Show HN: Forwarder – FOSS MITM proxy written in Go (forwarder-proxy.io)

> blocking rules around newly registered DNS

Why is this even a thing?

Thank you, looks like we could apply some hardening here indeed.

This is incredible feedback, good eye

Sent a PR to fix that https://github.com/saucelabs/forwarder/pull/617.

You have a lot of flexibility with PAC files, so I guess that's possible. Some PAC files can be quite complex.

Another option would be using --deny-domains it accepts a list of regular expressions, you can prefix an item with - to exclude it.

https://forwarder-proxy.io/cli/forwarder_run/#deny-domains

That's not currently on the roadmap.

Please file an issue, we'll see what we can do.

Nginx is built as a reverse proxy, useful to intercept traffic coming in to a server and route it to the correct service. This is the opposite, I guess we can call it an obverse proxy: it sits near a client and allows the owner (or a malicious party) of the client to intercept the traffic as it leaves the client. A former employer of mine used something like this to gain access to the API calls being made from iPhone apps, but you could use it to say attach authentication to calls heading a certain way (think what AWS is doing to make service to service calls work transparently to the user) or tons of other stuff (blocking content, if you’re so inclined).

I haven’t tried to use nginx as an MITM proxy or this project at all, but presumably it’s easier to use this when your usecase lies closer to the client than the server and vice versa.

Tools like Fiddler allow traffic modification based on rules, so you can tamper traffic. Forwarder doesn't appear to allow modification (other than headers?) so I think it's about logging traffic and collecting metrics. Still looking at the docs, I could have missed something.