How to ignore everything but a list of IPs/domains and their subdomains in transparent mode?

help
1

The documentation at https://mitmproxy.readthedocs.io/en/v2.0.2/features/passthrough.html#tutorial was not helpful.

I tried combinations of --ignore '(?!<domain or ip>|<domain2 or ip2>)' and --ignore '(?!<domain or ip>)(?!<domain2 or ip2>)', with and without leading ^ but no luck.

How do I ignore everything but a specific list of IPs or (sub)domains in transparent mode? Using v2.0.2

Just to add that ^(?!(.*)?\.?domain1\.com|(.*)?\.?domain2\.com).*$ matches everything but those two domains on regex101.com using the Python engine, but doesn’t seem to when used in mitmproxy with --ignore '<regex>'

2

What do you see in your mitmproxy event log?

3

Lots of clientconnect and clientdisconnect from the proxied device’s IP

Screenshot%20from%202018-02-24%2010-08-27
Screenshot from 2018-02-24 10-08-27.png312×886 34.3 KB

4

If you increase the verbosity a bit, you should see which string the pattern is matched on.

5

I don’t know how to make sense of it. starting it with --verbose adds -> <ip>:443 for some IPs in the Event Log. What do I get from this, and how do I know if that means it’s a match or not?

6

This is from the tutorial on https://mitmproxy.org/docs/latest/howto-ignoredomains/#tutorial - The string displayed here is the string we’re matching on. You can use this as your testcase to see if your pattern is correct.

7

Is there a way to ignore/disable clientconnect and clientdisconnect log in consolo?