InterceptSuite 2.1.0: Built-in Traffic Redirect for Windows and One-Click CA Install

InterceptSuite 2.1.0 removes two chores that came before almost every test: getting an application's traffic into the proxy, and trusting the CA certificate.

Traffic redirect for Windows

Many thick clients have no proxy setting, ignore the system proxy, or use their own DNS. Until now you used ProxyBridge next to InterceptSuite for those. On Windows that redirect is now built into the app, in Proxy > Redirect.

Application  ->  redirect (Windows network stack)  ->  InterceptSuite SOCKS5 (127.0.0.1:4444)  ->  Server

1. Open Proxy > Redirect and click Add.
2. Enter the program name, for example app.exe, and leave Action on Proxy.
3. Click Start Redirect and use the application.

Its traffic appears in Proxy History like any other connection, ready to inspect, edit and replay.

Rules

• Per application: one or more program names separated by ;, or * for every application.
• Per destination: IP addresses, ranges, CIDR blocks and domain names such as 10.0.0.0/8; *.example.com.
• Per port and protocol: a port, a list, a range (80,443,8000-9000), and TCP, UDP or both. UDP means DTLS and QUIC from an application can be redirected too.
• Action: Proxy (send through InterceptSuite), Direct (leave alone) or Block.
• Localhost: connections to 127.0.0.1 are left alone unless you tick the per-rule localhost option.
• The first matching rule wins, and an application that matches no rule is untouched. Rule 1 is always InterceptSuite.exe -> Direct, so the app can never loop back into itself.
• Rules are saved with the project. Redirect itself is off every time the app starts and when you switch project.
• Pause stops redirecting new connections without losing your rules, and redirect follows the proxy: it pauses when the proxy stops and resumes when it starts again.

Domain rules are matched from the application's own DNS lookups, so they work for normal DNS only. If the application uses DNS over HTTPS or TLS, match by IP address instead. Full reference: Traffic Redirect.

How it is built, and why it does not need admin for the app

Redirecting traffic needs a network driver, and loading one needs administrator rights. InterceptSuite keeps those rights out of the app:

• A small Windows service, InterceptSuite Traffic Redirect, holds the driver. It is the ProxyBridge engine on top of the WinDivert driver, built and signed by us.
• You install it once: tick Set up traffic redirect on the last page of the installer, or click Set Up Redirect Service... in the Redirect tab. Windows asks for permission once. After that, InterceptSuite runs as a normal user.
• It installs into C:\Program Files\InterceptSuite\Redirect, a folder only administrators can change, because the service runs with high privileges. It starts on demand and does nothing while redirect is off.
• Only your Windows account (and administrators) can control the service. InterceptSuite checks that the program it talks to really is the service, and that the setup program is signed by InterceptSuite before Windows is asked to run it as administrator.
• Remove it any time from Settings > Apps ("InterceptSuite Traffic Redirect").

macOS and Linux keep using ProxyBridge for per-application routing. The built-in redirect is Windows only for now.

Install Certificate: one click on Windows, macOS and Linux

Proxy > Settings > Certificate Management has a new Install Certificate button next to Export and Regenerate. It puts the CA certificate into the operating system's trust store:

OS	Where it goes	Prompt
Windows	Local Machine > Trusted Root Certification Authorities	One UAC prompt
macOS	Your login keychain, trusted for your user	Your macOS password
Linux	The distribution's trust folder (Debian, Ubuntu, Fedora, RHEL, openSUSE, Arch)	Graphical password prompt (pkexec)

An older InterceptSuite certificate, for example from before a regenerate, is replaced. InterceptSuite itself never runs elevated. Applications with their own store, such as Firefox, still need the certificate imported separately, so Export Certificate stays. See Proxy Settings and the install guides for Windows, macOS and Linux.

Fixes

• The app no longer keeps running after you close the window. The window now shuts down cleanly, with a safety net if a background thread refuses to stop. This also fixes the case on Linux where a closed window left a process using a CPU core, caused by an accept loop that kept spinning after a failed accept.
• No more "Not responding" under heavy traffic. Adding many rows to Proxy History and Connections is now spread over short slices, so a burst of thousands of connections shows up a moment later instead of freezing the window.

Upgrading from 2.0.0

• Existing projects open as they are. Redirect starts off, with no rules apart from the built-in rule for InterceptSuite itself.
• The redirect service is only installed if you tick the box in the installer or press Set Up Redirect Service....
• The installer and the app are signed by InterceptSuite.

Known limitations

• Traffic redirect is Windows only for now.
• Some antivirus products (for example Kaspersky) label the WinDivert driver a "RiskTool" because it can redirect traffic. It is the driver other redirect tools use, and it carries its original vendor signature.
• Connections that use Encrypted Client Hello (ECH) cannot be intercepted; turn ECH off in the browser.

WinDivert is licensed under the LGPL v3 and ProxyBridge under the MIT license; their licenses and source locations are in the licenses folder of the install. Download 2.1.0 or start the 7-day trial.