Using Envoy as a Forward Proxy like Squid (Requesting Help)

[myoungsun]

Hello,

I'm using Envoy version 1.34.0 with the example configuration provided at:
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/dynamic_forward_proxy_filter

I started Envoy as follows:

./envoy-contrib-1.34.0-linux-x86_64 -c envoy.yaml -l debug

Afterward, I tested it with curl. While HTTP requests succeed, HTTPS requests fail as shown below. The issue occurs with domains other than Google as well. Could someone please assist?

HTTP request (successful):

curl -s -v --proxy http://127.0.0.1:10000 http://google.com

HTTPS request (fails):

curl -s -v --proxy http://127.0.0.1:10000 https://www.google.com

*   Trying 127.0.0.1:10000...
* Connected to 127.0.0.1 (127.0.0.1) port 10000
* CONNECT tunnel: HTTP/1.1 negotiated
* allocate connect buffer
* Establish HTTP proxy tunnel to www.google.com:443
> CONNECT www.google.com:443 HTTP/1.1
> Host: www.google.com:443
> User-Agent: curl/8.5.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 404 Not Found
< date: Fri, 25 Apr 2025 02:09:51 GMT
< server: envoy
< connection: close
< content-length: 0
<
* CONNECT tunnel failed, response 404
* Closing connection

[ravenblackx]

Relevant bit of debug log:

[2025-04-25 17:17:38.615][70995][debug][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:160] [Tags: "ConnectionId":"0"] new connection from 127.0.0.1:46938
[2025-04-25 17:17:38.616][70995][debug][http] [source/common/http/conn_manager_impl.cc:394] [Tags: "ConnectionId":"0"] new stream
[2025-04-25 17:17:38.617][70995][debug][http] [source/common/http/conn_manager_impl.cc:1196] [Tags: "ConnectionId":"0","StreamId":"15339609770061626129"] request headers complete (end_stream=false):
':authority', 'www.google.com:443'
':method', 'CONNECT'
'user-agent', 'curl/7.68.0'
'proxy-connection', 'Keep-Alive'

[2025-04-25 17:17:38.617][70995][debug][connection] [./source/common/network/connection_impl.h:98] [Tags: "ConnectionId":"0"] current connecting state: false
[2025-04-25 17:17:38.617][70995][debug][router] [source/common/router/config_impl.cc:2112] route was resolved but final route list did not match incoming request
[2025-04-25 17:17:38.617][70995][debug][router] [source/common/router/router.cc:471] [Tags: "ConnectionId":"0","StreamId":"15339609770061626129"] no route match for URL ''
[2025-04-25 17:17:38.617][70995][debug][http] [source/common/http/filter_manager.cc:1040] [Tags: "ConnectionId":"0","StreamId":"15339609770061626129"] Preparing local reply with details route_not_found

Specifically route was resolved but final route list did not match incoming request
and
no route match for URL ''.

[ravenblackx]

@mattklein123 and @htuch as the main contributors to https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/dynamic_forward_proxy_filter

It seems from the doc like this example is expected to work with https upstreams, but it does not.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.