search

sonertari / SSLproxy

Transparent SSL/TLS proxy for decrypting and diverting network traffic to other programs, such as UTM services, for deep SSL inspection
BSD 2-Clause "Simplified" License
377 stars 98 forks source link

Connection not found in NAT state table #27

Closed arunppsg closed 3 years ago

arunppsg commented 3 years ago

For bug reports, please supply:

I use sslproxy for analysing https packet. I use firefox browser and added manual proxy configuration with https proxy 127.0.0.1 8443. I use a python program to listen for connections in port 8080. But once I enter an url in the browser, the ssl proxy is not redirecting packet to the python script.

Any help on why the python script listening on port 8080 is not able t gather the packets will be useful. Thanks.

sonertari commented 3 years ago

I guess you run the Firefox on the same machine you run the SSLproxy instance, right? If so, it is expected that the connection SSLproxy receives is not in the NAT table of the system. I suggest that you use a Firefox on another machine, so the connections from that Firefox show up in the NAT table.

arunppsg commented 3 years ago

I tried using Firefox from a different machine. In this setup, the sslproxy runs in a machine and the firefox browser from another machine directs traffic to the sslproxy. But the same error raises - Error from getsockopt(SO_ORIGINAL_DST): Protocol not available, connection not found in NAT state table, aborting connection. From my understanding, there are two parts of this error:

sonertari commented 3 years ago

You also say that you have "added manual proxy configuration" to Firefox. That's not how traffic should be redirected to sslproxy, do not use any proxy configuration on Firefox. Please read the NAT ENGINES section in the sslproxy man page, and search for the word "redirect" in the man page to see your options.

arunppsg commented 3 years ago

iptables -t nat -A PREROUTING -s 192.0.2.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 10080

iptables -t nat -A PREROUTING -s 192.0.2.0/24 -p tcp --dport 443 -j REDIRECT --to-ports 10443

Running these two commands solved the problem. Thanks. If I am not wrong, the application forwards connections to destination ports 80, 443 via port 10080, 10443.

sonertari commented 3 years ago

I suppose sslproxy listens on ports 10080 and/or 10443, instead of the one in your first post. And I suppose your local network where the Firefox connects from has the network address 192.0.2.0/24. If so, I think all looks fine now.

arunppsg commented 3 years ago

Thanks for your help.

vicnetto commented 1 year ago

Hello @sonertari!

However, if it were necessary to use iptables on the same computer as SSLProxy, to redirect all localhost requests from one port to another (443 -> 8443, for example), would that be feasible?

sonertari commented 1 year ago

Honestly, I don't know if such a redirect rule would make such connections show up on the NAT table.