PF settings on MacOS for transparent proxy

help
1

I would like to redirect all the outgoing-traffic on my mac through mitmproxy in a transparent way. The docs provide a recipe for something similar but note that it doesn’t work to redirect traffic arising from the machine itself. There is discussion on a workaround for this.

This work-around doesn’t work for me. Here is what I have done so far.

  • Created a file pf.conf with the following contents:
rdr pass proto tcp from any to any port {80, 443} -> 127.0.0.1 port 8080
pass out route-to (lo0 127.0.0.1) proto tcp from any to any port {80, 443} user != root
  • Ran sudo pfctl -vf pf.conf. Here is the output
pfctl: Use of -f option, could result in flushing of rules
present in the main ruleset added by the system at startup.
See /etc/pf.conf for further details.
   
No ALTQ support in kernel
ALTQ related functions disabled
rdr pass inet proto tcp from any to any port = 80 -> 127.0.0.1 port 8080
rdr pass inet proto tcp from any to any port = 443 -> 127.0.0.1 port 8080
pass out route-to (lo0 127.0.0.1) inet proto tcp from any to any port = 80 user != 0 flags S/SA keep state
pass out route-to (lo0 127.0.0.1) inet proto tcp from any to any port = 443 user != 0 flags S/SA keep state
  • Ran curl www.google.com as a non-root user and it successfully fetched the page.

Note: I have not started mitmproxy yet, so it is surprising that curl should be successful. Now even if I start mitmproxy with sudo mitmproxy --mode transparent there is no activity on the screen when I use curl again.

I am using MacOS High-Sierra.

2

It is working now. It might have something to do with MacOS parental controls which I just disabled. But I still don’t understand why this might have happened since I flush the previous pf rules before enabling new ones.

EDIT: PF on MacOS has some more features, which might actually be causing this interference.