3.19.0

changelog.md

@@ -1,5 +1,97 @@
 # Changelog
 
+## 2025-03-01 - 3.19.0 - feat(PortProxy)
+Enhance PortProxy with default blocked IPs
+
+- Introduced defaultBlockedIPs in IPortProxySettings to handle globally blocked IPs.
+- Added logic for merging domain-specific and default allowed and blocked IPs for effective IP filtering.
+- Refactored helper functions for IP and port range checks to improve modularity in PortProxy.
+
+## 2025-02-27 - 3.18.2 - fix(portproxy)
+Fixed typographical errors in comments within PortProxy class.
+
+- Corrected typographical errors in comments within the PortProxy class.
+
+## 2025-02-27 - 3.18.1 - fix(PortProxy)
+Refactor and enhance PortProxy test cases and handling
+
+- Refactored test cases in test/test.portproxy.ts for clarity and added coverage.
+- Improved TCP server helper functions for better flexibility.
+- Fixed issues with domain handling in PortProxy configuration.
+- Introduced round-robin logic for multi-IP domains in PortProxy.
+- Ensured proper cleanup and stopping of test servers in the test suite.
+
+## 2025-02-27 - 3.18.0 - feat(PortProxy)
+Add SNI-based renegotiation handling in PortProxy
+
+- Introduced a new field 'lockedDomain' in IConnectionRecord to store initial SNI.
+- Enhanced connection management by enforcing termination if rehandshake is detected with different SNI.
+
+## 2025-02-27 - 3.17.1 - fix(PortProxy)
+Fix handling of SNI re-negotiation in PortProxy
+
+- Removed connection locking to the initially negotiated SNI
+- Improved handling of SNI during renegotiation in PortProxy
+
+## 2025-02-27 - 3.17.0 - feat(smartproxy)
+Enhance description clarity and improve SNI handling with domain locking.
+
+- Improved package description in package.json, readme.md, and npmextra.json for better clarity and keyword optimization.
+- Enhanced SNI handling in PortProxy by adding domain locking and extra checks to terminate connections if a different SNI is detected post-handshake.
+- Refactored readme.md to better explain the usage and functionalities of the proxy features including SSL redirection, WebSocket handling, and dynamic routing.
+
+## 2025-02-27 - 3.16.9 - fix(portproxy)
+Extend domain input validation to support string arrays in port proxy configurations.
+
+- Modify IDomainConfig interface to allow domain specification as string array.
+- Update connection setup logic to handle multiple domain patterns.
+- Enhance domain rejection logging to include all domain patterns.
+
+## 2025-02-27 - 3.16.8 - fix(PortProxy)
+Fix IP filtering for domain and global default allowed lists and improve port-based routing logic.
+
+- Improved logic to prioritize domain-specific allowed IPs over global defaults.
+- Fixed port-based rules application to handle global port ranges more effectively.
+- Enhanced rejection handling for unauthorized IP addresses in both domain-specific and default global lists.
+
+## 2025-02-27 - 3.16.7 - fix(PortProxy)
+Improved IP validation logic in PortProxy to ensure correct domain matching and fallback
+
+- Refactored the setupConnection function inside PortProxy to enhance IP address validation.
+- Domain-specific allowed IP preference is applied before default list lookup.
+- Removed redundant condition checks to streamline connection rejection paths.
+
+## 2025-02-27 - 3.16.6 - fix(PortProxy)
+Optimize connection cleanup logic in PortProxy by removing unnecessary delays.
+
+- Removed multiple await plugins.smartdelay.delayFor(0) calls.
+- Improved performance by ensuring timely resource release during connection termination.
+
+## 2025-02-27 - 3.16.5 - fix(PortProxy)
+Improved connection cleanup process with added asynchronous delays
+
+- Connection cleanup now includes asynchronous delays for reliable order of operations.
+
+## 2025-02-27 - 3.16.4 - fix(PortProxy)
+Fix and enhance port proxy handling
+
+- Ensure that all created proxy servers are correctly checked for listening state.
+- Corrected the handling of ports and domain configurations within port proxy setups.
+- Expanded test coverage for handling multiple concurrent and chained proxy connections.
+
+## 2025-02-27 - 3.16.3 - fix(PortProxy)
+Refactored PortProxy to support multiple listening ports and improved modularity.
+
+- Updated PortProxy to allow multiple listening ports with flexible configuration.
+- Moved helper functions for IP and port range checks outside the class for cleaner code structure.
+
+## 2025-02-27 - 3.16.2 - fix(PortProxy)
+Fix port-based routing logic in PortProxy
+
+- Optimized the handling and checking of local ports in the global port range.
+- Fixed the logic for rejecting or accepting connections based on predefined port ranges.
+- Improved handling of the default and specific domain configurations during port-based connections.
+
 ## 2025-02-27 - 3.16.1 - fix(core)
 Updated minor version numbers in dependencies for patch release.
 

npmextra.json

@@ -5,26 +5,26 @@
       "githost": "code.foss.global",
       "gitscope": "push.rocks",
       "gitrepo": "smartproxy",
-      "description": "A robust and versatile proxy package designed to handle high workloads, offering features like SSL redirection, port proxying, WebSocket support, and customizable routing and authentication.",
+      "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
       "npmPackagename": "@push.rocks/smartproxy",
       "license": "MIT",
       "projectDomain": "push.rocks",
       "keywords": [
         "proxy",
-        "network traffic",
-        "high workload",
-        "http",
-        "https",
-        "websocket",
-        "network routing",
-        "ssl redirect",
-        "port mapping",
-        "reverse proxy",
-        "authentication",
+        "network",
+        "traffic management",
+        "SSL",
+        "TLS",
+        "WebSocket",
+        "port proxying",
         "dynamic routing",
-        "sni",
-        "port forwarding",
-        "real-time applications"
+        "authentication",
+        "real-time applications",
+        "high workload",
+        "HTTPS",
+        "reverse proxy",
+        "server",
+        "network security"
       ]
     }
   },

