When you configure your browser, SSH client, or database tool to use an HTTP proxy, the first thing it does is send a CONNECT request. This tells the proxy: "Open a raw TCP tunnel to this destination. I will handle the encryption myself."
That is exactly what ProxyPass does in CONNECT mode. Your client sends the CONNECT request to the ProxyPass cloud. The cloud routes it through the encrypted tunnel to the node sitting in the remote network. The node opens a connection to whatever you asked for — an SSH server, a database, a web interface — and from that point, bytes flow in both directions without ProxyPass touching or inspecting them.
Opaque by Design, Not by Policy
This is true end-to-end encryption. Your client negotiates TLS directly with the target — ProxyPass is not part of that handshake. What passes through the tunnel is encrypted garbage from our perspective. We could not inspect it even if we wanted to. We do not know what protocol you are running, what data you are sending, or what the response contains. The tunnel is opaque by design, not by policy.
What Can You Tunnel?
Anything that speaks TCP. We have tested and confirmed SSH, SFTP, PostgreSQL, RDP, and standard HTTPS browsing. If your client supports HTTP CONNECT proxies — and most do — it works.
A Concrete Example: SSH Through ProxyPass
Say you need to SSH into a Linux server at a customer site. The server has no public IP and no open ports. But it has a ProxyPass node on the same network.
You open your SSH client — PuTTY, Bitvise, or the terminal — and configure it to use the ProxyPass endpoint as an HTTP proxy. You enter the target server's local IP address (like 192.168.1.50) and port 22. Your SSH client sends a CONNECT request through ProxyPass, the tunnel routes it to the node, the node connects to the server on the local network, and you are in. Full shell access, file transfers, port forwarding — everything SSH can do.
The same principle works in a browser. Configure your browser's proxy settings to point to ProxyPass, and you browse the internet as if you were sitting at the remote location. Every website sees the node's IP address, not yours. This is how residential proxy providers use ProxyPass to route traffic through thousands of locations — but that is a different blog post.
Single Entry Point, Full Access
The practical value is straightforward. You get a single, secure entry point into a remote network. Instead of managing VPN credentials, firewall rules, and port-forwarding configurations for every device and protocol, you install one ProxyPass node and access everything through it.
Each node is identified by a hardware-bound CPU ID, so even if someone clones the machine, the duplicate will not be able to register as the same node. Combined with per-node API keys and the ability to instantly block rogue nodes, CONNECT mode gives you raw TCP power with production-grade security controls.