Understanding how traffic moves through ProxyPass helps explain why it is both secure and performant.
The Persistent Tunnel
When a node starts, it opens an outbound TCP socket to the ProxyPass cloud server. This connection is encrypted with TLS — the same encryption standard used by every bank, email provider, and secure website. The socket stays open as a persistent tunnel.
When you send a request — whether through CONNECT mode, REST Bridge, or File Mount — the ProxyPass cloud receives it, identifies which node should handle it based on your API key and node ID, and routes the request through the existing tunnel to that node.
Local Processing
The node processes the request locally: opening a TCP connection to a target (CONNECT), forwarding an HTTP request to a LAN device (REST Bridge), or reading a file from disk (File Mount). The response travels back through the same tunnel, encrypted, to the cloud, and from there to your client.
Double Encryption in CONNECT Mode
For CONNECT mode traffic, there is an additional layer of encryption that is worth understanding. Your client — whether it is an SSH client, a database tool, or a browser — negotiates its own TLS session directly with the target. This session runs inside the already-encrypted tunnel.
The result is double encryption. The outer layer is the TLS tunnel between the node and the ProxyPass cloud. The inner layer is your client's own TLS session with the target. ProxyPass handles the outer layer but has zero visibility into the inner layer. We see encrypted bytes inside an encrypted connection. Even in a theoretical scenario where someone compromised the tunnel encryption, the inner layer remains intact. Your data is protected twice.
What ProxyPass Does Not Do
It does not terminate your TLS sessions in CONNECT mode — your end-to-end encryption stays intact. It does not log request content or response bodies. It does not inspect payloads. Traffic statistics (request count, bytes transferred) are tracked for dashboard metrics, but the actual data passing through is never stored, analyzed, or accessible to anyone.
Routing Architecture
The cloud server uses YARP — a high-performance .NET reverse proxy — for HTTP routing and SSL termination on the management and REST Bridge endpoints. YARP was chosen over traditional solutions like nginx because it integrates natively with the .NET stack ProxyPass is built on, allows programmatic routing decisions, and handles complex subdomain routing (like customer-specific subdomains) that would require fragile nginx configurations.
Direct TCP traffic (CONNECT mode) bypasses YARP entirely and goes straight to the tunnel handler for minimal latency. There is no unnecessary proxy hop for protocols that do not need HTTP processing.
Hardware-Bound Identity
Each node is identified by a hardware-bound CPU ID, ensuring that the identity of a node cannot be spoofed by cloning a machine. Combined with API key authentication and optional per-node keys, every request is verified before it reaches the tunnel.
The result is a system where your traffic is encrypted in transit, authenticated at every hop, and invisible to the infrastructure handling it.