4 ms·
Presumably this involves installing new CA certs on your devices, no?
by sneak 3y ago
Presumably this involves installing new CA certs on your devices, no?
- userbinator 3y agoYes, and this also answers the other comment about what else I MITM for: blocking devices that I can't inspect the traffic of is another reason, since the proxy is the only way out of the network.
- pdimitar 3y agoPardon the lay question, but is it really the only way out of the network? Can't programs initiate connections while skipping the system-wide configured proxy?
- haraldooo 3y agoSure they can.. but they can’t get around your outgoing firewall rule that reroutes alle traffic for certain ports to the proxy.
- pdimitar 3y agoHm, I have to see if Mikrotik has rule syntax for this. I can already force every app who thinks they will use their own DNS server to use mine but not sure how I could do the same with a proxy. Maybe just force ports 80 and 443? But what's stopping these apps to communicate on non-standard ports?
- emidln 3y agoThere's no reason to allow arbitrary traffic in either direction other than convenience. If you want a more secure network, you block everything by default and narrowly open as needed.
- pdimitar 3y agoThat means I'll stop 99% of all outgoing traffic. Still interested in how to force all traffic to a proxy though.
- denysvitali 3y agohttps://docs.mitmproxy.org/stable/howto-transparent/ https://docs.mitmproxy.org/stable/howto-transparent/
- pdimitar 3y agoThanks, I'll give this a thorough read.
- LoganDark 3y agoIf it's only for certain ports, they can just use non-standard ports.
- magicalhippo 3y agoNot uncommon to have a drop all rule as default on outgoing packets as well. Regular http gets redirected to proxy, non-standard traffic needs to be explicitly allowed out.
- fifteen1506 3y agoCooool. Any blog post or something about your network setup?
- yukIttEft 3y agolayperson here: won't, say a banking app complain about the now new cert it deals with instead of the bank-cert?
- alwayslikethis 3y agoBanking apps generally hardcode their certs in to prevent this, so this wouldn't work unless you find a way to replace that cert too.
- cute_boi 3y agomost banks already do certificate pinning, even tho it is not necessary.
- sgammon 3y agoclearly it is necessary in some circumstances