SOCKS, upstream proxies and reverse proxy

Three Mac tools for networks and clients that do not fit the usual "set the proxy and go". All three are in the Setup part of the Tools window (⇧⌘T). WireLens for iPhone and Android connects to servers directly.

SOCKS proxy#

Tools ▸ SOCKS Proxy opens a local SOCKS5 port. Point any SOCKS5 client at it, such as curl, an SDK or a tool's SOCKS setting, and its traffic appears in the capture like any other flow.

• Listen port takes 1–65535. Use 1080 fills in the conventional SOCKS port, and 0 or Turn Off closes the listener.
• The port opens when capture starts. Status says whether it is listening.

curl --socks5-hostname 127.0.0.1:1080 https://example.com

Prefer --socks5-hostname. Plain --socks5 looks the name up on the client, and WireLens then sees an address instead of the host you asked for.

Allow LAN access opens the port to your network instead of to this Mac only. It also needs Accept devices on this network in Settings ▸ Remote Devices, and devices still need your approval first, as they do for the main listener. An open SOCKS port on a network would let anyone use it.

The SOCKS proxy needs WireLens Pro.

Upstream proxy#

Behind a company proxy, WireLens has to reach servers through it too. Tools ▸ Upstream Proxy sends WireLens's own connections through an external proxy. Turn on Route upstream through a proxy, then choose the Kind:

• HTTP or HTTPS, with the proxy's host and port, and a Username and Password if it needs them.
• SOCKS5.
• PAC, with a PAC URL, for the rules your organisation already publishes. Evaluate Now fetches the script and shows how many hosts go through the proxy and how many go direct. If the script cannot be fetched or evaluated, every host goes direct.

Bypass lists hosts that always go direct. Loopback addresses always go direct.

Your apps keep pointing at WireLens, and WireLens points at the company proxy. The password is kept in your Keychain, not in WireLens's settings file. The External Proxy item in the menu bar status menu turns the upstream proxy on and off.

Connections sent through an upstream proxy keep WireLens's own TLS fingerprint, because the proxy makes its own connection to the server.

The upstream proxy needs WireLens Pro.

Reverse proxy#

Some clients cannot be pointed at a proxy at all. Tools ▸ Reverse Proxy gives them a local port that forwards to one server:

1. Add Listener. Set Listen on to a scheme and local port, and Forward to to the server, such as https://api.example.com.
2. Start capture. Listeners open when capture starts.
3. Point the client at the local port. Every request goes to the server and appears in the capture as an ordinary flow.

The client's path and query are kept, and the destination always comes from the listener. Set the listen scheme to https to have the listener handle the encryption: it presents a WireLens certificate for the server's hostname, which is what a client with a hosts-file entry pointing that name at 127.0.0.1 expects.

Each listener has two switches:

• Preserve Host decides what the server sees. Off, WireLens sets the Host header to the server's name. On, it forwards the client's value, which a virtual-hosted server may need.
• LAN access opens the port to your network instead of to this Mac only. It also needs Accept devices on this network in Settings ▸ Remote Devices, and every remote client still needs your approval.

Map Local, and Breakpoints and Scripts on the request, apply to this traffic.

The free plan includes one reverse proxy listener. Pro removes the limit.

From the command line and MCP#

wirelens ships inside the app and is not on your PATH until you link it once.

wirelens proxy upstream set --kind http --host proxy.example.com --port 8080
wirelens proxy upstream status
wirelens proxy upstream off
wirelens rules reverse-proxy --listen-port 9091 --target-host api.example.com --target-scheme https

The MCP tools are set_upstream_proxy and add_reverse_proxy.