Forward Proxy Advanced

The Forward Proxy Advanced plugin allows Kong Gateway to connect to intermediary transparent HTTP proxies, instead of directly to the upstream_url, when forwarding requests upstream.

This is useful in environments where the following is true:

1. Kong Gateway sits inside an organization’s internal network.
2. The upstream service is available via the public internet.
3. The organization proxies all outbound traffic through a forward proxy server.

The Forward Proxy Advanced plugin attempts to transparently replace upstream connections made by Kong Gateway, sending the request instead to an intermediary forward proxy.

The connection between Kong Gateway and the forward proxy is always plain HTTP. Kong Gateway does not support TLS to the forward proxy itself.

How the plugin reaches the upstream depends on the upstream’s scheme:

• For HTTP upstreams, the plugin sends the request to the proxy directly, using an absolute-form request URI.
• For HTTPS upstreams, the plugin sends an HTTP CONNECT request to open a tunnel to the upstream through the proxy. It then performs the TLS handshake with the upstream through that tunnel. The proxy only relays the encrypted bytes; it does not terminate the TLS connection.

The Forward Proxy Advanced plugin can’t be used with an Upstream. As a workaround for load balancing, configure the host field in a Gateway Service to a domain name so that you can use a DNS-based load balancing technique.

The Forward Proxy Advanced plugin also can’t be used together with the following:

• Validating the upstream response with the OAS Validation plugin.
• Using the kong.service.response.get_raw_body() from the PDK in the header_filter phase.