First, always specify internal interface to accept incoming connection with 'internal' configuration command or '-i' service command. (See How to start any of proxy services (HTTP, SOCKS etc)). If no internal interface is specified your proxy will act as open one.

It's also important to specify external interface to prevent access to internal network with 'external' or -e.

3proxy with configuration files allows to use authentication and authorization for user's access. Authentication is possible by username/password or user's NetBIOS name. Authentication type is specified by 'auth' command.

auth none

auth iponly

auth nbname

auth strong

Different services can have different authentication levels.

auth none
pop3p
auth iponly
proxy
auth strong
socks

Since 0.6 version double authentication is possible, e.g.

auth iponly strong
allow * * 192.168.0.0/16
allow user1,user2
proxy

0.6 version introduces authentication (username) caching to increase productivity. It's recommended to use authentication caching with resource or time consuming authentication types, such as nbname or external plugins (WindowsAuthentication). Caching can be set with 'authcache' command with 2 parameters: caching type and caching time (in seconds). Caching type defines the type of cached access: 'ip' - after successful authentication all connections during caching time from same IP are assigned to the same user, username is not requested. "ip,user" - username is requested and all connections from the same IP are assigned to the same user without actual authentication. "user" - same as above, but IP is not checked. "user,password" - username and password are checked against cached ones. For authentication special authentication type 'cache' must be used. Example:

authcache ip 60
auth cache strong windows
proxy -n

authcache can be used to bind user's sessions to ip with 'limit' option, with

  autchcache ip,user,pass,limit 120
  auth cache strong

Userslist is created with 'users' command.

users USERDESC ...

users admin:CL:bigsecret test:CL:password test1:CL:password1
users "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63

• No password type: use system authentication.
• CL - cleartext password
• CR - crypt password, only MD5 crypt passwords are supported
• NT - NT-hashed (MD4) passwords in hex, as used in pwdump or SAMBA

users $/etc/.3proxypasswd

users $"c:\Program Files\3proxy\passwords"

Commands allow, deny and flush are used to manage ACLs:

allow <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist> <weekdaylist> <timeperiodlist>
deny <userlist> <sourcelist> <targetlist> <weekdaylist> <timeperiodlist>
flush

• <userlist> - comma delimited list of users
• <sourcelist> - comma delimited list of source (client) networks. Networks can be defined as single IP address or in CIDR form xxx.yyy.zzz.mmm/l, where l - is the length of network mask (a number of non-zero bits). 192.168.1.0/24 means network with 255.255.255.0 mask.
• <targetlist> - comma delimited list of target (server) networks. In 3proxy 0.6 and above it's allowed to use hostnames with wildmasks in targetlist. Wildmask may only present in the begginning or at the end of the hostname, e.g. 192.168.0.0/16,www.example.com,*wrongsite.com,*wrongcontent*.
• <targetportlist> - comma delimited list of ports. I It's possible to define port ranges with -, e.g. 80,1024-65535 means port 80 and all unprivileged ports.
• <commandlist> - the list of allowed actions
  CONNECT - establish outgoing TCP connection. e.g. POP3 or SOCKSv5
  BIND - allow incoming TCP connection (SOCKSv5)
  UDPASSOC - create UDP association (SOCKSv5)
  ICMPASSOC - create ICMP association (not implemented)
  HTTP_GET - HTTP GET request (HTTP proxy)
  HTTP_PUT - HTTP PUT request (HTTP proxy)
  HTTP_POST - HTTP POST request (HTTP proxy)
  HTTP_HEAD - HTTP HEAD request (HTTP proxy)
  HTTP_CONNECT - HTTP CONNECT, aka HTTPS request (HTTP proxy)
  HTTP_OTHER - another HTTP request (HTTP proxy)
  HTTP - any HTTP request except HTTP_CONNECT (HTTP proxy)
  HTTPS - alias to HTTP_CONNECT (HTTP proxy)
  FTP_GET - FTP get request (http, ftp proxy)
  FTP_PUT - FTP put request (ftp proxy)
  FTP_LIST - FTP list request (http, ftp proxy)
  FTP - any FTP request
  ADMIN - administration interface access

• <weeksdays> - week days numbers or periods (0 or 7 means Sunday, 1 is Monday, 1-5 means Monday through Friday).
• <timeperiodlists> - a list of time periods in HH:MM:SS-HH:MM:SS format. For example, 00:00:00-08:00:00,17:00:00-24:00:00 lists non-working hours.

Redirections are usefull to e.g. forward requests from specific clients to different servers or proxy server. Additionally, redirections are usefull to convert proxy interface from ont format to another, e.g. requests from SOCKS proxy can be redirected to parent HTTP proxy, or SOCKSv5 client can be redirected to SOCKSv4 proxy.
Because 3proxy understand "transparent" web request, it can be used as an intermediate software between HTTP proxy and NAT server for transparent HTTP forwarding, because it can convert "Web server" request issued by client to "proxy request" required by proxy server. A simplest redirection is:

auth iponly
allow *
parent 1000 http 192.168.1.1 3128
proxy

auth iponly
allow * * * 80
parent 1000 http 0.0.0.0 0
allow * * * 21
parent 1000 ftp 0.0.0.0 0
allow * * * 110
parent 1000 pop3 0.0.0.0 0
socks

Q: What is it for?

Q: What are restrictions?

Q: What are advantages?

