MacOS proxy configuration issues

[canyalccn]

After setting up the tpws proxy through binaries and got it running you would get this error log whenever you attempt to establish a connection:

ioctl(DIOCNATLOOK) failed: Operation not permitted

I did a quick reasearch and seems like at some point apple hardened the xnu even more to prevent users (even as root) from making NAT lookups.

no altq support in kernel
altq related functions disabled

You would still get the same error above even if zapret is running in TCP proxy only mode (without any tampering)

So transparent proxies no longer work on macOS again I guess? I think it's worth leaving this here for others to see,

Also the workaround is simply using zapret as socks (or other userspace proxy):

--socks

Macbook Air M1 Sonoma 14.5

[bol-van]

tpws drops root unless --user=root specified
macos hardchecks for uid 0
its documented
although apple is hostile to bsd legacy
have they invented another crap security ?

[canyalccn]

Yeah I guess. I've tried the root as well, maybe it's just me though.
Still I'd recommend socks as the default for macOS since it's much more reliable and you dont need to constantly keep up with apple

[bol-van]

it works for sure on big sur x86
to avoid loop its required to run client non root
and exclude root from redirect