package.json

@@ -1,8 +1,8 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "3.16.1",
+  "version": "3.19.0",
   "private": false,
-  "description": "A robust and versatile proxy package designed to handle high workloads, offering features like SSL redirection, port proxying, WebSocket support, and customizable routing and authentication.",
+  "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
@@ -53,20 +53,20 @@
   ],
   "keywords": [
     "proxy",
-    "network traffic",
-    "high workload",
-    "http",
-    "https",
-    "websocket",
-    "network routing",
-    "ssl redirect",
-    "port mapping",
-    "reverse proxy",
-    "authentication",
+    "network",
+    "traffic management",
+    "SSL",
+    "TLS",
+    "WebSocket",
+    "port proxying",
     "dynamic routing",
-    "sni",
-    "port forwarding",
-    "real-time applications"
+    "authentication",
+    "real-time applications",
+    "high workload",
+    "HTTPS",
+    "reverse proxy",
+    "server",
+    "network security"
   ],
   "homepage": "https://code.foss.global/push.rocks/smartproxy#readme",
   "repository": {

readme.md

@@ -1,6 +1,6 @@
 # @push.rocks/smartproxy
 
-A proxy for handling high workloads of proxying.
+A robust and versatile proxy package designed to handle high workloads, offering features like SSL redirection, port proxying, WebSocket support, and customizable routing and authentication.
 
 ## Install
 
@@ -14,19 +14,19 @@ This will add `@push.rocks/smartproxy` to your project's dependencies.
 
 ## Usage
 
-`@push.rocks/smartproxy` is a comprehensive and versatile package designed to handle complex and high-volume proxying tasks efficiently. It includes features such as SSL redirection, port proxying, WebSocket support, and customizable routing and authentication mechanisms. This guide will provide a detailed walkthrough of how to harness these capabilities effectively. 
+`@push.rocks/smartproxy` is a comprehensive package that provides advanced functionalities for handling proxy tasks efficiently, including SSL redirection, port proxying, WebSocket support, and dynamic routing with authentication capabilities. Here is an extensive guide on how to utilize these features effectively, ensuring robust and secure proxy operations.
 
 ### Initial Setup
 
-Before diving into specific features, let's start by configuring and setting up our basic proxy server:
+Before exploring the advanced features of `smartproxy`, you need to set up a basic proxy server. This setup serves as the foundation for incorporating additional functionalities later on:
 
 ```typescript
 import { NetworkProxy } from '@push.rocks/smartproxy';
 
-// Instantiate the NetworkProxy with desired options
+// Create an instance of NetworkProxy with the desired configuration
 const myNetworkProxy = new NetworkProxy({ port: 443 });
 
-// Define reverse proxy configurations
+// Define reverse proxy configurations for the domains you wish to proxy
 const proxyConfigs = [
   {
     destinationIp: '127.0.0.1',
@@ -39,16 +39,16 @@ PRIVATE_KEY_CONTENT
 CERTIFICATE_CONTENT
 -----END CERTIFICATE-----`,
   },
-  // More configurations can be added here
+  // Additional configurations can be added here
 ];
 
-// Start the network proxy
+// Start the network proxy to enable forwarding
 await myNetworkProxy.start();
 
-// Apply proxy configurations
+// Apply the configurations you defined earlier
 await myNetworkProxy.updateProxyConfigs(proxyConfigs);
 
-// Optionally add default headers to all responses
+// Optionally, you can set default headers to be included in all responses
 await myNetworkProxy.addDefaultHeaders({
   'X-Powered-By': 'smartproxy',
 });
@@ -56,44 +56,45 @@ await myNetworkProxy.addDefaultHeaders({
 
 ### Configuring SSL Redirection
 
-One essential capability of a robust proxy server is ensuring that all HTTP traffic is redirected to secure HTTPS endpoints. This can be effortlessly accomplished using the `SslRedirect` class within `smartproxy`. This class listens on port 80 (HTTP) and redirects all incoming requests to HTTPS:
+A critical feature of modern proxy servers is the ability to redirect HTTP traffic to secure HTTPS endpoints. The `SslRedirect` class in `smartproxy` simplifies this process by automatically redirecting requests from HTTP port 80 to HTTPS:
 
 ```typescript
 import { SslRedirect } from '@push.rocks/smartproxy';
 
-// Instantiate the SslRedirect for listening on port 80
+// Create an SslRedirect instance to listen on port 80
 const mySslRedirect = new SslRedirect(80);
 
-// Start listening and redirect HTTP traffic to HTTPS
+// Start the redirect to enforce HTTPS
 await mySslRedirect.start();
 
-// To stop redirection, you can use the following command:
+// To stop HTTP redirection, use the following command:
 await mySslRedirect.stop();
 ```
 
-### Handling Complex Networking with Port Proxy
+### Managing Port Proxying
 
-Port proxying allows redirection of traffic from one port to another. This capability is crucial when dealing with services that need dynamic port forwarding, or when adapting to infrastructure changes without downtime. Smartproxy's `PortProxy` class handles this efficiently:
+Port proxying is essential for forwarding traffic from one port to another, an important feature for services that require dynamic port changes without downtime. Smartproxy's `PortProxy` class efficiently handles these scenarios:
 
 ```typescript
 import { PortProxy } from '@push.rocks/smartproxy';
 
-// Create a PortProxy to directly forward traffic from port 5000 to 3000
+// Set up a PortProxy to forward traffic from port 5000 to 3000
 const myPortProxy = new PortProxy(5000, 3000);
 
 // Initiate the port proxy
 await myPortProxy.start();
 
-// To stop the port proxy mechanism:
+// To halt the port proxy, execute:
 await myPortProxy.stop();
 ```
 
-Additionally, smartproxy's port proxying can support intricate scenarios where different forwarding rules are configured based on domain names or allowed IPs:
+For more intricate setups—such as forwarding based on specific domain rules or IP allowances—smartproxy allows detailed configurations:
 
 ```typescript
 import { PortProxy } from '@push.rocks/smartproxy';
 
