Proxyman only captures flows for a few seconds after enabling proxy

[lilyball]

Proxyman version? (Ex. Proxyman 1.4.3)

Proxyman 1.7.1

macOS Version? (Ex. mac 10.14)

macOS 10.15 (19A602)

Steps to reproduce

Launch Proxyman, or disable and re-enable "Override macOS Proxy"

Expected behavior

It should capture flows the whole time it's active.

Actual behavior

It only logs new flows for a few seconds and then just stops logging them. Disabling and re-enabling "Override macOS Proxy" will log flows for a few more seconds, then stop.

---

This is a fresh install of Proxyman, first time using it. I installed the root certificate as well as the Proxy Setting Tool, but I'm pretty sure this problem was occurring from the very moment I first launched the app. I skimmed Console.app (searching for "Proxyman") and didn't notice anything that looked relevant.

[NghiaTranUIT]

Hey there @lilyball

It's odd when Proxyman only logs the traffic few seconds after launching.

I test Proxyman on 10.14 and 10.15 whole the time, but never encounter this weird issues.

Can you please help me answer some questions, so I could investigate it:

1. After few seconds from the launch, Proxyman doesn't log any requests. Are you able to use the Internet as usual? or All connections are dropped?

2. Do you use any VPN or Shadowsocks app? If yes, please try to turn it OFF.

Thank you in advance.

[NghiaTranUIT]

3. Do you use Guest user or admin?

[lilyball]

1. Internet works fine as usual.
2. I have a company VPN (using Viscosity). I don't remember if it was enabled at the time that I ran into this issue.
3. Admin

I just tested again and it's working fine, even with my VPN enabled. However I am at home on wifi, whereas before I was at work on ethernet. I wouldn't expect that to make a difference, but it's the first difference that comes to mind. I'll have to test again when I'm back in the office on Thursday.

If I do run into this again, is there any more diagnostics I can gather?

[NghiaTranUIT]

I suppose that after few seconds after the launch, some apps (could be company VPN) override the HTTP Proxy and it doesn't point to Proxyman's port (9090).

Thus, it results:

• The Internet works normal
• There are no logs in Proxyman

If you back to the office, let try again. If it still happens, please check:

• Do HTTP and HTTPS Proxy in Network.prefPanel point to Proxyman's port?

[lilyball]

The proxy settings was the very first thing I checked before I even filed this issue. As long as Proxyman was running and had the proxy enabled, it was properly pointed at 127.0.0.1:9090, and toggling "Override macOS Proxy" off disabled that, and toggling it back on re-enabled it.

[NghiaTranUIT]

I checked on Ethernet on my mac mini and it's fine.

I suspect that some apps turn HTTP/HTTPS Proxy as soon as Proxyman overrides it. Can you try to disable those VPN apps?

[lilyball]

My VPN app doesn't touch the system proxy settings, and I verified while Proxyman was busted that the proxy settings were enabled correctly.

Anyway it's still working correctly today, with VPN enabled, with the app I wanted to debug active. I'll test again tomorrow when I'm in the office as that's really the only difference I can think of between now and when it was broken.

[NghiaTranUIT]

Thank for your patient @lilyball. Please bump any issues here, I'm looking forward to fix this issues 🌮

[lilyball]

It's happening at the office, with VPN on. With VPN off it works fine. This is the same VPN that worked perfectly fine from home too.

I've tested with ethernet unplugged (so using wifi), still broken. I tried plugging in ethernet and turning off wifi, still broken. If I'm in the office, and the VPN is on, Proxyman doesn't work.

I also double-checked, the proxy settings are configured (for both interfaces), so the VPN app isn't turning that off.

[NghiaTranUIT]

If those VPN apps doesn't turn OFF the HTTP/HTTPS Proxy, but Proxyman still couldn't capture the traffics. I'm not sure how to fix it.

Maybe the traffic goes through VPN in different mechanism, which Proxyman couldn't handle.

Does you encounter this issue with other apps like Charles Proxy and Wireshake?

[lilyball]

I haven't tried those other apps yet.

FWIW, route get 127.0.0.1 tells me it's still using lo0 so the VPN really shouldn't be intercepting that (I'm pretty sure it only intercepts internal domains anyway; route get on an internal domain gives me utun10, and route get example.com gives me en8 which is my ethernet adapter).

