1---
2layout: commands
3page_title: 'Commands: Connect Proxy'
4description: >
5  The connect proxy subcommand is used to run the built-in mTLS proxy for
6  Connect.
7---
8
9# Consul Connect Proxy
10
11Command: `consul connect proxy`
12
13The connect proxy command is used to run Consul's built-in mTLS proxy for
14use with Connect. This can be used in production to enable a Connect-unaware
15application to accept and establish Connect-based connections. This proxy
16can also be used in development to connect to Connect-enabled services.
17
18## Usage
19
20Usage: `consul connect proxy [options]`
21
22#### API Options
23
24@include 'http_api_options_client.mdx'
25
26@include 'http_api_options_server.mdx'
27
28#### Proxy Options
29
30- `-sidecar-for` - The _ID_ (not name if they differ) of the service instance
31  this proxy will represent. The target service doesn't need to exist on the
32  local agent yet but a [sidecar proxy
33  registration](/docs/connect/registration/service-registration) with
34  `proxy.destination_service_id` equal to the passed value must be present. If
35  multiple proxy registrations targeting the same local service instance are
36  present the command will error and `-proxy-id` should be used instead.
37  This can also be specified via the `CONNECT_SIDECAR_FOR` environment variable.
38
39- `-proxy-id` - The [proxy
40  service](/docs/connect/registration/service-registration) ID on the
41  local agent. This must already be present on the local agent. This option
42  can also be specified via the `CONNECT_PROXY_ID` environment variable.
43
44- `-log-level` - Specifies the log level.
45
46- `-pprof-addr` - Enable debugging via pprof. Providing a host:port (or just ':port')
47  enables profiling HTTP endpoints on that address.
48
49- `-service` - Name of the service this proxy is representing. This service
50  doesn't need to actually exist in the Consul catalog, but proper ACL
51  permissions (`service:write`) are required. This and the remaining options can
52  be used to setup a proxy that is not registered already with local config
53  [useful for development](/docs/connect/dev).
54
55- `-upstream` - Upstream service to support connecting to. The format should be
56  'name:addr', such as 'db:8181'. This will make 'db' available on port 8181.
57  When a regular TCP connection is made to port 8181, the proxy will service
58  discover "db" and establish a Connect mTLS connection identifying as
59  the `-service` value. This flag can be repeated multiple times.
60
61- `-listen` - Address to listen for inbound connections to the proxied service.
62  Must be specified with -service and -service-addr. If this isn't specified,
63  an inbound listener is not started.
64
65- `-service-addr` - Address of the local service to proxy. Required for
66  `-listen`.
67
68- `-register` - Self-register with the local Consul agent, making this
69  proxy available as Connect-capable service in the catalog. This is only
70  useful with `-listen`.
71
72- `-register-id` - Optional ID suffix for the service when `-register` is set to
73  disambiguate the service ID. By default the service ID is `<service>-proxy`
74  where `<service>` is the `-service` value. In most cases it is now preferable
75  to use [`consul services register`](/commands/services/register) to
76  register a fully configured proxy instance rather than specify config and
77  registration via this command.
78
79## Examples
80
81The example below shows how to start a local proxy for establishing outbound
82connections to "db" representing the frontend service. Once running, any
83process that creates a TCP connection to the specified port (8181) will
84establish a mutual TLS connection to "db" identified as "frontend".
85
86```shell-session
87$ consul connect proxy -service frontend -upstream db:8181
88```
89
90The next example starts a local proxy that also accepts inbound connections
91on port 8443, authorizes the connection, then proxies it to port 8080:
92
93```shell-session
94$ consul connect proxy \
95    -service frontend \
96    -service-addr 127.0.0.1:8080 \
97    -listen ':8443'
98```
99