# Terminate SSL and forward to a different server?

**URL:** <https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239>\
**Category:** help\
**Created:** [September 17, 2018, 10:36am UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239 "2018-09-17T10:36:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pazuwu](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pazuwu](https://discourse.mitmproxy.org/u/pazuwu)\
**Post date:** [September 17, 2018, 10:36am UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239/1 "2018-09-17T10:36:03Z")

</div>

Can someone tell me if the following scenario is possible using mitmproxy?

I have a LAN with a few devices on it and a `dnsmasq` running on the gateway to provide DHCP and DNS services. This `dnsmasq` is configured with a large domains list to perform ad blocking (by returning NXDOMAIN or an invalid ip address).

I want to take things a step further and instead of blocking the traffic, I want to redirect it to a small web server running on the same gateway, which will log the requests and return dummy data, like 1x1 px gif/png for images, empty html/js, etc. For this, I’ll configure `dnsmasq` to return a specific IP address for all blocked domains (e.g. `1.2.3.4`) and use `iptables` to redirect the traffic received from the LAN to `1.2.3.4`, to my web server.

The problem will be the HTTPS traffic, as my web server isn’t capable of spoofing SSL certificates for the requested hosts.

So, would it be possible to redirect traffic to mitmproxy, spoof the certificate from the **real** host and then forward the connection to _my_ web server (via HTTP) instead ?

---

<div class="post-metadata">

**Author:** ![zulrang](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/zulrang/32/345_2.png) [@zulrang](https://discourse.mitmproxy.org/u/zulrang)\
**Post date:** [September 17, 2018, 1:14pm UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239/2 "2018-09-17T13:14:13Z")

</div>

From what I understand, mitmproxy already spoofs the certificates for the real host using a self-signed certificate.

As long as your client has the mitmproxy cert in the trust chain, it should just work.

---

<div class="post-metadata">

**Author:** ![pazuwu](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pazuwu](https://discourse.mitmproxy.org/u/pazuwu)\
**Post date:** [September 17, 2018, 1:22pm UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239/3 "2018-09-17T13:22:21Z")

</div>

Yes, it spoofs the certificates for the real host, but it also forwards the connection to that host. I need it forwarded to a **different** server (other than the client requested).

For example, the regular usage scenario is:

1. client makes a request to `https://example.com`
2. mitmproxy intercepts the request and fetches certificate from `example.com`
3. mitmproxy creates a fake cert for “`example.com`” and gives it to the client
4. mitmproxy connects to `https://example.com` and sends requests on behalf of the client

For my use case, I need step 4 to be:

1. mitmproxy connects to a local server (e.g. localhost:10000) and sends requests on behalf of the client

---

<div class="post-metadata">

**Author:** ![zulrang](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/zulrang/32/345_2.png) [@zulrang](https://discourse.mitmproxy.org/u/zulrang)\
**Post date:** [September 17, 2018, 1:55pm UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239/4 "2018-09-17T13:55:49Z")

</div>

On the front page of mitmproxy’s site:

```
from mitmproxy import http

def request(flow: http.HTTPFlow):
    # redirect to different host
    if flow.request.pretty_host == "example.com":
        flow.request.host = "mitmproxy.org"
```

---

<div class="post-metadata">

**Author:** ![pazuwu](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pazuwu](https://discourse.mitmproxy.org/u/pazuwu)\
**Post date:** [September 17, 2018, 1:59pm UTC](https://discourse.mitmproxy.org/t/terminate-ssl-and-forward-to-a-different-server/1239/5 "2018-09-17T13:59:27Z")

</div>

Uh, can’t believe I missed that. ☹ I’ll give it a try.