-const myComplexPortProxy = new PortProxy({
+// Configure complex port proxy rules
+const advancedPortProxy = new PortProxy({
   fromPort: 6000,
   toPort: 3000,
   domains: [
@@ -102,57 +103,60 @@ const myComplexPortProxy = new PortProxy({
       allowedIPs: ['192.168.0.*', '127.0.0.1'],
       targetIP: '192.168.1.100'
     }
-    // Define more domain-specific rules if needed
+    // Additional domain rules can be added as needed
   ],
-  sniEnabled: true,  // if SNI (Server Name Indication) is desired
-  defaultAllowedIPs: ['*']);
+  sniEnabled: true,  // Server Name Indication (SNI) support
+  defaultAllowedIPs: ['*'],
 });
 
-// Start listening for complex routing requests
-await myComplexPortProxy.start();
+// Activate the proxy with conditional rules
+await advancedPortProxy.start();
 ```
 
-### WebSocket Support and Load Handling
+### WebSocket Handling
 
-With the advent of real-time applications, efficient WebSocket handling in proxies is crucial. Smartproxy integrates WebSocket support seamlessly, enabling it to proxy WebSocket traffic while maintaining security and performance:
+With real-time applications becoming more prevalent, effective WebSocket handling is crucial in a proxy server. Smartproxy natively incorporates WebSocket support to manage WebSocket traffic securely and efficiently:
 
 ```typescript
 import { NetworkProxy } from '@push.rocks/smartproxy';
 
-const wsProxy = new NetworkProxy({ port: 443 });
+// Create a NetworkProxy instance for WebSocket traffic
+const wsNetworkProxy = new NetworkProxy({ port: 443 });
 
-// Assume reverse proxy configurations with WebSocket intentions
-const wsProxyConfigs = [
+// Define proxy configurations targeted for WebSocket traffic
+const websocketConfig = [
   {
     destinationIp: '127.0.0.1',
     destinationPort: '8080',
     hostName: 'socket.example.com',
-    // Add further options such as keys for SSL if needed
+    // Include SSL details if necessary
   }
 ];
 
-// Start the network proxy with WebSocket capabilities
-await wsProxy.start();
-await wsProxy.updateProxyConfigs(wsProxyConfigs);
+// Start the proxy and apply WebSocket settings
+await wsNetworkProxy.start();
+await wsNetworkProxy.updateProxyConfigs(websocketConfig);
 
-// Ensure WebSocket connections remain alive
-wsProxy.heartbeatInterval = setInterval(() => {
-  // logic for keeping connections alive and healthy
-}, 60000); // Every 60 seconds
+// Set heartbeat intervals to maintain WebSocket connections
+wsNetworkProxy.heartbeatInterval = setInterval(() => {
+  // Logic for connection health checks
+}, 60000); // every minute
 
-// Gracefully handle server or connection errors to maintain uptime
-wsProxy.httpsServer.on('error', (error) => console.log('Server Error:', error));
+// Capture and handle server errors for resiliency
+wsNetworkProxy.httpsServer.on('error', (error) => console.log('Server Error:', error));
 ```
 
-### Comprehensive Routing and Advanced Features
+### Advanced Routing and Custom Features
 
-Smartproxy supports dynamic and customizable request routing based on the incoming request's destination. This feature enables extensive use-case scenarios, from simple API endpoint redirection to elaborate B2B service integrations:
+Smartproxy shines with its dynamic routing capabilities, allowing for custom and advanced request routing based on the request's destination. This enables extensive flexibility, such as directing API requests or facilitating intricate B2B integrations:
 
 ```typescript
 import { NetworkProxy } from '@push.rocks/smartproxy';
 
-const dynamicRoutingProxy = new NetworkProxy({ port: 8443 });
-dynamicRoutingProxy.router.setNewProxyConfigs([
+// Instantiate a proxy with dynamic routing
+const routeProxy = new NetworkProxy({ port: 8443 });
+
+routeProxy.router.setNewProxyConfigs([
   {
     destinationIp: '192.168.1.150',
     destinationPort: '80',
@@ -165,57 +169,60 @@ dynamicRoutingProxy.router.setNewProxyConfigs([
   }
 ]);
 
-await dynamicRoutingProxy.start();
+// Activate the routing proxy
+await routeProxy.start();
 ```
 
-For those dealing with high volume or regulatory needs, the integration of tools like `iptables` allows broad control over network traffic:
+For those who require granular traffic control, integrating tools like `iptables` offers additional power over network management:
 
 ```typescript
 import { IPTablesProxy } from '@push.rocks/smartproxy';
 
-// Setting up iptables for advanced network management
-const ipTablesProxy = new IPTablesProxy({
+// Set up IPTables for sophisticated network traffic management
+const iptablesProxy = new IPTablesProxy({
   fromPort: 8081,
   toPort: 8080,
-  deleteOnExit: true // clean rules upon server shutdown
+  deleteOnExit: true // Clean up rules when the server shuts down
 });
 
-// Begin routing with IPTables
-await ipTablesProxy.start();
+// Enable routing through IPTables
+await iptablesProxy.start();
 ```
 
-### Combining with HTTP and HTTPS Credentials
+### Integrating SSL and HTTP/HTTPS Credentials
 
-When undertaking proxy configurations, handling sensitive data like SSL certificates and keys securely is imperative:
+Handling sensitive data like SSL keys and certificates securely is crucial in proxy configurations:
 
 ```typescript
 import { loadDefaultCertificates } from '@push.rocks/smartproxy';
 
 try {
-  const { privateKey, publicKey } = loadDefaultCertificates(); // adjust path as needed
-  console.log('Certificates loaded.');
-  // Use these certificates in your SSL-based configurations
+  const { privateKey, publicKey } = loadDefaultCertificates(); // Adjust path if necessary
+  console.log('SSL certificates loaded successfully.');
+  // Use these credentials in your configurations
 } catch (error) {
-  console.error('Cannot load certificates:', error);
+  console.error('Error loading certificates:', error);
 }
 ```
 
 ### Testing and Validation
 
-Given these powerful capabilities, rigorous testing of configurations and functionality using frameworks like `tap` can ensure high-quality and reliable proxy configurations. Smartproxy integrates with Typescript test setups:
+Smartproxy supports extensive testing to ensure your proxy configurations operate as expected. Leveraging `tap` alongside TypeScript testing frameworks supports quality assurance:
 
