hide upstream server from client