# LinkSys router traffic to mitmproxy

**URL:** <https://discourse.mitmproxy.org/t/linksys-router-traffic-to-mitmproxy/1111>\
**Category:** Uncategorized\
**Created:** [June 21, 2018, 2:56am UTC](https://discourse.mitmproxy.org/t/linksys-router-traffic-to-mitmproxy/1111 "2018-06-21T02:56:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![csgaur](https://avatars.discourse-cdn.com/v4/letter/c/74df32/32.png) [@csgaur](https://discourse.mitmproxy.org/u/csgaur)\
**Post date:** [June 21, 2018, 2:56am UTC](https://discourse.mitmproxy.org/t/linksys-router-traffic-to-mitmproxy/1111/1 "2018-06-21T02:56:38Z")

</div>

I have LinkSys router get connected local devices to ethernet ports of it with IP addresses assigned (192.168.1.X) and WAN port connected to a network-A and network-A connected to internet.

I have written below rules in LinkSys router to route all HTTP traffic to Ubuntu machine running mitmproxy with transparent mode on 8080 port .

#!/bin/sh  
PROXY\_IP=Ubuntu-IP-Address  
PROXY\_PORT=80  
LAN\_IP=`nvram get lan_ipaddr`  
LAN\_NET=$LAN\_IP/`nvram get lan_netmask`

iptables -t nat -A PREROUTING -i br0 -s $LAN\_NET -d $LAN\_NET -p tcp --dport 80 -j ACCEPT  
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY\_IP -p tcp --dport 80 -j DNAT --to $PROXY\_IP:$PROXY\_PORT  
iptables -t nat -A POSTROUTING -o br0 -s $LAN\_NET -d $PROXY\_IP -p tcp -j SNAT --to $LAN\_IP  
iptables -I FORWARD -i br0 -o br0 -s $LAN\_NET -d $PROXY\_IP -p tcp --dport $PROXY\_PORT -j ACCEPT

Also, I have written below rule on Ubuntu machine to listen all traffic  
Iptables -t nat -I PREROUTING -p tcp —dport 80 -j DNAT —to Ubuntu-IP-Address:8080

So, When mitmproxy captures the traffic from connected devices of LinkSys, Mitmproxy shows 404 because details section shows that mitmproxy hitting at Ubuntu-Server:80 like below:

Server : Ubuntu-IP-Address:80  
Client: LinkSys-WAN-IP:randam port

Could you please help me to identify issue so that mitmproxy should hit real IP addresses of the HTTP Urls not to the Ubuntu IP address.

---

<div class="post-metadata">

**Author:** ![csgaur](https://avatars.discourse-cdn.com/v4/letter/c/74df32/32.png) [@csgaur](https://discourse.mitmproxy.org/u/csgaur)\
**Post date:** [June 22, 2018, 11:53pm UTC](https://discourse.mitmproxy.org/t/linksys-router-traffic-to-mitmproxy/1111/2 "2018-06-22T23:53:13Z")

</div>

I have caught the issue that I was doing NAT before sending network traffic to MITM Proxy.  
I have gone through over the details on URL [https://docs.mitmproxy.org/stable/concepts-modes/](https://docs.mitmproxy.org/stable/concepts-modes/) and found below note:  
“Network Address Translation should not be applied before the traffic reaches mitmproxy, since this would remove the target information, leaving mitmproxy unable to determine the real destination.”

To get this issue resolve, I had changed the default gateway of router to my mitmproxy machine and it works!  
Thanks MitmProxy Team.

---

<div class="post-metadata">

**Author:** ![cmck](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/cmck/32/329_2.png) [@cmck](https://discourse.mitmproxy.org/u/cmck)\
**Post date:** [August 8, 2018, 11:16pm UTC](https://discourse.mitmproxy.org/t/linksys-router-traffic-to-mitmproxy/1111/3 "2018-08-08T23:16:55Z")

</div>

For anyone else encountering this issue, here are the firewall rules that I used to proxy traffic via the router from one device to a machine running mitmproxy in transparent mode. Tested on the DD-WRT firmware.

#!/bin/sh  
PROXIFYING\_MACHINE=192.168.0.145  
MACHINE\_TO\_PROXIFY=192.168.0.113  
iptables -I PREROUTING 1 -t mangle -s $MACHINE\_TO\_PROXIFY ! -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -p tcp -m multiport --dports 80,443 -j MARK --set-mark 3  
iptables -I PREROUTING 2 -t mangle -s $MACHINE\_TO\_PROXIFY ! -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -p tcp -m multiport --dports 80,443 -j CONNMARK --save-mark  
iptables -I PREROUTING 3 -t mangle -s $MACHINE\_TO\_PROXIFY ! -d `nvram get wan_ipaddr` -p tcp -m multiport --dports 80,443 -j MARK --set-mark 3  
iptables -I PREROUTING 4 -t mangle -s $MACHINE\_TO\_PROXIFY ! -d `nvram get wan_ipaddr` -p tcp -m multiport --dports 80,443 -j CONNMARK --save-mark

ip rule add fwmark 3 table 13  
ip route add default via $PROXIFYING\_MACHINE table 13

via [https://gist.github.com/CROSP/ebbbc7171c336c4ea01b3a24a36daf10](https://gist.github.com/CROSP/ebbbc7171c336c4ea01b3a24a36daf10)  
and [https://crosp.net/blog/administration/routing-network-traffic-through-socks5-proxy-using-dd-wrt/](https://crosp.net/blog/administration/routing-network-traffic-through-socks5-proxy-using-dd-wrt/)