# Used interfaces by Snowflake proxy **URL:** \ **Category:** Relay Operator\ **Tags:** snowflake\ **Created:** [September 7, 2024, 2:23pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508 "2024-09-07T14:23:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![tobrop](https://forum.torproject.org/user_avatar/forum.torproject.org/tobrop/32/1514_2.png) [@tobrop](https://forum.torproject.org/u/tobrop)\ **Post date:** [September 7, 2024, 2:23pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/1 "2024-09-07T14:23:56Z")
If you use a [docker-compose.yml](https://gitlab.torproject.org/tpo/anti-censorship/docker-snowflake-proxy/-/blob/main/docker-compose.yml?ref_type=heads) with `network_mode: host` and something like `command: ["-ephemeral-ports-range", "30000:30010"]`, why does > netstat -tulpen | grep proxy also lists the Snowflake proxy on the Docker (172.17.0.1) and WireGuard (I have it installed) interface, in addition to eth0 - and that for every single configured port (30000, 30001, …)? Is this correct behavior? Note: my Docker image contains [snowflake-proxy 2.9.2 (2bbd4d06)](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/commit/2bbd4d064376f5076c7526a3afff055470f96af0) ---
**Author:** ![WofWca](https://forum.torproject.org/user_avatar/forum.torproject.org/wofwca/32/2302_2.png) [@WofWca](https://forum.torproject.org/u/WofWca)\ **Post date:** [September 7, 2024, 7:51pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/2 "2024-09-07T19:51:53Z")
I believe so. If you want to change that, you can try the [`outbound-address`](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/blob/2bbd4d064376f5076c7526a3afff055470f96af0/proxy/main.go#L33) parameter. See relevant issue: > **[standalone snowflake operators want a way to bind a specific outbound address...](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40108)** > > This is similar to Tor's OutboundBindAddress config option: if you're running headless snowflake on a server with multiple IP addresses, you want a way to control which... ---
**Author:** ![tobrop](https://forum.torproject.org/user_avatar/forum.torproject.org/tobrop/32/1514_2.png) [@tobrop](https://forum.torproject.org/u/tobrop)\ **Post date:** [September 7, 2024, 8:19pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/3 "2024-09-07T20:19:14Z")
Unfortunately, this parameter does not change anything. Even with `-outbound-address` set to the local IPv4 of eth0 the process uses/connects to the Docker and WireGuard interface. Strange, or at least unusual, behavior. 🤔 ---
**Author:** ![SirNeo](https://forum.torproject.org/user_avatar/forum.torproject.org/sirneo/32/1933_2.png) [@SirNeo](https://forum.torproject.org/u/SirNeo)\ **Post date:** [September 7, 2024, 8:25pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/4 "2024-09-07T20:25:21Z")
With this paramater if i have two internet providers i can start 2 proxies one/isp? ---
**Author:** ![WofWca](https://forum.torproject.org/user_avatar/forum.torproject.org/wofwca/32/2302_2.png) [@WofWca](https://forum.torproject.org/u/WofWca)\ **Post date:** [September 7, 2024, 8:31pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/5 "2024-09-07T20:31:42Z")
I believe it’s the opposite `-outbound-address` is supposed to make the proxy use just one address. In your case you need to omit the parameter. ---
**Author:** ![WofWca](https://forum.torproject.org/user_avatar/forum.torproject.org/wofwca/32/2302_2.png) [@WofWca](https://forum.torproject.org/u/WofWca)\ **Post date:** [September 7, 2024, 8:31pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/6 "2024-09-07T20:31:48Z")
Hmm yeah [the fix](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/136/diffs?commit_id=fb35e80b0a9c2b85cbd8fbee502519df396fea74) is kind of just a hack IMO. I guess [`SetInterfaceFilter`](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40108#note_2900452) really is the way to go Update: I made an issue: > **[Use \`SetInterfaceFilter\` instead of \`SetNAT1To1IPs\` for \`-outbound-address\`...](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40380)** > > See Though I suspect this is not gonna be a high-priority one since the connections on other interfaces should not be happening since the Snowflake proxy never passes them to the client as ICE candidates. Not much to worry about. ---
**Author:** ![tobrop](https://forum.torproject.org/user_avatar/forum.torproject.org/tobrop/32/1514_2.png) [@tobrop](https://forum.torproject.org/u/tobrop)\ **Post date:** [September 8, 2024, 2:14pm UTC](https://forum.torproject.org/t/used-interfaces-by-snowflake-proxy/14508/7 "2024-09-08T14:14:34Z")
Just tried this: removed `network_mode: host` in docker-compose.yml and replaced it with ```auto ports: - "192.168.2.100:33000-33010:33000-33010/udp" ``` `192.168.2.100` is the local IPv4 of the eth0 interface. After starting the container there is the output ```auto NAT type: unrestricted In the last 5m0s, there were 4 completed connections. ``` The command `netstat -tulpen | grep proxy` shows ```auto udp ... 192.168.2.100:33000 0.0.0.0:* ... docker-proxy udp ... 192.168.2.100:33001 0.0.0.0:* ... docker-proxy ... udp ... 192.168.2.100:33009 0.0.0.0:* ... docker-proxy udp ... 192.168.2.100:33010 0.0.0.0:* ... docker-proxy ``` So, seems to work, there are client connections to the unrestricted proxy and the process is only connected to eth0, not to Docker and WireGuard interface anymore. What I don’t know is whether the above configuration has a negative impact on clients connecting via IPv6 (udp6).