sslh is a protocol multiplexer that accepts connections on specified ports and forwards them based on analysis of the initial data packet from the remote client.
The tool solves the problem of running multiple services on a single port by identifying which protocol a connection uses and routing it accordingly. It inspects the first bytes of incoming traffic against probes for HTTP, TLS/SSL, SSH, WireGuard, OpenVPN, tinc, XMPP, SOCKS5, and custom patterns defined by regular expression. A common use case is sharing port 443 for both SSH and HTTPS, allowing SSH access from restrictive corporate networks that block most ports while maintaining standard HTTPS service. The tool can also act as a front-end to virtual host farms by leveraging SNI and ALPN probes to distinguish between different TLS-based services on a single IP address.
Adoption is suited for operators who need to multiplex protocols on shared ports or provide transparent proxying where backend services see the original client IP. The tool offers multiple deployment models including fork-based, select-based, and libev-based concurrency for different scale requirements. For transparent proxying, it supports both simple virtual network interface methods and iptables packet marking approaches, with HAProxy proxyprotocol support as an alternative for backends that implement it. The README notes that a security review identified multiple issues including two CVEs, and recommends reviewing those findings before production deployment. Connection limits configuration is documented as part of securing an installation.
The project maintains comprehensive documentation covering installation, configuration, transparent proxying scenarios, and containerized deployment with podman and docker-compose. The codebase includes mature daemon features such as privilege dropping, capabilities management, inetd and systemd support, chroot isolation, and logging, alongside support for both IPv4 and IPv6 over TCP and UDP protocols.