Q: How to setup?

auth iponly
allow * * * 80,8080-8088
parent 1000 http 0.0.0.0 0
allow * * * 80,8080-8088
#redirect ports 80 and 8080-8088 to local HTTP proxy
#Second allow is required, because ACLs are checked
#twice: first time by socks and second by http proxy.

allow * * * 21,2121
parent 1000 ftp 0.0.0.0 0
allow * * * 21,2121
#redirect ports 21 and 2121 to local 
#ftp proxy


allow *
#allow rest of connections directly

socks
#now let socks server to start

Q: How it affects different ACL rules

allow * * * 80,8080-8088
parent 1000 http 0.0.0.0 0
#redirect http traffic to internal proxy

allow * * $c:\3proxy\local.nets 80,8080-8088
#allow direct access to local.nets networks
allow * * * 80,8080-8088
parent 1000 http proxy.3proxy.org 3128
#use parent caching proxy for rest of the networks

allow *
#allow direct connections for rest of socks
#requests

Proxy itself doesn't manage network level routing. The only way to control outgoing channel is to select external interface. It's possible to make external interface (what is usually selected with 'external' command or '-e' option) random by using local redirection with external port 0.

auth iponly
allow *
parent 500 http 10.1.1.101 0
parent 500 http 10.2.1.102 0

If both interface addresses are in same network, e.g. 10.1.1.101 and 10.1.1.102 and you want to select random gateway between 10.1.1.1 and 10.1.1.2, you must control it by using routing table, in case there is no default gateway route for Windows:

 route add -p 10.1.1.1 10.1.1.101
 route add -p 10.1.1.2 10.1.1.102
 route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.1
 route add -p 0.0.0.0 mask 0.0.0.0 192.168.1.2

parent command may also be used to build a proxy chains. In this case few 'parent' commands are used for single 'allow' rule with different weights (first argument of parent command). Chain may contain any number of proxy servers, but it should be noted that every hope significantly reduces productivity. It's possible to mix different types of proxy within single chain: HTTPS (HTTP connect), SOCKS4, SOCKS5. Weight different from 1000 is used to build random chains. if weight W is below 1000, this proxy will be used as a next chain hop with probability of W/1000. That is, if the weight is 250 probability this proxy will be used for the next hope is 25%. 'parent' records with common weight of 1000 establish a group, one of these record will be used for the hop with probability according to weight. Warning: each group must have a weight even of 1000. As follows, common weight of all 'parent' records must also be even of 1000. If common weight of 'parent' records in te chain is 3000, chain has 3 hops and must be formed of 3 groups. Example:

allow *
parent 500 socks5 192.168.1.1 1080
parent 500 connect 192.168.10.1 3128

allow * * * 80
parent 1000 socks5 192.168.10.1 1080
parent 1000 connect 192.168.20.1 3128
parent 300 socks4 192.168.30.1 1080
parent 700 socks5 192.168.40.1 1080

3proxy supports bandwidth filters. To manage filters bandlimin/bandlimout and nobandlimin/nobandlimout. 'in' means incoming and 'out' - outgoing traffic.

bandlimin <bitrate> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
nobandlimin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>

  bandlimin 57600 * 192.168.10.16
  bandlimin 57600 * 192.168.10.17
  bandlimin 57600 * 192.168.10.18
  bandlimin 57600 * 192.168.10.19

  bandlimin 57600 * 192.168.10.16/30

  nobandlimin * * * 110
  bandlimin 57600 * 192.168.10.16/32

counter <filename> <type> <reportpath>
countin <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
nocountin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
countout <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
nocountout <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>

You can set traffic limit per day (D), week (W), month (M), year (Y) or absolute ('N'), as specified by 'type' argument of counterin command. Traffic information is stored in binary file specified by 'filename' argument. countersutil utility can be used to manage this file. reportpath specifies location of text reports, type parameter of 'counter' command controls how often text reports are created. amount is amount of allowed traffic in Megabytes (MB). nocountin allows you to set exclusions.

3proxy accounts protocol level traffic. Provider counts channel or IP-level traffic with network and transport headers. In additions, 3proxy doesn't counts DNS resolutions, pings, floods, scans, etc. It makes approx. 10% of difference. That's why you should have 15% reserve if you use 3proxy to limit your traffic. If difference with your provider is significantly above 10% you should look for traffic avoiding proxy server, for example connections through NAT, traffic originated from the host with proxy installed, traffic from server applications, etc.

For name resolution and caching use commands nserver, nscache / nscache6 and nsrecord.

  nserver 192.168.1.2
  nserver 192.168.1.3:5353/tcp

  nscache 65535
  nscache6 65535

  nsrecord server.mycompany.example.com 192.168.1.1
  nsrecord www.porno.com 127.0.0.2
  ...
  deny * * 127.0.0.2

IPv6 is supported since 0.8. Please note, some proxy protolos, e.g. SOCKSv4, do not support IPv6. SOCKSv5 supports IPv6 with special request type (must be implemented by client).
3proxy supports proxying from IPv4 and IPv6 networks to IPv4, IPv6 and mixed networks. IPv6 address may be used in internal, external, parent commands, ACLs, -i and -e options,etc. external command and -e options may be given twice for each service - once with IPv4 and once with IPv6 address. internal can be given only once, to bind to all IPv4 and IPv6 addresses use [0:0:0:0:0:0:0:0] or [::].
Any service may be configured with -4, -46, -64, -6 options to specify decied priority for name to IPv4/IPv6 address resolution (IPv4 only, IPv4 priority, IPv6 priority, IPv6 only).

In example, users needs access from external network to proxy server located on the host 192.168.1.2. This host can not be accessed from external network, but it has access to external network with with external address 1.1.1.1. Also, user has access to the host 2.2.2.2 (IP address may be dynamic) with hostname host.dyndns.example.org via external network. User needs 2 instances of 3proxy, first one on the host 192.168.1.2 with config

  users user:CL:password
  auth strong
  allow user
  proxy -rhost.dyndns.example.org:1234

  auth iponly
  allow * * 1.1.1.1
  tcppm -R0.0.0.0:1234 3128 1.1.1.1 3128