[NghiaTranUIT]

What is the VPN app are you using? I would reproduce in my local machine 🤖

[lilyball]

Viscosity

[optimusbits]

Similar issue is with Cisco AnyConnect vpn.

[NghiaTranUIT]

Thank for those app name. I will spend next week to investigate this mysterious case 👍

[NghiaTranUIT]

Hey @lilyball @optimusbits

I’ve just installed those apps and some VPNs and confirmed that Proxyman couldn’t properly work with this VPN.

The reason is that some VPNs doesn’t override the HTTP/HTTPS Proxy in Network System to navigate the traffic. Those apps often instruct us to install the Helper Tool (https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/AccessControl.html) and all network are navigate in the low-level of the system.

Therefore, Proxyman and other apps like Charles Proxy, Fiddler and even though Wireshark couldn't capture any traffics.

Here is what I investigated before:

• https://github.com/ProxymanApp/Proxyman/issues/264#issuecomment-525387578 and here Fiddler & Wireshark issues on VPNs
• https://serverfault.com/questions/379972/how-to-monitor-vpn-traffic-with-wireshark-on-windows-7
• https://www.telerik.com/forums/fiddler-not-capturing-calls-in-vpn
• https://superuser.com/questions/1334060/charles-proxy-doesnt-work-with-vpn

Finally, I suggest that we should disable VPN when debugging Proxyman.

Or try Private Internet Access VN (https://www.privateinternetaccess.com) since it works with Proxyman

[michahell]

This is happening for me too, without any VPN 😢 Why are proxy tools so hard to get working always... Mac OSX Catalina: 10.15.7 Proxyman: Version 2.16.1 (21610) Fresh install, installed the certificate, same thing happens: I see 5/6 or so requests come in and then everything just stops.

[NghiaTranUIT]

Sorry to hear that. It's notorious that Proxy Tools doesn't cooperate well with VPN apps 😿

Is it possible to disable the VPN when you start debugging the app? @michahell

[michahell]

@NghiaTranUIT this is happening to me without any VPN active. Do you think even having a VPN app installed might influence things?

[NghiaTranUIT]

Maybe some apps override the HTTP/HTTPS Proxies in Your wifi setting, it might be a VPN app.

You can verify it by open Network preference->Wifi->Advance->Proxies tab and see the http and https proxy value changes after opening Proxyman app.

[ssayfulin69]

I have the same issue using Proxyman (or Charles) and Viscosity together. I try to capture traffic from iOS Simulator. And actually, here is interesting thing I noticed.

Proxyman doesn't see any traffic while VPN is connected. But I disconnect VPN, make single request, which is captured by Proxy, and connect to VPN again. After that weird manipulations Proxyman continues to capture requests for a while, but after some time it is blind again, whereas iOS Simulator is working perfectly.

[NghiaTranUIT]

@srebalaji you might check out this Viscosity documentation on how to setup HTTP/HTTPS proxy on Viscosity.

#viscosity proxy-http localhost 9090
#viscosity proxy-https localhost 9090

By doing this way, I suppose that your issue can be fixed 👍 😄

[rakeshkarkare]

Heyy @NghiaTranUIT , I am also unable to capture requests in proxyman for iOS Simulators when connected with Pulse secure vpn. But same works without VPN.

[NghiaTranUIT]

If you're using Pulse Secure VPN, please check out this: https://docs.proxyman.io/troubleshooting/proxyman-does-not-work-with-vpn-apps#4.-pulse-secure-and-global-protect-vpn

Or find a way to not use any VPN app 😄

[rakeshkarkare]

Unfortunately I can't skip VPN app as my application will not work without VPN in lower environment, I will try https://docs.proxyman.io/troubleshooting/proxyman-does-not-work-with-vpn-apps#4.-pulse-secure-and-global-protect-vpn

[NghiaTranUIT]

If it's required to use the VPN, you can use our Atlantis framework (https://docs.proxyman.io/atlantis/atlantis-for-ios), it can capture the traffic, but it's only for inspecting, not debugging with tools.

[rakeshkarkare]

yeah with atlantis I can capture logs but want to use proxyman feature of remote map and local map which I can't do with atlantis