sslh

sslh allows multiple protocols to share a single port, primarily port 443, which is commonly open for HTTPS traffic. This is particularly useful in environments like corporate networks where outbound connections to standard SSH or VPN ports are blocked, but HTTPS is permitted. By multiplexing protocols on port 443, users can securely access SSH, OpenVPN, tinc, or XMPP servers without altering firewall rules.

The tool acts as a front-end proxy that inspects incoming connections and forwards them to the appropriate backend service based on protocol detection. It supports a range of protocols including SSL/TLS, SSH, OpenVPN, tinc, WireGuard, XMPP, HTTP, and others. This setup maintains HTTPS availability on the same port for web servers.

sslh comes in variants like sslh (default), sslh-ev, and sslh-select, with the main binary providing extensive configuration options for logging, verbosity, and protocol forwarding.

sslh operates as a protocol demultiplexer, listening on a specified port (e.g., 443) and probing incoming packets to identify the protocol. It uses techniques like packet inspection (hexdump for probing) to distinguish between HTTPS/SSL/TLS, SSH, OpenVPN, tinc, XMPP, and other supported protocols. Once identified, it forwards the connection transparently to the designated backend host:port for that protocol. Internals include support for UDP, syslog integration, timeout handling, and verbose logging at various levels for connections, packets, and errors.