 ```typescript
 import { expect, tap } from '@push.rocks/tapbundle';
 import { NetworkProxy } from '@push.rocks/smartproxy';
 
-tap.test('proxied request should return status 200', async () => {
-  // Your test logic here
+tap.test('Check proxied request returns status 200', async () => {
+  // Testing logic
 });
 
 tap.start();
 ```
 
-In summary, `@push.rocks/smartproxy` offers a plethora of solutions tailored to both common and sophisticated proxying needs. Whether you're seeking straightforward port forwarding, secure SSL redirection, WebSocket management, or robust network routing controls, smartproxy provides the right tools for efficient and effective proxy operations. Through its integration simplicity and versatile configurations, developers can ensure high performance and secure proxying across various environments and applications.
+### Conclusion
+
+`@push.rocks/smartproxy` is designed for both simple and complex proxying demands, offering tools for high-performance and secure proxy management across diverse environments. Its efficient configurations are capable of supporting SSL redirection, WebSocket traffic, dynamic routing, and other advanced functionalities, making it indispensable for developers seeking robust and adaptable proxy solutions. By integrating these capabilities with ease of use, `smartproxy` stands out as an essential tool in modern software architecture.
 
 ## License and Legal Information
 

test/test.portproxy.ts

@@ -8,85 +8,79 @@ const TEST_SERVER_PORT = 4000;
 const PROXY_PORT = 4001;
 const TEST_DATA = 'Hello through port proxy!';
 
-// Helper function to create a test TCP server
-function createTestServer(port: number): Promise<net.Server> {
+// Helper: Creates a test TCP server that listens on a given port and host.
+function createTestServer(port: number, host: string = 'localhost'): Promise<net.Server> {
   return new Promise((resolve) => {
     const server = net.createServer((socket) => {
       socket.on('data', (data) => {
-        // Echo the received data back
+        // Echo the received data back with a prefix.
         socket.write(`Echo: ${data.toString()}`);
       });
-
       socket.on('error', (error) => {
-        console.error('[Test Server] Socket error:', error);
+        console.error(`[Test Server] Socket error on ${host}:${port}:`, error);
       });
     });
-
-    server.listen(port, () => {
-      console.log(`[Test Server] Listening on port ${port}`);
+    server.listen(port, host, () => {
+      console.log(`[Test Server] Listening on ${host}:${port}`);
       resolve(server);
     });
   });
 }
 
-// Helper function to create a test client connection
+// Helper: Creates a test client connection.
 function createTestClient(port: number, data: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const client = new net.Socket();
     let response = '';
-
     client.connect(port, 'localhost', () => {
       console.log('[Test Client] Connected to server');
       client.write(data);
     });
-
     client.on('data', (chunk) => {
       response += chunk.toString();
       client.end();
     });
-
-    client.on('end', () => {
-      resolve(response);
-    });
-
-    client.on('error', (error) => {
-      reject(error);
-    });
+    client.on('end', () => resolve(response));
+    client.on('error', (error) => reject(error));
   });
 }
 
-// Setup test environment
+// SETUP: Create a test server and a PortProxy instance.
 tap.test('setup port proxy test environment', async () => {
   testServer = await createTestServer(TEST_SERVER_PORT);
   portProxy = new PortProxy({
     fromPort: PROXY_PORT,
     toPort: TEST_SERVER_PORT,
-    toHost: 'localhost',
-    domains: [],
+    targetIP: 'localhost',
+    domainConfigs: [],
     sniEnabled: false,
-    defaultAllowedIPs: ['127.0.0.1']
+    defaultAllowedIPs: ['127.0.0.1'],
+    globalPortRanges: []
   });
 });
 
+// Test that the proxy starts and its servers are listening.
 tap.test('should start port proxy', async () => {
   await portProxy.start();
-  expect(portProxy.netServer.listening).toBeTrue();
+  expect((portProxy as any).netServers.every((server: net.Server) => server.listening)).toBeTrue();
 });
 
+// Test basic TCP forwarding.
 tap.test('should forward TCP connections and data to localhost', async () => {
   const response = await createTestClient(PROXY_PORT, TEST_DATA);
   expect(response).toEqual(`Echo: ${TEST_DATA}`);
 });
 
+// Test proxy with a custom target host.
 tap.test('should forward TCP connections to custom host', async () => {
-  // Create a new proxy instance with a custom host
   const customHostProxy = new PortProxy({
     fromPort: PROXY_PORT + 1,
     toPort: TEST_SERVER_PORT,
-    toHost: '127.0.0.1',
-    domains: [],
+    targetIP: '127.0.0.1',
+    domainConfigs: [],
     sniEnabled: false,
-    defaultAllowedIPs: ['127.0.0.1']
+    defaultAllowedIPs: ['127.0.0.1'],
+    globalPortRanges: []
   });
   
   await customHostProxy.start();
@@ -95,148 +89,151 @@ tap.test('should forward TCP connections to custom host', async () => {
   await customHostProxy.stop();
 });
 
-tap.test('should forward connections based on domain-specific target IP', async () => {
-  // Create a second test server on a different port
-  const TEST_SERVER_PORT_2 = TEST_SERVER_PORT + 100;
-  const testServer2 = await createTestServer(TEST_SERVER_PORT_2);
+// Test forced domain routing via port-range configuration.
+// In this test, we want to forward to a different IP (using '127.0.0.2')
+// while keeping the same port. We create a test server on '127.0.0.2'.
+tap.test('should forward connections based on domain-specific target IP (forced domain via port-range)', async () => {
+  const forcedProxyPort = PROXY_PORT + 2;
+  // Create a test server listening on '127.0.0.2' at forcedProxyPort.
+  const testServer2 = await createTestServer(forcedProxyPort, '127.0.0.2');
 
-  // Create a proxy with domain-specific target IPs
   const domainProxy = new PortProxy({
-    fromPort: PROXY_PORT + 2,
-    toPort: TEST_SERVER_PORT,  // default port
-    toHost: 'localhost',       // default host
-    domains: [{
-      domain: 'domain1.test',
+    fromPort: forcedProxyPort,
+    toPort: TEST_SERVER_PORT, // default target port (unused for forced domain)
