Hacker News Reader

Pardon the lay question, but is it really the only way out of the network? Can't programs initiate connections while skipping the system-wide configured proxy?

View on HN

Sure they can.. but they can’t get around your outgoing firewall rule that reroutes alle traffic for certain ports to the proxy.

Hm, I have to see if Mikrotik has rule syntax for this. I can already force every app who thinks they will use their own DNS server to use mine but not sure how I could do the same with a proxy. Maybe just force ports 80 and 443? But what's stopping these apps to communicate on non-standard ports?

There's no reason to allow arbitrary traffic in either direction other than convenience. If you want a more secure network, you block everything by default and narrowly open as needed.

That means I'll stop 99% of all outgoing traffic. Still interested in how to force all traffic to a proxy though.

https://docs.mitmproxy.org/stable/howto-transparent/

Thanks, I'll give this a thorough read.

If it's only for certain ports, they can just use non-standard ports.

Not uncommon to have a drop all rule as default on outgoing packets as well.

Regular http gets redirected to proxy, non-standard traffic needs to be explicitly allowed out.

Reply on news.ycombinator.com