Setting up transparent proxy testing

[mook-as]

I was working on testing transparent proxies, and now that something kind of works, I wanted to write everything down before I forget.

Context

• macOS
• lima

Steps

• Set up mitmproxy: brew install mitmproxy
  • Run it in SOCKS5 mode: mitmweb --mode=socks5 --web-port=8080 --listen-port=1080
• Install it in lima:

  • Add to the provisioning script:

    Provisioning snippet

    apk update
    apk add iptables ip6tables redsocks
    
    cat > /etc/redsocks.conf << 'EOF'
    base {
        log_debug = off;
        log_info = on;
        log = "file:/var/log/redsocks.log";
        daemon = on;
        redirector = iptables;
    }
    
    redsocks {
        local_port = 1081;
        ip = 192.168.5.2;
        port = 1080;
        type = socks5;
    }
    EOF

  • Edit Lima backend to run redsocks on startup:

    Startup snippet

    sudo redsocks -c /etc/redsocks.conf # written in provisioning script
    sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 1081
    sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDIRECT --to-port 1081
    sudo wget -O /usr/local/share/ca-certificates/mitmproxy.crt http://mitm.it/cert/pem
    sudo update-ca-certificates

• Start RD

Commentary

At this point when RD starts up it should use the proxy — I can see it pulling various images from registry-1.docker.io at least.