1--- 2layout: commands 3page_title: 'Commands: Connect Proxy' 4description: > 5 The connect proxy subcommand is used to run the built-in mTLS proxy for 6 Connect. 7--- 8 9# Consul Connect Proxy 10 11Command: `consul connect proxy` 12 13The connect proxy command is used to run Consul's built-in mTLS proxy for 14use with Connect. This can be used in production to enable a Connect-unaware 15application to accept and establish Connect-based connections. This proxy 16can also be used in development to connect to Connect-enabled services. 17 18## Usage 19 20Usage: `consul connect proxy [options]` 21 22#### API Options 23 24@include 'http_api_options_client.mdx' 25 26@include 'http_api_options_server.mdx' 27 28#### Proxy Options 29 30- `-sidecar-for` - The _ID_ (not name if they differ) of the service instance 31 this proxy will represent. The target service doesn't need to exist on the 32 local agent yet but a [sidecar proxy 33 registration](/docs/connect/registration/service-registration) with 34 `proxy.destination_service_id` equal to the passed value must be present. If 35 multiple proxy registrations targeting the same local service instance are 36 present the command will error and `-proxy-id` should be used instead. 37 This can also be specified via the `CONNECT_SIDECAR_FOR` environment variable. 38 39- `-proxy-id` - The [proxy 40 service](/docs/connect/registration/service-registration) ID on the 41 local agent. This must already be present on the local agent. This option 42 can also be specified via the `CONNECT_PROXY_ID` environment variable. 43 44- `-log-level` - Specifies the log level. 45 46- `-pprof-addr` - Enable debugging via pprof. Providing a host:port (or just ':port') 47 enables profiling HTTP endpoints on that address. 48 49- `-service` - Name of the service this proxy is representing. This service 50 doesn't need to actually exist in the Consul catalog, but proper ACL 51 permissions (`service:write`) are required. This and the remaining options can 52 be used to setup a proxy that is not registered already with local config 53 [useful for development](/docs/connect/dev). 54 55- `-upstream` - Upstream service to support connecting to. The format should be 56 'name:addr', such as 'db:8181'. This will make 'db' available on port 8181. 57 When a regular TCP connection is made to port 8181, the proxy will service 58 discover "db" and establish a Connect mTLS connection identifying as 59 the `-service` value. This flag can be repeated multiple times. 60 61- `-listen` - Address to listen for inbound connections to the proxied service. 62 Must be specified with -service and -service-addr. If this isn't specified, 63 an inbound listener is not started. 64 65- `-service-addr` - Address of the local service to proxy. Required for 66 `-listen`. 67 68- `-register` - Self-register with the local Consul agent, making this 69 proxy available as Connect-capable service in the catalog. This is only 70 useful with `-listen`. 71 72- `-register-id` - Optional ID suffix for the service when `-register` is set to 73 disambiguate the service ID. By default the service ID is `<service>-proxy` 74 where `<service>` is the `-service` value. In most cases it is now preferable 75 to use [`consul services register`](/commands/services/register) to 76 register a fully configured proxy instance rather than specify config and 77 registration via this command. 78 79## Examples 80 81The example below shows how to start a local proxy for establishing outbound 82connections to "db" representing the frontend service. Once running, any 83process that creates a TCP connection to the specified port (8181) will 84establish a mutual TLS connection to "db" identified as "frontend". 85 86```shell-session 87$ consul connect proxy -service frontend -upstream db:8181 88``` 89 90The next example starts a local proxy that also accepts inbound connections 91on port 8443, authorizes the connection, then proxies it to port 8080: 92 93```shell-session 94$ consul connect proxy \ 95 -service frontend \ 96 -service-addr 127.0.0.1:8080 \ 97 -listen ':8443' 98``` 99