+    targetIP: 'localhost',
+    domainConfigs: [{
+      domains: ['forced.test'],
       allowedIPs: ['127.0.0.1'],
-      targetIP: '127.0.0.1'
-    }, {
-      domain: 'domain2.test',
-      allowedIPs: ['127.0.0.1'],
-      targetIP: 'localhost'
+      targetIPs: ['127.0.0.2'], // Use a different IP than the default.
+      portRanges: [{ from: forcedProxyPort, to: forcedProxyPort }]
     }],
-    sniEnabled: false, // We'll test without SNI first since this is a TCP proxy test
-    defaultAllowedIPs: ['127.0.0.1']
+    sniEnabled: false,
+    defaultAllowedIPs: ['127.0.0.1'],
+    globalPortRanges: [{ from: forcedProxyPort, to: forcedProxyPort }]
   });
 
   await domainProxy.start();
 
-  // Test default connection (should use default host)
-  const response1 = await createTestClient(PROXY_PORT + 2, TEST_DATA);
-  expect(response1).toEqual(`Echo: ${TEST_DATA}`);
-
-  // Create another proxy with different default host
-  const domainProxy2 = new PortProxy({
-    fromPort: PROXY_PORT + 3,
-    toPort: TEST_SERVER_PORT,
-    toHost: '127.0.0.1',
-    domains: [],
-    sniEnabled: false,
-    defaultAllowedIPs: ['127.0.0.1']
-  });
-
-  await domainProxy2.start();
-  const response2 = await createTestClient(PROXY_PORT + 3, TEST_DATA);
-  expect(response2).toEqual(`Echo: ${TEST_DATA}`);
+  // When connecting to forcedProxyPort, forced domain handling triggers,
+  // so the proxy will connect to '127.0.0.2' on the same port.
+  const response = await createTestClient(forcedProxyPort, TEST_DATA);
+  expect(response).toEqual(`Echo: ${TEST_DATA}`);
 
   await domainProxy.stop();
-  await domainProxy2.stop();
   await new Promise<void>((resolve) => testServer2.close(() => resolve()));
 });
 
+// Test handling of multiple concurrent connections.
 tap.test('should handle multiple concurrent connections', async () => {
   const concurrentRequests = 5;
-  const requests = Array(concurrentRequests).fill(null).map((_, i) => 
+  const requests = Array(concurrentRequests).fill(null).map((_, i) =>
     createTestClient(PROXY_PORT, `${TEST_DATA} ${i + 1}`)
   );
-  
   const responses = await Promise.all(requests);
-  
   responses.forEach((response, i) => {
     expect(response).toEqual(`Echo: ${TEST_DATA} ${i + 1}`);
   });
 });
 
+// Test connection timeout handling.
 tap.test('should handle connection timeouts', async () => {
   const client = new net.Socket();
-  
   await new Promise<void>((resolve) => {
     client.connect(PROXY_PORT, 'localhost', () => {
-      // Don't send any data, just wait for timeout
-      client.on('close', () => {
-        resolve();
-      });
+      // Do not send any data to trigger a timeout.
+      client.on('close', () => resolve());
     });
   });
 });
 
+// Test stopping the port proxy.
 tap.test('should stop port proxy', async () => {
   await portProxy.stop();
-  expect(portProxy.netServer.listening).toBeFalse();
+  expect((portProxy as any).netServers.every((server: net.Server) => !server.listening)).toBeTrue();
 });
 
-// Cleanup
+// Test chained proxies with and without source IP preservation.
 tap.test('should support optional source IP preservation in chained proxies', async () => {
-  // Test 1: Without IP preservation (default behavior)
+  // Chained proxies without IP preservation.
   const firstProxyDefault = new PortProxy({
     fromPort: PROXY_PORT + 4,
     toPort: PROXY_PORT + 5,
-    toHost: 'localhost',
-    domains: [],
+    targetIP: 'localhost',
+    domainConfigs: [],
     sniEnabled: false,
-    defaultAllowedIPs: ['127.0.0.1', '::ffff:127.0.0.1']
+    defaultAllowedIPs: ['127.0.0.1', '::ffff:127.0.0.1'],
+    globalPortRanges: []
   });
-
   const secondProxyDefault = new PortProxy({
     fromPort: PROXY_PORT + 5,
     toPort: TEST_SERVER_PORT,
-    toHost: 'localhost',
-    domains: [],
+    targetIP: 'localhost',
+    domainConfigs: [],
     sniEnabled: false,
-    defaultAllowedIPs: ['127.0.0.1', '::ffff:127.0.0.1']
+    defaultAllowedIPs: ['127.0.0.1', '::ffff:127.0.0.1'],
+    globalPortRanges: []
   });
-
   await secondProxyDefault.start();
   await firstProxyDefault.start();
-
-  // This should work because we explicitly allow both IPv4 and IPv6 formats
   const response1 = await createTestClient(PROXY_PORT + 4, TEST_DATA);
   expect(response1).toEqual(`Echo: ${TEST_DATA}`);
-
   await firstProxyDefault.stop();
   await secondProxyDefault.stop();
 
-  // Test 2: With IP preservation
+  // Chained proxies with IP preservation.
   const firstProxyPreserved = new PortProxy({
     fromPort: PROXY_PORT + 6,
     toPort: PROXY_PORT + 7,
-    toHost: 'localhost',
-    domains: [],
+    targetIP: 'localhost',
+    domainConfigs: [],
     sniEnabled: false,
     defaultAllowedIPs: ['127.0.0.1'],
-    preserveSourceIP: true
+    preserveSourceIP: true,
+    globalPortRanges: []
   });
-
   const secondProxyPreserved = new PortProxy({
     fromPort: PROXY_PORT + 7,
     toPort: TEST_SERVER_PORT,
-    toHost: 'localhost',
-    domains: [],
+    targetIP: 'localhost',
+    domainConfigs: [],
     sniEnabled: false,
     defaultAllowedIPs: ['127.0.0.1'],
-    preserveSourceIP: true
+    preserveSourceIP: true,
+    globalPortRanges: []
   });
-
   await secondProxyPreserved.start();
   await firstProxyPreserved.start();
-
-  // This should work with just IPv4 because source IP is preserved
   const response2 = await createTestClient(PROXY_PORT + 6, TEST_DATA);
   expect(response2).toEqual(`Echo: ${TEST_DATA}`);
-
   await firstProxyPreserved.stop();
   await secondProxyPreserved.stop();
 });
 
+// Test round-robin behavior for multiple target IPs in a domain config.
+tap.test('should use round robin for multiple target IPs in domain config', async () => {
+  const domainConfig = {
+    domains: ['rr.test'],
+    allowedIPs: ['127.0.0.1'],
+    targetIPs: ['hostA', 'hostB']
+  } as any;
+  
+  const proxyInstance = new PortProxy({
+    fromPort: 0,
+    toPort: 0,
+    targetIP: 'localhost',
+    domainConfigs: [domainConfig],
+    sniEnabled: false,
+    defaultAllowedIPs: [],
+    globalPortRanges: []
+  });
+  
+  const firstTarget = (proxyInstance as any).getTargetIP(domainConfig);
+  const secondTarget = (proxyInstance as any).getTargetIP(domainConfig);
+  expect(firstTarget).toEqual('hostA');
