aboutsummaryrefslogtreecommitdiffstats
path: root/doc-src/transparent
diff options
context:
space:
mode:
authorAldo Cortesi <aldo@nullcube.com>2014-01-22 13:33:02 +1300
committerAldo Cortesi <aldo@nullcube.com>2014-01-22 13:33:02 +1300
commit8f88fcedd601c0033b4469b66626a83011879baf (patch)
tree878b2c737f2483f52e7c222541483773af1c152a /doc-src/transparent
parent7ddc941116852b191d80643af70af90a6fd8849c (diff)
downloadmitmproxy-8f88fcedd601c0033b4469b66626a83011879baf.tar.gz
mitmproxy-8f88fcedd601c0033b4469b66626a83011879baf.tar.bz2
mitmproxy-8f88fcedd601c0033b4469b66626a83011879baf.zip
Move the doc tree out into its own repo.
Diffstat (limited to 'doc-src/transparent')
-rw-r--r--doc-src/transparent/index.py6
-rw-r--r--doc-src/transparent/linux.html43
-rw-r--r--doc-src/transparent/osx.html81
3 files changed, 0 insertions, 130 deletions
diff --git a/doc-src/transparent/index.py b/doc-src/transparent/index.py
deleted file mode 100644
index 091b3471..00000000
--- a/doc-src/transparent/index.py
+++ /dev/null
@@ -1,6 +0,0 @@
-from countershape import Page
-
-pages = [
- Page("osx.html", "OSX"),
- Page("linux.html", "Linux"),
-]
diff --git a/doc-src/transparent/linux.html b/doc-src/transparent/linux.html
deleted file mode 100644
index 96b7132a..00000000
--- a/doc-src/transparent/linux.html
+++ /dev/null
@@ -1,43 +0,0 @@
-On Linux, mitmproxy integrates with the iptables redirection mechanism to
-achieve transparent mode.
-
-<ol class="tlist">
-
- <li> <a href="@!urlTo('ssl.html')!@">Install the mitmproxy
- certificates on the test device</a>. </li>
-
- <li> Enable IP forwarding:
-
- <pre class="terminal">sysctl -w net.ipv4.ip_forward=1</pre>
-
- You may also want to consider enabling this permanently in
- <b>/etc/sysctl.conf</b>.
-
- </li>
-
- <li> Create an iptables ruleset that redirects the desired traffic to the
- mitmproxy port. Details will differ according to your setup, but the
- ruleset should look something like this:
-
-<pre class="terminal">iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
-iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080</pre>
-
- </li>
-
- <li> Fire up mitmproxy. You probably want a command like this:
-
- <pre class="terminal">mitmproxy -T --host</pre>
-
- The <b>-T</b> flag turns on transparent mode, and the <b>--host</b>
- argument tells mitmproxy to use the value of the Host header for URL
- display.
-
- </li>
-
- <li> Finally, configure your test device to use the host on which mitmproxy is
- running as the default gateway.</li>
-
-</ol>
-
-
-For a detailed walkthrough, have a look at the <a href="@!urlTo('tutorials/transparent-dhcp.html')!@"><i>Transparently proxify virtual machines</i></a> tutorial.
diff --git a/doc-src/transparent/osx.html b/doc-src/transparent/osx.html
deleted file mode 100644
index c1ae823d..00000000
--- a/doc-src/transparent/osx.html
+++ /dev/null
@@ -1,81 +0,0 @@
-
-
-OSX Lion integrated the [pf](http://www.openbsd.org/faq/pf/) packet filter from
-the OpenBSD project, which mitmproxy uses to implement transparent mode on OSX.
-Note that this means we don't support transparent mode for earlier versions of
-OSX.
-
-<ol class="tlist">
-
- <li> <a href="@!urlTo('ssl.html')!@">Install the mitmproxy
- certificates on the test device</a>. </li>
-
- <li> Enable IP forwarding:
-
- <pre class="terminal">sudo sysctl -w net.inet.ip.forwarding=1</pre>
- </li>
-
- <li> Place the following two lines in a file called, say, <b>pf.conf</b>:
-
-<pre class="terminal">rdr on en2 inet proto tcp to any port 80 -&gt; 127.0.0.1 port 8080
-rdr on en2 inet proto tcp to any port 443 -&gt; 127.0.0.1 port 8080
-</pre>
-
- These rules tell pf to redirect all traffic destined for port 80 or 443
- to the local mitmproxy instance running on port 8080. You should
- replace <b>en2</b> with the interface on which your test device will
- appear.
-
- </li>
-
- <li> Configure pf with the rules:
-
- <pre class="terminal">sudo pfctl -f pf.conf</pre>
-
- </li>
-
- <li> And now enable it:
-
- <pre class="terminal">sudo pfctl -e</pre>
-
- </li>
-
- <li> Configure sudoers to allow mitmproxy to access pfctl. Edit the file
- <b>/etc/sudoers</b> on your system as root. Add the following line to the end
- of the file:
-
- <pre>ALL ALL=NOPASSWD: /sbin/pfctl -s state</pre>
-
- Note that this allows any user on the system to run the command
- "/sbin/pfctl -s state" as root without a password. This only allows
- inspection of the state table, so should not be an undue security risk. If
- you're special feel free to tighten the restriction up to the user running
- mitmproxy.</li>
-
- <li> Fire up mitmproxy. You probably want a command like this:
-
- <pre class="terminal">mitmproxy -T --host</pre>
-
- The <b>-T</b> flag turns on transparent mode, and the <b>--host</b>
- argument tells mitmproxy to use the value of the Host header for URL
- display.
-
- </li>
-
- <li> Finally, configure your test device to use the host on which mitmproxy is
- running as the default gateway.</li>
-
-
-</ol>
-
-Note that the **rdr** rules in the pf.conf given above only apply to inbound
-traffic. This means that they will NOT redirect traffic coming from the box
-running pf itself. We can't distinguish between an outbound connection from a
-non-mitmproxy app, and an outbound connection from mitmproxy itself - if you
-want to intercept your OSX traffic, you should use an external host to run
-mitmproxy. None the less, pf is flexible to cater for a range of creative
-possibilities, like intercepting traffic emanating from VMs. See the
-**pf.conf** man page for more.
-
-
-