Class TransparentQuicProxyEndPoint

A transparent proxy endpoint that listens on UDP/QUIC and intercepts HTTP/3 traffic. Clients are not aware of the proxy; traffic must be directed here via firewall/NAT redirection.

QUIC always terminates TLS 1.3 at the proxy — there is no pass-through mode. An IOriginalDestinationResolver must be configured (or a fixed ForwardHost / ForwardPort fallback) so the proxy knows which origin server each connection is intended for.

Platform requirement: IsSupported must be true (MsQuic native library present, OS version supported). If it is false, Start(bool) will throw PlatformNotSupportedException.

ECH constraint: when managed DNS advertises ECH for intercepted names, the hidden SNI is encrypted and cannot be extracted here. Either disable ECH for intercepted names in your managed DNS, or configure managed clients to disable ECH.

Experimental: HTTP/3 support has not yet completed the full interop/soak/fuzz gate process. Suppress TWP001 to opt in.

Inheritance
object
ProxyEndPoint
TransparentBaseProxyEndPoint
TransparentQuicProxyEndPoint
Inherited Members
Namespace: Titanium.Web.Proxy.Models
Assembly: Titanium.Web.Proxy.dll
Syntax
[Experimental("TWP001")]
public class TransparentQuicProxyEndPoint : TransparentBaseProxyEndPoint

Constructors

| Edit this page View Source

TransparentQuicProxyEndPoint(int)

Initializes a new TransparentQuicProxyEndPoint listening on all addresses at the specified port.

Declaration
public TransparentQuicProxyEndPoint(int port)
Parameters
Type Name Description
int port

UDP port to listen on.
| Edit this page View Source

TransparentQuicProxyEndPoint(IPAddress, int)

Initializes a new TransparentQuicProxyEndPoint.

Declaration
public TransparentQuicProxyEndPoint(IPAddress ipAddress, int port)
Parameters
Type Name Description
IPAddress ipAddress

Local UDP address to listen on.
int port

UDP port to listen on.

Properties

| Edit this page View Source

AdvertiseToHttpClients

Documented for origin-upgrade scenarios; dual-listen reverse HTTP/3 on EnableHttp3 is the supported path for client-facing Alt-Svc discovery. This flag remains unused on UDP-only endpoints (no H1/H2 listen). Default: false.

Declaration
public bool AdvertiseToHttpClients { get; set; }
Property Value
Type Description
bool
| Edit this page View Source

GenericCertificateName

Fallback certificate name used when the client does not supply SNI. Defaults to "localhost".

Declaration
public override string GenericCertificateName { get; set; }
Property Value
Type Description
string
Overrides
| Edit this page View Source

HandshakeTimeout

Maximum time allowed for the QUIC handshake before the connection is aborted. Default: 30 seconds.

Declaration
public TimeSpan HandshakeTimeout { get; set; }
Property Value
Type Description
TimeSpan
| Edit this page View Source

IdleTimeout

Connection idle timeout. MsQuic closes idle connections that exceed this duration. Default: 60 seconds.

Declaration
public TimeSpan IdleTimeout { get; set; }
Property Value
Type Description
TimeSpan
| Edit this page View Source

MaxInboundBidirectionalStreams

Maximum number of concurrent inbound client-initiated bidirectional streams per QUIC connection (HTTP/3 request streams). MsQuic enforces QUIC flow control at this limit — the client is backpressured, not disconnected. Default: 100.

Declaration
public int MaxInboundBidirectionalStreams { get; set; }
Property Value
Type Description
int
| Edit this page View Source

MaxInboundUnidirectionalStreams

Maximum number of concurrent inbound client-initiated unidirectional streams per QUIC connection. HTTP/3 requires at least 3 (control stream + QPACK encoder stream + QPACK decoder stream from the client). Values below 3 are clamped to 3 at runtime. Default: 3.

Declaration
public int MaxInboundUnidirectionalStreams { get; set; }
Property Value
Type Description
int
| Edit this page View Source

OriginalDestinationResolver

Resolver that determines the original (pre-NAT) destination host and port for each incoming QUIC connection. When null the endpoint falls back to ForwardHost / ForwardPort; if neither is set the connection is rejected.

Declaration
public IOriginalDestinationResolver? OriginalDestinationResolver { get; set; }
Property Value
Type Description
IOriginalDestinationResolver

Events

| Edit this page View Source

BeforeQuicAuthenticate

Fired before the QUIC TLS handshake completes for each inbound connection. Handlers may inspect/override the forward target, upstream protocol policy, and custom upstream proxy, or call Reject() to refuse the connection.

This event does not expose DecryptSsl: QUIC always decrypts at the proxy.

Declaration
public event AsyncEventHandler<BeforeQuicAuthenticateEventArgs>? BeforeQuicAuthenticate
Event Type
Type Description
AsyncEventHandler<BeforeQuicAuthenticateEventArgs>