+  expect(secondTarget).toEqual('hostB');
+});
+
+// CLEANUP: Tear down the test server.
 tap.test('cleanup port proxy test environment', async () => {
   await new Promise<void>((resolve) => testServer.close(() => resolve()));
 });
@@ -245,9 +242,9 @@ process.on('exit', () => {
   if (testServer) {
     testServer.close();
   }
-  if (portProxy && portProxy.netServer) {
+  if (portProxy && (portProxy as any).netServers) {
     portProxy.stop();
   }
 });
 
-export default tap.start();
+export default tap.start();

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '3.16.1',
-  description: 'A robust and versatile proxy package designed to handle high workloads, offering features like SSL redirection, port proxying, WebSocket support, and customizable routing and authentication.'
+  version: '3.19.0',
+  description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
 }

ts/classes.portproxy.ts

@@ -1,11 +1,12 @@
 import * as plugins from './plugins.js';
 
-/** Domain configuration with per‐domain allowed port ranges */
+/** Domain configuration with per-domain allowed port ranges */
 export interface IDomainConfig {
-  domain: string;         // Glob pattern for domain
-  allowedIPs: string[];   // Glob patterns for allowed IPs
-  targetIP?: string;      // Optional target IP for this domain
-  portRanges?: Array<{ from: number; to: number }>; // Optional domain-specific allowed port ranges
+  domains: string[];         // Glob patterns for domain(s)
+  allowedIPs: string[];      // Glob patterns for allowed IPs
+  blockedIPs?: string[];     // Glob patterns for blocked IPs
+  targetIPs?: string[];      // If multiple targetIPs are given, use round robin.
+  portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
 }
 
 /** Port proxy settings including global allowed port ranges */
@@ -13,9 +14,10 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   fromPort: number;
   toPort: number;
   targetIP?: string; // Global target host to proxy to, defaults to 'localhost'
-  domains: IDomainConfig[];
+  domainConfigs: IDomainConfig[];
   sniEnabled?: boolean;
   defaultAllowedIPs?: string[];
+  defaultBlockedIPs?: string[];
   preserveSourceIP?: boolean;
   maxConnectionLifetime?: number; // (ms) force cleanup of long-lived connections
   globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
@@ -90,17 +92,51 @@ interface IConnectionRecord {
   outgoing: plugins.net.Socket | null;
   incomingStartTime: number;
   outgoingStartTime?: number;
+  lockedDomain?: string; // New field to lock this connection to the initial SNI
   connectionClosed: boolean;
   cleanupTimer?: NodeJS.Timeout; // Timer to force cleanup after max lifetime/inactivity
 }
 
+// Helper: Check if a port falls within any of the given port ranges.
+const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
+  return ranges.some(range => port >= range.from && port <= range.to);
+};
+
+// Helper: Check if a given IP matches any of the glob patterns.
+const isAllowed = (ip: string, patterns: string[]): boolean => {
+  const normalizeIP = (ip: string): string[] => {
+    if (ip.startsWith('::ffff:')) {
+      const ipv4 = ip.slice(7);
+      return [ip, ipv4];
+    }
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
+      return [ip, `::ffff:${ip}`];
+    }
+    return [ip];
+  };
+  const normalizedIPVariants = normalizeIP(ip);
+  const expandedPatterns = patterns.flatMap(normalizeIP);
+  return normalizedIPVariants.some(ipVariant =>
+    expandedPatterns.some(pattern => plugins.minimatch(ipVariant, pattern))
+  );
+};
+
+// Helper: Check if an IP is allowed considering allowed and blocked glob patterns.
+const isGlobIPAllowed = (ip: string, allowed: string[], blocked: string[] = []): boolean => {
+  if (blocked.length > 0 && isAllowed(ip, blocked)) return false;
+  return isAllowed(ip, allowed);
+};
+
 export class PortProxy {
-  netServer: plugins.net.Server;
+  private netServers: plugins.net.Server[] = [];
   settings: IPortProxySettings;
   // Unified record tracking each connection pair.
   private connectionRecords: Set<IConnectionRecord> = new Set();
   private connectionLogger: NodeJS.Timeout | null = null;
 
+  // Map to track round robin indices for each domain config.
+  private domainTargetIndices: Map<IDomainConfig, number> = new Map();
+
   private terminationStats: {
     incoming: Record<string, number>;
     outgoing: Record<string, number>;
@@ -121,44 +157,19 @@ export class PortProxy {
     this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
   }
 
+  private getTargetIP(domainConfig: IDomainConfig): string {
+    if (domainConfig.targetIPs && domainConfig.targetIPs.length > 0) {
+      const currentIndex = this.domainTargetIndices.get(domainConfig) || 0;
+      const ip = domainConfig.targetIPs[currentIndex % domainConfig.targetIPs.length];
+      this.domainTargetIndices.set(domainConfig, currentIndex + 1);
+      return ip;
+    }
+    return this.settings.targetIP!;
+  }
+
   public async start() {
-    // Helper to forcefully destroy sockets.
-    const cleanUpSockets = (socketA: plugins.net.Socket, socketB?: plugins.net.Socket) => {
-      if (!socketA.destroyed) socketA.destroy();
-      if (socketB && !socketB.destroyed) socketB.destroy();
-    };
-
-    // Normalize an IP to include both IPv4 and IPv6 representations.
-    const normalizeIP = (ip: string): string[] => {
-      if (ip.startsWith('::ffff:')) {
-        const ipv4 = ip.slice(7);
-        return [ip, ipv4];
-      }
-      if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
-        return [ip, `::ffff:${ip}`];
-      }
-      return [ip];
-    };
-
-    // Check if a given IP matches any of the glob patterns.
-    const isAllowed = (ip: string, patterns: string[]): boolean => {
-      const normalizedIPVariants = normalizeIP(ip);
-      const expandedPatterns = patterns.flatMap(normalizeIP);
-      return normalizedIPVariants.some(ipVariant =>
-        expandedPatterns.some(pattern => plugins.minimatch(ipVariant, pattern))
-      );
-    };
-
-    // Check if a port falls within any of the given port ranges.
-    const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
-      return ranges.some(range => port >= range.from && port <= range.to);
-    };
-
