ProxyPass offers two fundamentally different ways to reach devices through a tunnel: CONNECT proxy and REST Bridge. They solve different problems and work differently under the hood.
CONNECT: A Raw TCP Pipe
HTTP CONNECT creates a raw TCP tunnel. Your client sends a CONNECT request, ProxyPass opens a bidirectional byte stream through the tunnel to the target, and from that point, your client talks directly to the target. ProxyPass does not understand, parse, or modify the traffic flowing through. It is a pipe.
This means CONNECT works with any TCP protocol: SSH, RDP, databases, HTTPS, custom protocols. The target needs to be reachable on its port, and the client needs to support HTTP CONNECT proxies.
REST Bridge: HTTP-Aware Forwarding
REST Bridge works differently. You send a standard HTTP request to your ProxyPass subdomain with three headers: your API key, the target node ID, and the local URL of the device you want to reach. ProxyPass receives the full HTTP request, routes it through the tunnel, and the node forwards it to the local device.
This means the REST Bridge understands HTTP. It forwards all HTTP methods and all headers to the target. The target does not need to support TLS — the encryption ends at the node, and the last hop is plain HTTP inside the LAN.
When to Use Which
| Scenario | Use |
|---|---|
| SSH into a remote server | CONNECT |
| Query a Shelly relay's HTTP API | REST Bridge |
| Connect to a PostgreSQL database | CONNECT |
| Toggle an IoT device via REST API | REST Bridge |
| RDP to a Windows machine | CONNECT |
| Check a health endpoint on a local service | REST Bridge |
| SFTP file transfer | CONNECT |
| Send a POST command to a smart plug | REST Bridge |
Rule of thumb: CONNECT when the target speaks a non-HTTP protocol or when you need true end-to-end encryption. REST Bridge when the target is an HTTP device that does not support TLS, or when you want to make API calls without configuring a proxy in your client.
Both modes run through the same node, on the same tunnel connection. You do not need to choose one — you use whichever fits the task.