11

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.

The following config is supplied to make this work:

CLIENT_NET=192.168.1.0/24
TABLE_ID=100
MARK=1

echo "$TABLE_ID     mitmproxy" >> /etc/iproute2/rt_tables
iptables -t mangle -A PREROUTING -d $CLIENT_NET -j MARK --set-mark $MARK
iptables -t nat \
    -A PREROUTING -p tcp -s $CLIENT_NET \
    --match multiport --dports 80,443 -j \
    REDIRECT --to-port 8080

ip rule add fwmark $MARK lookup $TABLE_ID
ip route add local $CLIENT_NET dev lo table $TABLE_ID

Mitmproxy is listening on the router (192.168.178.40) on port: 8080

However my setup consists of a custom debian router with 2 NICs.

  • One internet facing wlp2s0 (also used to SSH into it) with address: 192.168.178.40
  • One NIC set as default gateway enp4s0 for the target client at: 10.0.0.1

The client connects to the default gateway with address 10.0.0.12

By default I use the following IP table rules to redirect my client traffic to port 8080:

sudo iptables -t nat -A PREROUTING -i enp4s0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i enp4s0 -p tcp --dport 443 -j REDIRECT --to-port 8008

While this works as intended, I'd like to be able to spoof the client source address so that the HTTP(S) requests captured match the TCP packets and other traffic also coming from the client.

Here's a picture to visualize my setup because I am pretty horrible at explaining:

Transparent proxy setup.

  • Since request comes from mitmproxy host - it will have this host IP, with an exception to have some information regarding original in the headers. – bluszcz Mar 7 '18 at 9:59
  • @bluszcz The idea is that mitmproxy can spoof the source address using --spoof-source-address. However, needed first is the above config, but I don't know how to adjust this to my 2 NIC setup. read more here: mitmproxy.org/docs/latest/howto-transparent – Ghxst Mar 7 '18 at 10:04
  • Right, did you follow all the docs from mitmproxy.org/docs/latest/howto-transparent/… ? Using root accounts and others? ./mitmproxy_shim $(which mitmproxy) -T --spoof-source-address – bluszcz Mar 7 '18 at 10:12
  • @bluszcz I see now what the mitmproxy_shim is for. However, I am still not sure if there needs to be anything changed in the iptables config in order for me to spoof the correct client source (10.0.0.x instead of 192.168.178.x) – Ghxst Mar 7 '18 at 10:27
-2

You cannot use Client's ip...proxy is intermediary device/software to whom client ask for data. Client asks for proxy to contact server, proxy contacts server. If you want to bypass client configuration for proxy you have to apply arpspoof command (arpspoof -i -t -r , using these you don't have to route your traffic to proxy via router.

  • 1
    to whom client ask - well, no, transparent proxy is the one where client does not negotiate with the proxy. – domen Mar 13 at 10:49
  • Transparent proxy means that client is Unaware of Proxy. It doesnt have to mean that the traffic is not going through proxy. – Antonio Zunic Mar 13 at 10:55
  • 1
    Yes, of course, how else could it work. But client does not know about the proxy, which your answer says. – domen Mar 13 at 11:08
  • Ok, gotta explore that...learning on mistakes. :D – Antonio Zunic Mar 13 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.