Hacker News Reader

Comment by userbinator | Hacker News Reader

Yes, and this also answers the other comment about what else I MITM for: blocking devices that I can't inspect the traffic of is another reason, since the proxy is the only way out of the network.

View on HN

Pardon the lay question, but is it really the only way out of the network? Can't programs initiate connections while skipping the system-wide configured proxy?

Sure they can.. but they can’t get around your outgoing firewall rule that reroutes alle traffic for certain ports to the proxy.

Hm, I have to see if Mikrotik has rule syntax for this. I can already force every app who thinks they will use their own DNS server to use mine but not sure how I could do the same with a proxy. Maybe just force ports 80 and 443? But what's stopping these apps to communicate on non-standard ports?

There's no reason to allow arbitrary traffic in either direction other than convenience. If you want a more secure network, you block everything by default and narrowly open as needed.

That means I'll stop 99% of all outgoing traffic. Still interested in how to force all traffic to a proxy though.

https://docs.mitmproxy.org/stable/howto-transparent/

Thanks, I'll give this a thorough read.

If it's only for certain ports, they can just use non-standard ports.

Not uncommon to have a drop all rule as default on outgoing packets as well.

Regular http gets redirected to proxy, non-standard traffic needs to be explicitly allowed out.

layperson here: won't, say a banking app complain about the now new cert it deals with instead of the bank-cert?

Banking apps generally hardcode their certs in to prevent this, so this wouldn't work unless you find a way to replace that cert too.

most banks already do certificate pinning, even tho it is not necessary.

clearly it is necessary in some circumstances

Cooool. Any blog post or something about your network setup?

Reply on news.ycombinator.com