-    // Find a matching domain config based on SNI (fallback when port ranges aren’t used)
-    const findMatchingDomain = (serverName: string): IDomainConfig | undefined =>
-      this.settings.domains.find(config => plugins.minimatch(serverName, config.domain));
-
-    this.netServer = plugins.net.createServer((socket: plugins.net.Socket) => {
+    // Define a unified connection handler for all listening ports.
+    const connectionHandler = (socket: plugins.net.Socket) => {
       const remoteIP = socket.remoteAddress || '';
       const localPort = socket.localPort; // The port on which this connection was accepted.
       const connectionRecord: IConnectionRecord = {
@@ -175,13 +186,14 @@ export class PortProxy {
       let outgoingTerminationReason: string | null = null;
 
       // Ensure cleanup happens only once for the entire connection record.
-      const cleanupOnce = () => {
+      const cleanupOnce = async () => {
         if (!connectionRecord.connectionClosed) {
           connectionRecord.connectionClosed = true;
           if (connectionRecord.cleanupTimer) {
             clearTimeout(connectionRecord.cleanupTimer);
           }
-          cleanUpSockets(connectionRecord.incoming, connectionRecord.outgoing || undefined);
+          if (!socket.destroyed) socket.destroy();
+          if (connectionRecord.outgoing && !connectionRecord.outgoing.destroyed) connectionRecord.outgoing.destroy();
           this.connectionRecords.delete(connectionRecord);
           console.log(`Connection from ${remoteIP} terminated. Active connections: ${this.connectionRecords.size}`);
         }
@@ -241,26 +253,39 @@ export class PortProxy {
        * @param serverName - The SNI hostname (unused when forcedDomain is provided).
        * @param initialChunk - Optional initial data chunk.
        * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
+       * @param overridePort - If provided, use this port for the outgoing connection (typically the same as the incoming port).
        */
-      const setupConnection = (serverName: string, initialChunk?: Buffer, forcedDomain?: IDomainConfig) => {
+      const setupConnection = (serverName: string, initialChunk?: Buffer, forcedDomain?: IDomainConfig, overridePort?: number) => {
         // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
-        const domainConfig = forcedDomain ? forcedDomain : (serverName ? findMatchingDomain(serverName) : undefined);
-        const defaultAllowed = this.settings.defaultAllowedIPs && isAllowed(remoteIP, this.settings.defaultAllowedIPs);
+        const domainConfig = forcedDomain
+          ? forcedDomain
+          : (serverName ? this.settings.domainConfigs.find(config =>
+              config.domains.some(d => plugins.minimatch(serverName, d))
+            ) : undefined);
 
-        if (!defaultAllowed && serverName && !forcedDomain) {
-          if (!domainConfig) {
-            return rejectIncomingConnection('rejected', `Connection rejected: No matching domain config for ${serverName} from ${remoteIP}`);
+        // Effective IP check: merge allowed IPs with default allowed, and remove blocked IPs.
+        if (domainConfig) {
+          const effectiveAllowedIPs: string[] = [
+            ...domainConfig.allowedIPs,
+            ...(this.settings.defaultAllowedIPs || [])
+          ];
+          const effectiveBlockedIPs: string[] = [
+            ...(domainConfig.blockedIPs || []),
+            ...(this.settings.defaultBlockedIPs || [])
+          ];
+          if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
+            return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(', ')}`);
           }
-          if (!isAllowed(remoteIP, domainConfig.allowedIPs)) {
-            return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for domain ${serverName}`);
+        } else if (this.settings.defaultAllowedIPs) {
+          if (!isGlobIPAllowed(remoteIP, this.settings.defaultAllowedIPs, this.settings.defaultBlockedIPs || [])) {
+            return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed by default allowed list`);
           }
-        } else if (defaultAllowed && !serverName) {
-          console.log(`Connection allowed: IP ${remoteIP} is in default allowed list`);
         }
-        const targetHost = domainConfig?.targetIP || this.settings.targetIP!;
+
+        const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
         const connectionOptions: plugins.net.NetConnectOpts = {
           host: targetHost,
-          port: this.settings.toPort,
+          port: overridePort !== undefined ? overridePort : this.settings.toPort,
         };
         if (this.settings.preserveSourceIP) {
           connectionOptions.localAddress = remoteIP.replace('::ffff:', '');
@@ -271,8 +296,8 @@ export class PortProxy {
         connectionRecord.outgoingStartTime = Date.now();
 
         console.log(
-          `Connection established: ${remoteIP} -> ${targetHost}:${this.settings.toPort}` +
-          `${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domain})` : ''}`
+          `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+          `${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}`
         );
 
         if (initialChunk) {
@@ -344,15 +369,9 @@ export class PortProxy {
       };
 
       // --- PORT RANGE-BASED HANDLING ---
-      // If global port ranges are defined, enforce port-based routing and ignore SNI.
-      if (this.settings.globalPortRanges && this.settings.globalPortRanges.length > 0) {
-        if (!isPortInRanges(localPort, this.settings.globalPortRanges)) {
-          console.log(`Connection from ${remoteIP} rejected: port ${localPort} is not in global allowed ranges.`);
-          socket.destroy();
-          return;
-        }
+      // Only apply port-based rules if the incoming port is within one of the global port ranges.
+      if (this.settings.globalPortRanges && isPortInRanges(localPort, this.settings.globalPortRanges)) {
         if (this.settings.forwardAllGlobalRanges) {
-          // Forward connection to the global targetIP regardless of domain config.
           if (this.settings.defaultAllowedIPs && !isAllowed(remoteIP, this.settings.defaultAllowedIPs)) {
             console.log(`Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`);
