Sower is a cross-platform intelligent transparent proxy tool. It provides both socks5 proxy and DNS-based proxy. All these kinds of proxies support intelligent routing.

If you already have another proxy solution, you can use its socks5(h) service as a parent proxy to enjoy sower's intelligent routing.

Installation

To enjoy sower, you need to deploy sower on both server-side(sowerd) and client-side(sower).

Sowerd

If you want to use sower as a secondary proxy to provide intelligent routing, you can skip sowerd.

On the server-side, sowerd runs just like a web server proxy. It will bind two ports 80 / 443.

sowerd validates its configuration at startup, redacts secrets from logs, and exits immediately if 80 / 443 listeners cannot be established.

You can use your own certificate or the certificate automatically applied for by sowerd from Let's Encrypt.

When fake_site points to a local directory, sowerd serves that directory only through loopback fallback traffic on 127.0.0.1:80, while public HTTP traffic is still redirected to HTTPS.

There are two ways to run the sowerd service:

Run the command with root permission

# sowerd -password XXX -fake_site 127.0.0.1:8080

Install as a systemd service interactively
```
sudo sowerd -i
```
The installer can copy the current binary to /usr/local/bin/sowerd, write /etc/systemd/system/sowerd.service, create /etc/sower/sowerd.toml when missing, and optionally start the service immediately.

Sower

A config file is required on the sower client side. Here is a usable example in China.

Sower will bind 4 ports by default with root permission. They are: udp(53) / tcp(80) / tcp(443) / tcp(1080).

For sower and trojan upstreams, remote.addr now accepts either host or host:port. Optional remote.tls settings let the client override SNI, skip certificate verification, or use a uTLS client fingerprint such as chrome or firefox.

After doing the next three steps, you can enjoy the intelligent transparent proxy solution:

Run the command with root permission:
```
# sower -f sower.hcl
```
Change your DNS server to 127.0.0.1.
Set your proxy to socks5h://127.0.0.1:1080.

Architecture

Detailed architecture and runtime design notes are in ARCHITECTURE.md.