SNI Proxy review
A focused self-hosted router for hostname-based TLS pass-through.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
SNI Proxy is a self-hosted reverse proxy for routing incoming HTTP and TLS connections by hostname. It is aimed at operators who need HTTPS name-based virtual hosting without decrypting traffic or placing private keys on the proxy. The project is open source, available on Linux and macOS, and can run in a self-hosted deployment. Routing rules support exact hostnames, wildcards, and regular expressions, with a configurable fallback backend for requests that do not include a hostname.
Its main strength is focused TLS pass-through. SNI Proxy reads the hostname from the initial TCP request and forwards the connection without terminating TLS. That keeps the proxy out of the encrypted traffic path while supporting IPv4 and IPv6 backends and listeners. Unix domain sockets, multiple listening sockets per instance, and HAProxy proxy protocol support add deployment flexibility. The file-based configuration fits environments where routing behavior is managed alongside other server configuration.
The trade-off is scope and project status. SNI Proxy does not provide TLS termination, so certificate handling and decrypted HTTP features remain outside the proxy. The maintainer marked the project deprecated in December 2023 because it does not support HTTP/2, HTTP/3, or QUIC. Linux installation is available from source or distribution packages, while macOS support is described as best effort. The project remains publicly available, but responses should not be expected except for significant security or reliability issues. Choose SNI Proxy for narrow hostname-based pass-through; choose an alternative when modern HTTP protocols, TLS termination, or an actively maintained project are requirements.
SNI Proxy pros and cons
- Where it wins
- Routes HTTP and TLS by exact, wildcard, or regex hostname rules
- Supports IPv4, IPv6, Unix sockets, and multiple listeners
- Passes HTTPS traffic without TLS termination or private keys on the proxy
- Where it doesn't
- Does not terminate TLS on the proxy
- Deprecated because it lacks HTTP/2, HTTP/3, and QUIC support
- macOS support is best effort, with limited maintainer responses
SNI Proxy fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update