What is this?
SSLInspectingRouter is a Go program that runs on a Linux box. You run it as root, point it at a network interface, and it pulls HTTP and HTTPS traffic aside at the iptables layer so you can look at it.
It can MITM TLS using on-the-fly certs generated from a local CA, or it can run in SNI-only mode and just log the ClientHello bits (TLS version, ciphers, ALPN, extensions) without decrypting the body. Everything stored in SQLite. Rewrites are defined in JSON. There is a web dashboard with auth for ease of use.
A 30-second tour
| Mode | What happens |
|---|---|
| Full inspection | MITM HTTPS, log every request and response, apply rewrites. The default. |
| Bypass | Tunnel specific hosts untouched. Log a BYPASSED marker so you can prove the bypass fired. |
| Drop | Close the connection on a match. Loud and fast. |
| Inspection paused | Tunnel everything until you toggle inspection back on in the dashboard. |
| SNI-only | Forward HTTPS unchanged. Log SNI and ClientHello metadata only. No decryption. |
| Allowlist (inspect-only) | Only inspect traffic from the listed source IPs. |
| Dual-NIC gateway | Pin LAN ingress and WAN egress. Interception only fires for the LAN side. |
| Firewall mode | Per-host rules at the proxy layer, plus an iptables-enforced outbound port allowlist. |
Install it
Tested on Ubuntu. Root is required for iptables, forwarding, and interception.
# 1. clone & build (no host changes yet) git clone https://github.com/dmitryporotnikov/SSLInspectingRouter.git cd SSLInspectingRouter go build -o sslinspectingrouter ./cmd/router # 2. run it. open http://<router-ip>:3000 # default login is admin / admin123 -- CHANGE THIS sudo ./sslinspectingrouter -web :3000
For first-time setup with full dependency checks, run sudo ./scripts/setup.sh.
Need a passive deployment without MITM? Pass -snionly.
Features at a glance
- iptables NAT for transparent interception (no client config)
- TLS MITM with per-host certs from a local CA
- SQLite logging with full request and response capture
- JSON rewrite rules for response tampering
- Web dashboard with auth and runtime controls
- WireGuard or Tor egress (runtime toggleable, mutually exclusive)
- PCAP export of decrypted traffic for Wireshark
- Drop, bypass, and source-IP allowlists
Sign the guestbook
Say hi. Report a bug. Ask how it handles a weird edge case. The guestbook lives on GitHub Discussions.