mitm/TROUBLESHOOTING.md

152 lines
3.9 KiB
Markdown

# MITM Proxy Troubleshooting Guide
## ERR_TUNNEL_CONNECTION_FAILED Error
This error typically occurs when the browser cannot establish a secure tunnel through the proxy. Here are the most common causes and solutions:
### 1. Certificate Issues
**Problem**: The CA certificate is not properly installed or trusted by the browser.
**Solutions**:
- Run the program as Administrator to ensure certificate installation
- Manually verify certificate installation:
```cmd
certlm.msc
```
Check if "Charles Proxy CA" appears in "Trusted Root Certification Authorities"
- If certificate installation fails, try:
```cmd
certutil -addstore -f "Root" CA.crt
```
### 2. Proxy Configuration Issues
**Problem**: System proxy is not properly configured or there are conflicting proxy settings.
**Solutions**:
- Verify proxy settings in Windows:
- Go to Settings > Network & Internet > Proxy
- Ensure "Use a proxy server" is enabled
- Check that proxy address is `127.0.0.1:8080`
- Clear existing proxy settings:
```cmd
netsh winhttp reset proxy
```
### 3. Firewall/Antivirus Blocking
**Problem**: Security software is blocking the proxy connections.
**Solutions**:
- Temporarily disable Windows Firewall
- Add exception for the proxy program in antivirus software
- Add exception for port 8080
### 4. TLS Handshake Issues
**Problem**: The proxy cannot properly negotiate TLS connections.
**Solutions**:
- The updated code now includes:
- Better TLS handshake handling
- Fallback to transparent proxy mode
- Improved error logging
- Connection timeouts
### 5. Testing and Debugging
Use the built-in test mode to verify connectivity:
```cmd
# Run with test flag
go run . -test
```
This will:
- Start the proxy server
- Test HTTP and HTTPS connections
- Show detailed error messages
- Help identify the specific issue
### 6. Common Error Messages and Solutions
**"TLS handshake failed"**:
- Certificate not trusted by browser
- Try accessing a simple HTTP site first
- Check certificate installation
**"Failed to connect to target server"**:
- Network connectivity issue
- DNS resolution problems
- Target server blocking connections
**"Write error" or "Read error"**:
- Connection interrupted
- Network timeout
- Proxy overloaded
**HTTP Redirects (302/301) Issues**:
- ✅ FIXED: Proxy is now completely transparent
- All redirects are passed through exactly as-is
- Browser handles redirects automatically
- No interference with redirect chains
### 7. Manual Testing Steps
1. **Test without proxy**:
```cmd
curl https://httpbin.org/ip
```
2. **Test with proxy**:
```cmd
curl --proxy 127.0.0.1:8080 https://httpbin.org/ip
```
3. **Test certificate**:
```cmd
curl --proxy 127.0.0.1:8080 --insecure https://httpbin.org/ip
```
### 8. Browser-Specific Issues
**Chrome**:
- Clear SSL state: Settings > Privacy and security > Security > Manage certificates > Clear SSL state
- Disable certificate transparency checks temporarily
**Firefox**:
- Import certificate manually: Settings > Privacy & Security > Certificates > Import
- Disable OCSP checking temporarily
**Edge**:
- Same as Chrome (uses Windows certificate store)
### 9. Advanced Debugging
Enable verbose logging by modifying the code to show more details:
- Connection attempts
- TLS handshake details
- Certificate validation steps
- Network I/O operations
### 10. Alternative Solutions
If the proxy still doesn't work:
1. **Use transparent mode only**: Modify code to skip TLS termination
2. **Use different certificate**: Generate new certificates with proper SAN fields
3. **Use different port**: Change from 8080 to 8081 or 3128
4. **Bypass problematic domains**: Add exceptions for specific sites
## Getting Help
If none of these solutions work:
1. Run with `-test` flag and save the output
2. Check Windows Event Viewer for errors
3. Use Process Monitor to see file/registry access issues
4. Provide the exact error message and browser version