             socket.end();
@@ -360,37 +379,33 @@ export class PortProxy {
           }
           console.log(`Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`);
           setupConnection('', undefined, {
-            domain: 'global',
+            domains: ['global'],
             allowedIPs: this.settings.defaultAllowedIPs || [],
-            targetIP: this.settings.targetIP,
+            blockedIPs: this.settings.defaultBlockedIPs || [],
+            targetIPs: [this.settings.targetIP!],
             portRanges: []
-          });
+          }, localPort);
           return;
         } else {
-          // Find a matching domain config based on the incoming local port.
-          const forcedDomain = this.settings.domains.find(
+          // Attempt to find a matching forced domain config based on the local port.
+          const forcedDomain = this.settings.domainConfigs.find(
             domain => domain.portRanges && domain.portRanges.length > 0 && isPortInRanges(localPort, domain.portRanges)
           );
-          if (!forcedDomain) {
-            console.log(`Connection from ${remoteIP} rejected: port ${localPort} not configured in any domain's portRanges.`);
-            socket.destroy();
+          if (forcedDomain) {
+            if (!isAllowed(remoteIP, forcedDomain.allowedIPs)) {
+              console.log(`Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(', ')} on port ${localPort}.`);
+              socket.end();
+              return;
+            }
+            console.log(`Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(', ')}.`);
+            setupConnection('', undefined, forcedDomain, localPort);
             return;
           }
-          // Check allowed IPs for the forced domain.
-          const defaultAllowed = this.settings.defaultAllowedIPs && isAllowed(remoteIP, this.settings.defaultAllowedIPs);
-          if (!defaultAllowed && !isAllowed(remoteIP, forcedDomain.allowedIPs)) {
-            console.log(`Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domain} on port ${localPort}.`);
-            socket.end();
-            return;
-          }
-          console.log(`Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domain}.`);
-          // Proceed immediately using the forced domain; ignore SNI.
-          setupConnection('', undefined, forcedDomain);
-          return;
+          // Fall through to SNI/default handling if no forced domain config is found.
         }
       }
 
-      // --- FALLBACK: SNI-BASED HANDLING (if no global port ranges are defined) ---
+      // --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
       if (this.settings.sniEnabled) {
         socket.setTimeout(5000, () => {
           console.log(`Initial data timeout for ${remoteIP}`);
@@ -402,7 +417,22 @@ export class PortProxy {
           socket.setTimeout(0);
           initialDataReceived = true;
           const serverName = extractSNI(chunk) || '';
+          // Lock the connection to the negotiated SNI.
+          connectionRecord.lockedDomain = serverName;
           console.log(`Received connection from ${remoteIP} with SNI: ${serverName}`);
+          // Delay adding the renegotiation listener until the next tick,
+          // so the initial ClientHello is not reprocessed.
+          setImmediate(() => {
+            socket.on('data', (renegChunk: Buffer) => {
+              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+                const newSNI = extractSNI(renegChunk);
+                if (newSNI && newSNI !== connectionRecord.lockedDomain) {
+                  console.log(`Rehandshake detected with different SNI: ${newSNI} vs locked ${connectionRecord.lockedDomain}. Terminating connection.`);
+                  cleanupOnce();
+                }
+              }
+            });
+          });
           setupConnection(serverName, chunk);
         });
       } else {
@@ -412,16 +442,36 @@ export class PortProxy {
         }
         setupConnection('');
       }
-    })
-      .on('error', (err: Error) => {
-        console.log(`Server Error: ${err.message}`);
-      })
-      .listen(this.settings.fromPort, () => {
-        console.log(
-          `PortProxy -> OK: Now listening on port ${this.settings.fromPort}` +
-          `${this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''}`
-        );
+    };
+
+    // --- SETUP LISTENERS ---
+    // Determine which ports to listen on.
+    const listeningPorts = new Set<number>();
+    if (this.settings.globalPortRanges && this.settings.globalPortRanges.length > 0) {
+      // Listen on every port defined by the global ranges.
+      for (const range of this.settings.globalPortRanges) {
+        for (let port = range.from; port <= range.to; port++) {
+          listeningPorts.add(port);
+        }
+      }
+      // Also ensure the default fromPort is listened to if it isn't already in the ranges.
+      listeningPorts.add(this.settings.fromPort);
+    } else {
+      listeningPorts.add(this.settings.fromPort);
+    }
+
+    // Create a server for each port.
+    for (const port of listeningPorts) {
+      const server = plugins.net
+        .createServer(connectionHandler)
+        .on('error', (err: Error) => {
+          console.log(`Server Error on port ${port}: ${err.message}`);
+        });
+      server.listen(port, () => {
+        console.log(`PortProxy -> OK: Now listening on port ${port}${this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''}`);
       });
+      this.netServers.push(server);
+    }
 
     // Log active connection count and longest running durations every 10 seconds.
     this.connectionLogger = setInterval(() => {
@@ -444,14 +494,17 @@ export class PortProxy {
   }
 
   public async stop() {
-    const done = plugins.smartpromise.defer();
-    this.netServer.close(() => {
-      done.resolve();
-    });
+    // Close all servers.
+    const closePromises: Promise<void>[] = this.netServers.map(
+      server =>
+        new Promise<void>((resolve) => {
+          server.close(() => resolve());
+        })
+    );
     if (this.connectionLogger) {
       clearInterval(this.connectionLogger);
       this.connectionLogger = null;
     }
-    await done.promise;
+    await Promise.all(closePromises);
   }
 }