Traffic Redirect (Windows)

Traffic Redirect (Windows)

Send the traffic of selected applications through InterceptSuite without changing their settings. Use it for thick clients and other programs that have no proxy option, ignore the system proxy, or bring their own DNS.

Windows only for now. The Redirect tab appears in Proxy on Windows. On macOS and Linux, use ProxyBridge alongside InterceptSuite, as described in the Quick Start guides.

How it works

Application  ->  (redirect, in the Windows network stack)  ->  InterceptSuite SOCKS5 (127.0.0.1:4444)  ->  Server

• Matching connections are caught at the operating system level by the WinDivert driver and handed to InterceptSuite's SOCKS5 proxy. The application is not modified and is not told.
• It works for TCP and UDP, so DTLS and QUIC traffic from an application can be redirected as well as TLS.
• The engine is ProxyBridge's, packaged by InterceptSuite as a small Windows service called InterceptSuite Traffic Redirect.
• InterceptSuite itself runs without administrator rights. Only the one-time setup needs them.

One-time setup

The redirect service has to be installed once, because loading a network driver needs administrator permission. There are two ways:

Way	Steps
In the installer	Leave Set up traffic redirect (needs admin) ticked on the last page of the InterceptSuite installer. Windows shows one permission prompt.
From the app	Open Proxy > Redirect and click Set Up Redirect Service.... Windows shows one permission prompt. The button only appears while the service is not installed.

What setup does:

• Installs the service files into C:\Program Files\InterceptSuite\Redirect, a folder only administrators can change, because the service runs with high privileges.
• Registers the InterceptSuite Traffic Redirect service, started on demand by InterceptSuite. Nothing runs in the background while you are not using redirect.
• Allows your Windows account to start and control it. Administrators can too.
• Adds an entry in Settings > Apps so you can remove it.

The setup program is signed by InterceptSuite. The installer and the app both check that signature before asking Windows to run it, and refuse to run a file that is not signed by us.

To remove it later, uninstall InterceptSuite Traffic Redirect from Settings > Apps (uninstalling InterceptSuite offers this too). It stops and deletes the service, the driver, the user group and the files.

Using redirect

1. Open Proxy > Redirect.
2. Add a rule (see below) for the application you want, for example curl.exe.
3. Make sure the proxy is running (it starts with the app by default), then click Start Redirect.
4. Start or use the application. Its connections appear in Proxy History like any other traffic. The Redirected connections list on the tab shows what was sent through the proxy.
5. Click Stop Redirect when you are done.

Control	What it does
Start / Stop Redirect	Turns the redirect on or off. It is off whenever the app starts and when you open another project.
Pause / Resume	Stops redirecting new connections without losing your rules or the connection to the service.
Set Up Redirect Service...	One-time setup (shown only when the service is not installed).
Clear	Empties the Redirected connections list.

Redirect follows the proxy: if you stop the proxy, redirect pauses ("Paused: the proxy is stopped") so applications are not sent to a proxy that is not there, and it resumes when the proxy starts again. It also uses the proxy address and port you set in Proxy > Settings.

Rules

Rules decide which applications are redirected. The first matching rule wins, and an application that matches no rule is left alone. Use Add, Edit, Remove, Up and Down to manage them.

Rule 1 is built in and cannot be changed: InterceptSuite.exe -> Direct. It keeps InterceptSuite's own connections out of the redirect so they cannot loop back into the proxy.

Field	Meaning
Enabled	Untick to keep the rule without applying it.
Application(s)	Program names separated by ;, for example curl.exe; chrome.exe. Use * for every application.
Destination hosts	Optional. IP addresses, ranges, CIDR blocks and domain names, separated by ; or ,, for example 10.0.0.0/8; *.example.com. Empty or * means any.
Ports	Optional. One port, a list, a range, or any mix, for example 80,443,8000-9000. Empty means any.
Protocol	TCP, UDP or Both.
Action	Proxy (send through InterceptSuite), Direct (let it go out normally) or Block (drop the connection).
Also redirect connections to this computer (localhost)	Off by default. Turn on when the application talks to a service on 127.0.0.1 that you want to intercept.

Rules are saved with the project. Opening a project from an older version simply has no rules.

Rule order

Put narrow rules above broad ones. To intercept everything except one program:

#	Application	Hosts	Action
1	InterceptSuite.exe	any	Direct (built in)
2	backup-agent.exe	any	Direct
3	*	any	Proxy

Things to know about hosts

• Domain names are matched from the application's own DNS lookups, so they work for normal (unencrypted) DNS only. If the application uses DNS over HTTPS or DNS over TLS, match by IP address or CIDR instead.
• * blocks are refused if they would cut you off: a Block rule for every application, every host and every port is not allowed, because it would also drop remote desktop and SSH sessions into the machine. Narrow it with a host or a port.
• Each field has a length limit (8191 characters for applications and hosts, 250 for ports).

Example: a thick client that ignores the proxy

1. Open Proxy > Redirect and click Add.
2. Application(s): BetaBank.exe, Protocol: TCP, Action: Proxy, then Save.
3. Click Start Redirect.
4. Run the application. Its traffic, including TLS, appears in Proxy History, where you can inspect, edit and replay it.

The same works for UDP applications: set Protocol to UDP or Both, and DTLS and QUIC are decrypted like any other traffic once the CA certificate is installed.

Troubleshooting

Message or problem	What to do
The Redirect tab is missing	It is Windows only.
Set Up Redirect Service... is shown, or "The traffic redirect service is not installed or could not be started"	The service is not installed yet. Click the button and accept the Windows permission prompt.
"Installation cancelled" / the prompt was declined	Click Set Up Redirect Service... again and accept the prompt.
"Start the proxy first (Proxy > Settings), then start the redirect."	Redirect sends traffic to the proxy, so the proxy must be running.
"The redirect engine is in use by another program (the ProxyBridge window?)"	The service serves one client at a time. Close ProxyBridge, or anything else using it on this computer, and try again.
"This Windows account is not allowed to use the redirect service"	Only administrators and the account that ran the setup can use it. Run Set Up Redirect Service... from the account you use, or ask an administrator to add you to the InterceptSuite Redirect Users group.
"The redirect service speaks a different protocol version"	The app and the service are from different versions. Run the setup again (Set Up Redirect Service...) from the installed version.
Nothing shows in Proxy History	Check that the proxy is running, the rule is enabled, and the Application(s) name matches the program's exact file name. Only new connections are redirected, so restart the application after you start the redirect.
TLS errors in the application	Install the CA certificate. Applications that pin certificates need TLS Pass-Through.
Antivirus flags the driver	See the notes below.

Security and licensing notes

• Redirect uses the WinDivert driver, which redirects network traffic. Some antivirus products (for example Kaspersky) label it a "RiskTool" for that reason. The driver carries its original vendor signature, and the other InterceptSuite files are signed by InterceptSuite.
• The service only accepts commands from your Windows account (and administrators). InterceptSuite, in turn, checks that the program it is talking to is the genuine redirect service before sending it anything.
• WinDivert is licensed under the LGPL v3 and ProxyBridge under the MIT license. Their licenses and the source location are in the licenses folder of the install.