Redirect traffic using PF along with Internet Sharing

Question

The short version:

How do I redirect all traffic from en2 port 80/443 to 127.0.0.1:8080 when I have enabled Internet Sharing in OS X Mountain Lion (10.8)?

Some background:

I am doing a master thesis where I will evaluate communication security for various smartphone apps. I have chosen to use my new MacBook Air as the router.

I have connected my Air to the Internet with USB Ethernet and setup Internet Sharing to my Wifi. This works fine. I can connect other devices to my Air via wifi and access the Internet. Great!

Now I want to intercept this traffic and modify it on-the-fly. I figured I need a proxy to do this but I need a transparent one, where I don't have to do any configuration on the device. I found that mitmproxy offers exactly these features. So I have it running on 127.0.0.1:8080, ready to intercept traffic.

Unfortunately I am stuck trying to redirect my traffic coming in from the wifi (en2) on port 80 and 443 to 127.0.0.1:8080. The mitmproxy docs suggest a config for pfctl but it doesn't work. I noticed that Apple has provided some config for Internet Sharing, enabling NAT. So if I don't use their configuration then the Internet Sharing stops working. And when I try to add the rdr lines to their config it doesn't take effect (tried several places in the file /etc/pf.conf). My traffic just passes on to the Internet, bypassing the mitmproxy.

Answer 1

I found the answer.

I loaded my rules as part of the anchor com.apple/100.InternetSharing/natpmp which is the one used for Internet Sharing.

The file mitm.pf.conf contains the rules:

rdr on bridge0 proto tcp from any to any port 80 -> 127.0.0.1 port 8080
rdr on bridge0 proto tcp from any to any port 443 -> 127.0.0.1 port 8080`

Load it using the Internet Sharing anchor:

sudo pfctl -a com.apple/100.InternetSharing/natpmp -f mitm.pf.conf

Answer 2

In a similar situation I have used the firewall to redirect traffic from one NIC to the proxy. You could use something like that:

$ sudo ipfw add fwd 127.0.0.1,8080 tcp from not me to any 80 in via en1
$ sudo ipfw add fwd 127.0.0.1,8080 tcp from not me to any 443 in via en1

If worked ok for me.

You can also use the free WaterRoof program as a GUI to configure the firewall. It does not add anything to the ipsw command, it just gives you easier access to all the options.

This page helped me a lot in setting up my configuration:

http://lucumr.pocoo.org/2013/1/6/osx-wifi-proxy/