Proxy Settings

Configure and manage proxy server settings in InterceptSuite.

Overview

The Proxy Settings section (Proxy > Settings) provides complete control over the proxy server, including network configuration, logging verbosity, and certificate management. This is where you tune the core proxy behavior.

Proxy Server Control

Starting and Stopping

Use the Start/Stop controls to manually manage the proxy server
By default, the proxy starts automatically when you launch InterceptSuite
Changes take effect immediately

Default Configuration

Setting	Default Value
IP Address	`127.0.0.1`
SOCKS5 Port	`4444`
Protocol	SOCKS5
Auto-start	Enabled

Network Configuration

SOCKS5 Proxy Settings

You can customize the IP address and port the proxy listens on:

Select IP Address -Choose from available system IPs in the dropdown
Set Port Number -Enter your desired SOCKS5 proxy port (default: 4444)
Save Settings -Click save; the configuration takes effect immediately

Port changes apply instantly without restarting the proxy service.

UDP Relay Settings

The UDP relay port is fixed and not configurable:

Setting	Value
UDP Relay Port	`4445`
IP Address	Same as SOCKS5 proxy IP
Configurable	No

The UDP relay automatically binds to the same IP address as the SOCKS5 proxy. There is no manual configuration for the UDP relay port.

Logging Configuration

Verbose Logging

Enabling verbose logging adds significantly more detail to the log output:

Default: Standard logging (connection events, errors)
Verbose: Additional packet-level and diagnostic information

When to enable verbose logging:

Diagnosing connection problems
Troubleshooting extension behavior
Performing in-depth traffic analysis
Development and testing of extensions

Performance note: Verbose logging increases log size and processing overhead. Disable it for production use or when performance matters.

Certificate Management

The Certificate Management section has three buttons: Export Certificate, Install Certificate and Regenerate Certificate.

Install Certificate

Click Install Certificate to add the InterceptSuite CA certificate to your operating system's trust store, so TLS, DTLS and QUIC interception works without certificate errors. InterceptSuite itself never runs as administrator; the operating system asks for permission for this one step.

OS	What it does	What you see
Windows	Adds the certificate to Local Machine > Trusted Root Certification Authorities (all users).	One Windows permission (UAC) prompt.
macOS	Adds the certificate to your login keychain and trusts it for your user.	macOS asks for your password.
Linux	Writes the certificate into the distribution's trust folder and refreshes the trust store.	A graphical password prompt (`pkexec`).

Details:

A previous InterceptSuite certificate (for example from before you regenerated) is replaced where the operating system allows it, so old and new do not pile up.
The result is shown next to the button and written to the Logs tab. On Windows it checks that the certificate really is in the store afterwards.
Linux trust folders by distribution: Debian, Ubuntu and Mint use /usr/local/share/ca-certificates/ with update-ca-certificates; Fedora, RHEL and CentOS use /etc/pki/ca-trust/source/anchors/ with update-ca-trust extract; openSUSE uses /etc/pki/trust/anchors/; Arch uses /etc/ca-certificates/trust-source/anchors/. The file is called interceptsuite-ca.
If the distribution is not recognised, or pkexec is not installed, you get a message that says so. Use Export Certificate and install it manually (see the Quick Start for your platform).
It installs into the operating system store only. Applications that keep their own store, such as Firefox, Java, or Python and Node with their own bundles, need the certificate added to them separately (use Export Certificate).

Export Certificate

Click Export Certificate to save the InterceptSuite CA certificate and private key:

Exports in DER format
Includes the private key
Use the exported certificate to install trust on client systems

Common uses:

Installing the CA cert on target systems
Adding to browsers, applications, or container environments
Backing up the certificate before regenerating

Regenerate Certificate

Click Regenerate Certificate to immediately create a new CA certificate:

The current CA certificate is deleted and replaced instantly
No proxy downtime -regeneration completes without stopping the service
The new certificate is available immediately after regeneration

When to regenerate:

The certificate may be compromised
Starting a fresh analysis project and want a clean cert
Certificate trust issues on client systems
As part of a periodic security rotation policy

Important: After regenerating, all client systems must reinstall the new CA certificate for TLS interception to work correctly. On this computer, click Install Certificate again. The old certificate will no longer be trusted by InterceptSuite.

Interception Rules

The Proxy > Settings tab also holds the interception direction switches and rules, which decide which packets are held. See Interception Rules.

TLS Pass-Through

Relay selected destinations without decrypting them, for applications that pin certificates. See TLS Pass-Through.

Traffic Redirect (Windows)

The Redirect tab, next to Settings, sends selected applications through the proxy without changing their settings. See Traffic Redirect.

Upstream Proxy, Scope and AI Access

These are in the top-level Settings tab, not here. See Global Settings.

Configuration Workflow

Initial Setup

Verify the defaults (IP 127.0.0.1, port 4444) meet your needs
Adjust IP or port if you need to proxy traffic from other hosts on your network
Enable verbose logging if you need detailed diagnostic information
Click Install Certificate on this computer, or export the CA certificate and install it on your target systems

Ongoing Management

Monitor proxy status to ensure it's running when needed
Adjust the IP/port configuration as your environment changes
Export or regenerate certificates as needed
Toggle verbose logging when troubleshooting, disable afterward

Important Notes

Network Considerations

IP selection -If you need other devices to proxy through InterceptSuite, bind to your local network IP instead of 127.0.0.1
Port conflicts -Ensure the selected ports (4444, 4445) are not already in use by other services
Firewall rules -Configure your firewall to allow inbound traffic on the configured ports if intercepting from remote devices

Certificate Impact

Regenerating the CA certificate immediately breaks TLS interception for all clients until they install the new certificate
Always export a backup of the certificate before regenerating if you need to restore it later