1

I am using 2 proxies to intercept the communication between my phone and my server. Here is my topology:

phone --> proxy 1 --> proxy 2 --> server

proxy1 is listening to port 8080, proxy 2 is listening to port 8080 but I redirect all what it gets to ports 80 and 443, finally my server is listening to port 443.

phone's IP address : 192.168.10.199

proxy2's IP address: 192.168.10.246

server's IP address: 192.168.10.211

All the devices I am using are in my LAN.

The first proxy is installed on my phone (Android) and it enables me to route all the traffic coming from my phone to the second proxy (when I use the second proxy on its own, it doesn't intercept all the traffic, that's because some applications choose to communicate directly with the server without passing by the proxy even though my phone is rooted).

I use Wireshark to visualize the communication between my phone and the server on the second proxy which is mitmproxy, I've installed the certificate on my phone, and here is what I get:

192.168.10.199 192.168.10.246 POST /message HTTP/1.1

192.168.10.199 is the IP address of my phone and 192.168.10.246 is the IP address of proxy 2, so proxy 2 is receiving the information from my phone, but when it tries to transmit to the server, here is what I get:

192.168.10.246 192.168.10.199 HTTP/1.1 502 Bad Gateway (text/html), Alert (Level: Warning, Description: Close Notify)

Here is exactly the message I get on Wireshark:

<html>
        <head>
            <title>502 Bad Gateway</title>
        </head>
        <body>
        <h1>502 Bad Gateway</h1>
        <p>TlsProtocolException(&quot;Cannot establish TLS with 192.168.10.211:443 (sni: None): TlsException(&#x27;Cannot validate certificate hostname without SNI&#x27;,)&quot;,)</p>
        </body>
</html>

I tried running the same request POST https://192.168.10.211:443/message on Postman and the message I get is not the same:

Could not get any response There was an error connecting to https://192.168.10.211:443/message.

Why this might have happened:

The server couldn't send a response:

Ensure that the backend is working properly Self-signed SSL certificates are being blocked:

Fix this by turning off 'SSL certificate verification' in Settings > General

Proxy configured incorrectly

Ensure that proxy is configured correctly in Settings > Proxy

Request timeout:

Change request timeout in Settings > General

I am trying to understand what's exactly happening? My guess is the certificate must be installed on the first proxy (which is installed on my phone) not on the phone itself and that's why I get the exception above. Am I right?

Improve this question
2
  • Could you please fix a typo there: proxy2's IP address: 192.168.10.264. Should be 192.168.10.246
    – Sergey Nudnov
    Commented May 27, 2019 at 17:51
  • @SergeyNudnov Thank you for your remark. I changed it :)
    – yosra
    Commented May 28, 2019 at 9:08

2 Answers 2

Reset to default
0

This appears to be a server side error not a device specific error.

Have you confirmed that the web server is running on port 443 and accessible without the proxy?

Here is some more information regarding the actual 502 error code. https://www.lifewire.com/502-bad-gateway-error-explained-2622939

Improve this answer
4
  • Yes, the server is listening to port 443 and is accessible without the proxy.
    – yosra
    Commented May 27, 2019 at 14:50
  • I've just updated my post; I added the port numbers to which my devices are listening. On the article you linked they say that there may an error on my end, so I tried changing the ports that the first proxy is listening to and it magically worked. But I don't understand why? what's wrong with my configuration? Are you please able to explain that?
    – yosra
    Commented May 27, 2019 at 15:09
  • Honestly I am unsure. Rule of thumb is one port per IP so it can be bound properly. Unless there was something else listening on 443 and the proxy could not bind the the webserver. After you changed the port was 443 also accessible ?
    – Setsquared
    Commented May 27, 2019 at 15:42
  • yes it was accessible after I changed the port on proxy1
    – yosra
    Commented May 28, 2019 at 8:33
0

Update

Initially I thought the problem is with Proxy 2...

It must be that your Proxy 1 forwards requests without maintaining host headers. Configure it to maintain host headers.

If you would provide what kind of proxy is that, I could update my answer with a proper config.

For example, for Apache you could use ProxyPreserveHost directive. See the docs.

For mitmproxy it is keep_host_header, described there

Improve this answer
2
  • The name of the proxy is mitmproxy.
    – Michael Hampton
    Commented May 27, 2019 at 17:03
  • Thank you for your response. But proxy 1 is not a mitmproxy it's proxyDroid which is an android proxy app and I'm afraid I am not able to configure it to maintain the headers.
    – yosra
    Commented May 28, 2019 at 8:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .