Capturing localnetwork traffic in NETransparentProxyProvider

Question

Created Jun ’21

Replies 2

Boosts 0

Participants 2

Hi, We have implemented NETransparentProxyProvider with following network Rules: includedNetworkRules = [NENetworkRule(remoteNetwork: nil, remotePrefix: 0, localNetwork: nil, localPrefix: 0, protocol: .TCP, direction: .outbound) , NENetworkRule(remoteNetwork: nil, remotePrefix: 0, localNetwork: nil, localPrefix: 0, protocol: .UDP, direction: .outbound) ]

Now on the same machine I have started the webserver like: python -m SimpleHTTPServer

Now if I execute "curl 127.0.0.1:8000" or "curl localhost:8000", I don't see any flows captured by NETransparentProxyProvider, but I see request reaching properly to the web server, and if I execute "curl example.com", I see flows related to it.

Please let me know how to capture flows of local network in NETransparentProxyProvider.

Thanks

Boost

Answer 1

vk04 OP

Jun ’21

I noted 1 more thing that we are setting NETransparentProxyNetworkSettings with 127.0.0.1 can this be reason that my application is not catching localhost traffic.?

    let settings = NETransparentProxyNetworkSettings(tunnelRemoteAddress: "127.0.0.1")

        settings.includedNetworkRules = [
            NENetworkRule(remoteNetwork: nil,
                          remotePrefix: 0,
                          localNetwork: nil,
                          localPrefix: 0,
                          protocol: .TCP,
                          direction: .outbound) ,
            NENetworkRule(remoteNetwork: nil,
                          remotePrefix: 0,
                          localNetwork: nil,
                          localPrefix: 0,
                          protocol: .UDP,
                          direction: .outbound) 
        ]

What is the recommendation of setting tunnelRemoteAddress while creating NETransparentProxyNetworkSettings

0

Answer 2

Systems Engineer OP

Apple

Jun ’21

Take a look at the header documentation for:

public init(remoteNetwork: NWHostEndpoint?, remotePrefix: Int, localNetwork: NWHostEndpoint?, localPrefix: Int, protocol: NENetworkRule.`Protocol`, direction: NETrafficDirection)

@ discussion: Initialize a newly-allocated NENetworkRule object that matches traffic by remote network, local network, protocol, and direction. If both remoteNetwork and localNetwork are nil then the rule will match all traffic of the given protocol and direction, except for loopback traffic. To match loopback traffic create a NENetworkRule with remoteNetwork and/or localNetwork properties that explicitly match traffic to the loopback address (127.0.0.1 or ::1).

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0