: targetHost,
+          port: url.port || 80,
+          path: url.pathname + url.search,
+          method: req.method,
+          headers: req.headers,
+          family: ipFamily,
+          timeout: 10000,
+        };
+
+        const proxy = http.request(options, (proxyRes) => {
+          res.writeHead(proxyRes.statusCode, proxyRes.headers);
+          proxyRes.pipe(res);
+          proxyRes.on('error', () => {
+            if (!res.headersSent) {
+              res.writeHead(502).end('Bad Gateway');
+            }
+          });
+        });
+
+        proxy.on('error', () => {
+          if (!res.headersSent) {
+            res.writeHead(502).end('Bad Gateway');
+          }
+        });
+
+        proxy.on('timeout', () => {
+          proxy.destroy();
+          if (!res.headersSent) {
+            res.writeHead(504).end('Gateway Timeout');
+          }
+        });
+
+        req.pipe(proxy);
+        req.on('error', () => proxy.destroy());
+      } catch {
+        if (!res.headersSent) {
+          res.writeHead(500).end('Internal Server Error');
+        }
+      }
+    });
+
+    // HTTPS CONNECT tunnel handler
+    server.on('connect', async (req, socket, head) => {
+      try {
+        const [hostname, rawPort] = req.url.split(':');
+        const targetPort = parseInt(rawPort, 10) || 443;
+
+        if (targetPort < 1 || targetPort > 65535) {
+          socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+          return;
+        }
+
+        const { host: targetHost, family: ipFamily } = await resolveTarget(hostname);
+
+        const conn = net.connect(
+          { port: targetPort, host: targetHost, family: ipFamily },
+          () => {
+            socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            conn.write(head);
+            conn.pipe(socket).pipe(conn);
+          }
+        );
+
+        conn.on('error', () => socket.end());
+        socket.on('error', () => conn.end());
+        conn.setTimeout(10000, () => {
+          conn.destroy();
+          socket.end();
+        });
+      } catch {
+        socket.end();
+      }
+    });
+
+    server.on('error', (err) => {
+      reject(new Error(`Failed to start proxy: ${err.message}`));
+    });
+
+    server.listen(port, () => {
+      resolve(server);
+    });
+  });
+}
+
+module.exports = { createProxy };