1

I have configured an OpenVPN server and can monitor HTTP traffic via tcpdump. Is there any way to monitor the HTTPS traffic as well?

Hints Self Signed SSL certificate as root certificate on VPN client's machine.

If the above hint allows me to monitor the traffic, please specify how can that be implemented on centOS + OpenVPN.

  • Do you control the clients as well? – ndrix Apr 4 '16 at 17:36
  • Yes, I control the client too. I mean, my client will install self signed certificates willingly. – Tarek Siddiki Apr 4 '16 at 18:34
  • What's the purpose of monitoring their traffic? – Mirsad Apr 4 '16 at 21:28
  • @mirsad, this is our business requirement. Client's will know that they are being intercepted while they are on my vpn. – Tarek Siddiki Apr 5 '16 at 8:45
0

TL:DR; you'd have to setup a transparent proxy on your VPN server.

You can reroute all outgoing traffic to port 443 from your VPN server (which are, probably, your VPN clients) using iptables. After this you could run an intercepting proxy such as mitmproxy which takes care of the SSL bit as well.

  • First off, you redirect all outgoing web traffic to your local proxy - for example:

    iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
    iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
    

    This makes you a transparent proxy; i.e - traffic to all web ports (in above cases just port 80 and 443, you can add more) your clients will not have to set a proxy on their browsers, yet traffic goes though your proxy.

    Makes sure your box forwards traffic, but that usually happens already if you're running OpenVPN (else they won't be able to access the Internet).

  • Second, we need to set up an intercepting proxy, such as MiTM Proxy, this can simply be run in transparent mode with the -T parameter;

    mitmproxy -T --host
    

    It sets up a CA and that certificate can be found on the server on the ~/.mitmproxy directory. That certficiate needs to be distributed to your clients and needs to be trusted by them. The --host parameter ensures that the value of the Host header is used.

This would give you access to the HTTP traffic; and you should see it happening in your MITMProxy screen. To handle a large amount of traffic, or store these, add the --outfile parameter to mitmproxy to write all traffic to a file. More info can be found at http://docs.mitmproxy.org

Some clients will prevent connecting to particular SSL websites (such as google), due to certificate pinning; so it may either break functionality, or you'd have to implement a rule that doesn't trap this information. You can either do this on MiTMproxy or using iptables.

Also, to remain ethical. You should tell your users that their traffic is being monitored; they can find out anyways (since all certificates will be "signed" by the same CA, yours).

  • Thanks @m1ke for your answer. My clients will install my self-signed certificate on their browser. In such case, how can I intercept the HTTPS traffic? – Tarek Siddiki Apr 5 '16 at 8:44
  • I updated my answer with how to intercept it. – ndrix Apr 5 '16 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.