Sower is a cross-platform intelligent transparent proxy tool. It provides both socks5 proxy and DNS-based proxy. All these kinds of proxies support intelligent routing.

If you already have another proxy solution, you can use its socks5(h) service as a parent proxy to enjoy sower's intelligent routing.

Installation

To enjoy sower, you need to deploy sower on both server-side(sowerd) and client-side(sower).

Sowerd

If you want to use sower as a secondary proxy to provide intelligent routing, you can skip sowerd.

On the server-side, sowerd runs just like a web server proxy. It will bind two ports 80 / 443.

sowerd validates its configuration at startup, redacts secrets from logs, and exits immediately if 80 / 443 listeners cannot be established.

When sowerd runs as a system service without HOME or XDG_CACHE_HOME, it falls back to /var/cache/sower for certificate cache state so environment-only startup still works without a config file.

You can use your own certificate or the certificate automatically applied for by sowerd from Let's Encrypt.

When fake_site points to a local directory, sowerd serves that directory only through loopback fallback traffic on 127.0.0.1:80, while public HTTP traffic is still redirected to HTTPS.

There are two ways to run the sowerd service:

Run the command with root permission

# sowerd -password XXX -fake_site 127.0.0.1:8080

Install as a systemd service interactively
```
sudo sowerd -i
```
The installer can copy the current binary to /usr/local/bin/sowerd, write /etc/systemd/system/sowerd.service, create /etc/sower/sowerd.toml when missing, and optionally start the service immediately.

Sower

A config file is required on the sower client side. sower.toml is the default packaged example.

Sower will bind 4 ports by default with root permission. They are: udp(53) / tcp(80) / tcp(443) / tcp(1080).

When DNS-based HTTPS proxying is enabled, sower listens on local 443/tcp, reads the TLS ClientHello only to extract SNI, and forwards the original TLS stream to the selected upstream without terminating TLS.

For sower and trojan upstreams, remote.addr now accepts either host or host:port. Optional remote.tls settings let the client override SNI, skip certificate verification, or use a uTLS client fingerprint such as chrome or firefox.

Remote domain rule files can be filtered with per-router skip rules. For example, use file_skip_rules = ["t.co"] in the TOML [router.block] section to ignore a third-party blocklist entry while keeping explicit local rules intact.

Remote rule files are downloaded through the configured upstream proxy, not through direct outbound HTTP. sower loads these rules before exposing local listeners, so an unreachable upstream proxy or rule URL fails startup instead of starting with incomplete routing state.

router.country.mmdb is optional. Leave it empty to disable GeoIP lookup and use only configured CIDR rules for country-based direct routing.

After doing the next three steps, you can enjoy the intelligent transparent proxy solution:

Run the command with root permission:
```
# sower -c sower.toml
```
Change your DNS server to 127.0.0.1.
Set your proxy to socks5h://127.0.0.1:1080.

Architecture

Detailed architecture and runtime design notes are in ARCHITECTURE.md.