The v2 xDS API is not supported in Envoy v1.18.0 and above.

TCP Proxy

This extension may be referenced by the qualified name envoy.filters.network.tcp_proxy


This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.


This extension extends and can be used with the following extension category:

TCP Proxy configuration overview.


[config.filter.network.tcp_proxy.v2.TcpProxy proto]

  "stat_prefix": "...",
  "cluster": "...",
  "weighted_clusters": "{...}",
  "metadata_match": "{...}",
  "idle_timeout": "{...}",
  "access_log": [],
  "max_connect_attempts": "{...}",
  "hash_policy": []

(string, REQUIRED) The prefix to use when emitting statistics.


(string) The upstream cluster to connect to.

Precisely one of cluster, weighted_clusters must be set.


(config.filter.network.tcp_proxy.v2.TcpProxy.WeightedCluster) Multiple upstream clusters can be specified for a given route. The request is routed to one of the upstream clusters based on weights assigned to each cluster.

Precisely one of cluster, weighted_clusters must be set.


(core.Metadata) Optional endpoint metadata match criteria. Only endpoints in the upstream cluster with metadata matching that set in metadata_match will be considered. The filter name should be specified as envoy.lb.


(Duration) The idle timeout for connections managed by the TCP proxy filter. The idle timeout is defined as the period in which there are no bytes sent or received on either the upstream or downstream connection. If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled.


Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP FIN packets, etc.


(repeated config.filter.accesslog.v2.AccessLog) Configuration for access logs emitted by the this tcp_proxy.


(UInt32Value) The maximum number of unsuccessful connection attempts that will be made before giving up. If the parameter is not specified, 1 connection attempt will be made.


(repeated type.HashPolicy) Optional configuration for TCP proxy hash policy. If hash_policy is not set, the hash-based load balancing algorithms will select a host randomly. Currently the number of hash policies is limited to 1.


[config.filter.network.tcp_proxy.v2.TcpProxy.WeightedCluster proto]

Allows for specification of multiple upstream clusters along with weights that indicate the percentage of traffic to be forwarded to each cluster. The router selects an upstream cluster based on these weights.

  "clusters": []

(repeated config.filter.network.tcp_proxy.v2.TcpProxy.WeightedCluster.ClusterWeight, REQUIRED) Specifies one or more upstream clusters associated with the route.


[config.filter.network.tcp_proxy.v2.TcpProxy.WeightedCluster.ClusterWeight proto]

  "name": "...",
  "weight": "...",
  "metadata_match": "{...}"

(string, REQUIRED) Name of the upstream cluster.


(uint32) When a request matches the route, the choice of an upstream cluster is determined by its weight. The sum of weights across all entries in the clusters array determines the total weight.


(core.Metadata) Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints in the upstream cluster with metadata matching what is set in this field will be considered for load balancing. Note that this will be merged with what’s provided in TcpProxy.metadata_match, with values here taking precedence. The filter name should be specified as envoy.lb.


[config.filter.network.tcp_proxy.v2.TcpProxy.TunnelingConfig proto]

Configuration for tunneling TCP over other transports or application layers. Currently, only HTTP/2 is supported. When other options exist, HTTP/2 will remain the default.

  "hostname": "..."

(string, REQUIRED) The hostname to send in the synthesized CONNECT headers to the upstream proxy.