Transparent mode + Iptables, [Errno 111] Connection refused

[shiwenThu]

Mitmproxy works well in regular and socks5 mode, but reports 'connection refused' in transparent mode. Wondering if there is something wrong with the iptables setting.

Andorid Shell:
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to X.XXX.XXX.XX:80
iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to X.XXX.XXX.XX:443

Linux:
sudo iptables -t nat -F
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo sysctl -w net.ipv4.conf.all.send_redirects=0
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
sudo ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080

the command is :
mitmdump --mode transparent --set block_global=false --showhost

the bug report is:
Proxy server listening at http://*:8080
27.47.8.226:10434: clientconnect
27.47.8.226:10434: Server connection to ('172.25.143.177', 443) failed: Error connecting to "172.25.143.177": [Errno 111] Connection refused
27.47.8.226:10434: clientdisconnect
27.47.8.226:10435: clientconnect
27.47.8.226:10435: Server connection to ('172.25.143.177', 443) failed: Error connecting to "172.25.143.177": [Errno 111] Connection refused
27.47.8.226:10435: clientdisconnect
27.47.8.226:10436: clientconnect
27.47.8.226:10438: clientconnect
27.47.8.226:10439: clientconnect
27.47.8.226:10437: clientconnect
27.47.8.226:10439: Server connection to ('172.25.143.177', 443) failed: Error connecting to "172.25.143.177": [Errno 111] Connection refused
27.47.8.226:10439: clientdisconnect
27.47.8.226:10438: Server connection to ('172.25.143.177', 443) failed: Error connecting to "172.25.143.177": [Errno 111] Connection refused

[shiwenThu]

172.25.143.177 is the inet of the Linux

[ThomasBucaioni]

It looks like the Linux box is NATing the traffic? In the transparent proxy section, it would be the wrong redirection then

[ThomasBucaioni]

Maybe you could try on the Linux box alone: add a mitmproxyuser with a home and bash shell, and follow the transparent procedure

sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1
sysctl -w net.ipv4.conf.all.send_redirects=0

iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitmproxyuser --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitmproxyuser --dport 443 -j REDIRECT --to-port 8080
ip6tables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitmproxyuser --dport 80 -j REDIRECT --to-port 8080
ip6tables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitmproxyuser --dport 443 -j REDIRECT --to-port 8080

then login with this user and run mitmproxy:

su mitmproxyuser

pip install --user mitmproxy

mitmproxy --mode transparent --showhost --set block_global=false

You'll need to flush the rules before and after