8

The short version:

How do I redirect all traffic from en2 port 80/443 to 127.0.0.1:8080 when I have enabled Internet Sharing in OS X Mountain Lion (10.8)?

Some background:

I am doing a master thesis where I will evaluate communication security for various smartphone apps. I have chosen to use my new MacBook Air as the router.

I have connected my Air to the Internet with USB Ethernet and setup Internet Sharing to my Wifi. This works fine. I can connect other devices to my Air via wifi and access the Internet. Great!

Now I want to intercept this traffic and modify it on-the-fly. I figured I need a proxy to do this but I need a transparent one, where I don't have to do any configuration on the device. I found that mitmproxy offers exactly these features. So I have it running on 127.0.0.1:8080, ready to intercept traffic.

Unfortunately I am stuck trying to redirect my traffic coming in from the wifi (en2) on port 80 and 443 to 127.0.0.1:8080. The mitmproxy docs suggest a config for pfctl but it doesn't work. I noticed that Apple has provided some config for Internet Sharing, enabling NAT. So if I don't use their configuration then the Internet Sharing stops working. And when I try to add the rdr lines to their config it doesn't take effect (tried several places in the file /etc/pf.conf). My traffic just passes on to the Internet, bypassing the mitmproxy.

6

I found the answer.

I loaded my rules as part of the anchor com.apple/100.InternetSharing/natpmp which is the one used for Internet Sharing.

The file mitm.pf.conf contains the rules:

rdr on bridge0 proto tcp from any to any port 80 -> 127.0.0.1 port 8080
rdr on bridge0 proto tcp from any to any port 443 -> 127.0.0.1 port 8080`

Load it using the Internet Sharing anchor:

sudo pfctl -a com.apple/100.InternetSharing/natpmp -f mitm.pf.conf
0

In a similar situation I have used the firewall to redirect traffic from one NIC to the proxy. You could use something like that:

$ sudo ipfw add fwd 127.0.0.1,8080 tcp from not me to any 80 in via en1
$ sudo ipfw add fwd 127.0.0.1,8080 tcp from not me to any 443 in via en1

If worked ok for me.

You can also use the free WaterRoof program as a GUI to configure the firewall. It does not add anything to the ipsw command, it just gives you easier access to all the options.

This page helped me a lot in setting up my configuration:

http://lucumr.pocoo.org/2013/1/6/osx-wifi-proxy/

  • I did try that but for some reason it didn't work. It completely broke the Internet Sharing. Also, it is my understanding that Apple is moving away from ipfw from FreeBSD in favor of pf from OpenBSD. – Christoffer Reijer Aug 31 '13 at 8:23
  • This answer only works for old Mac's. Apple has dropped IPFW. – Brady Jan 3 '17 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .