CONNECT tunnelling is an HTTP method used to ask a proxy to open a raw TCP tunnel to a target host and port. After the tunnel is established, the proxy relays bytes without inspecting the application protocol, which is why it is commonly used for HTTPS proxying.
What CONNECT tunneling does
CONNECT tunneling is a proxy method for creating a raw TCP tunnel to a target host and port. Once the tunnel exists, the proxy stops interpreting the application protocol and simply relays bytes, which makes it the standard way to carry HTTPS through an HTTP proxy.
That design matters because the proxy is no longer enforcing application-layer visibility for traffic inside the tunnel. A CONNECT request therefore changes the proxy’s role from content-aware intermediary to transport relay for the chosen destination and port.
Why CONNECT tunneling is used
Organisations use CONNECT when clients must reach encrypted or otherwise opaque services through an intermediary without breaking the end-to-end session. In practice, the method is common for web browsing, outbound proxying, and controlled egress from internal networks.
The security trade-off is that CONNECT can also become a generic path for arbitrary TCP forwarding if proxy policy is too broad. That is why proxy administrators usually pair it with destination and port restrictions, authentication, and logging. For proxy hardening guidance, see the Proxies and Forward vs Reverse Proxy Security Guide.
How CONNECT affects inspection and control
CONNECT does not encrypt traffic by itself, but it can carry encrypted sessions that the proxy cannot inspect without TLS interception. That means content filters, DLP tools, and malware controls may lose protocol visibility once the tunnel is established, even though connection metadata such as destination, timing, and volume may still be observable.
As a result, defenders should think about CONNECT as a policy boundary, not just a networking convenience. The method can preserve privacy and compatibility, but it can also hide exfiltration, command traffic, or unauthorized access if egress policy is weak.
Typical failure modes and defensive boundaries
Misconfigured proxies can expose CONNECT on unintended ports, allow open-proxy behaviour, or permit tunnelling to internal targets that should never be reachable from a client segment. Those failures turn a useful proxy feature into a general-purpose forwarding channel.
Good practice is to treat CONNECT as a narrowly permitted capability, tied to explicit destinations, ports, and user or device policy. Where organisations allow it for HTTPS, they should also consider whether certificate inspection, proxy authentication, and outbound allowlisting are needed to keep the tunnel from bypassing intended controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | CONNECT tunneling is a boundary control issue because it can bypass inspection and egress restrictions. |
| AU-2 — Event Logging | Proxy CONNECT requests are security-relevant events that need audit visibility for abuse and troubleshooting. | |
| Recommendation — Restrict CONNECT tunneling to approved destinations and ports at the network boundary. Log CONNECT requests with user, destination, port, and outcome details. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Proxy tunnel traffic is a network control point that benefits from monitoring, alerting, and policy enforcement. |
| Recommendation — Monitor proxy tunnel activity for unauthorized destinations and anomalous volume. | ||
Practitioner Guidance
What to watch for: If CONNECT is enabled, review whether the proxy allows only the ports and destinations the business actually needs. The most common mistake is assuming that “proxy in front of it” automatically means “inspected and controlled.”
Governance implication: Proxy teams should define whether CONNECT is a standard web-access feature, a restricted exception, or a fully monitored egress pathway. That decision affects logging depth, TLS interception policy, and who is authorised to create raw tunnels.