Intercept local connections with NETransparentProxyProvider

Question

Created Jul ’25

Replies 1

Boosts 0

Participants 2

I am trying to intercept localhost connections within NETransparentProxyProvider system extension. As per NENetworkRule documentation

If the address is a wildcard address (0.0.0.0 or ::) then the rule will match all destinations except for loopback (127.0.0.1 or ::1). To match loopback traffic set the address to the loopback address.

I tried to add

NWHostEndpoint *localhostv4 = [NWHostEndpoint endpointWithHostname:@"127.0.0.1" port:@""];
    NENetworkRule *localhostv4Rule = [[NENetworkRule alloc] initWithDestinationNetwork:localhostv4 prefix:32 protocol:NENetworkRuleProtocolAny];

in the include network rules. I tried several variations of this rule like port 0, prefix 0 and some others. But the provider disregards the rule and the never receives any traffic going to localhost on any port.

Is there any other configuration required to receive localhost traffic in NETransparentProxyProvider?

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’25

I’m surprised that doesn’t work.

How are you testing this? My advice is to test it using nc, so run a ‘server’ like this:

% nc -l 12345

and a ‘client’ like this:

% nc 127.0.0.1 12345

If you try that, does your provider see the connection?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0