SOCKS, upstream proxies and reverse proxy

Three tools for networks and clients that do not fit the usual "set the proxy and go".

SOCKS proxy#

Tools ▸ SOCKS Proxy binds a local SOCKS5 port. Point any SOCKS5 client at it, such as curl, an SDK or a tool's SOCKS setting, and its traffic appears in Capture like any other flow. The listener opens when capture starts; a port of 0 turns it off.

curl --socks5-hostname 127.0.0.1:<port> https://example.com

Prefer --socks5-hostname. Plain --socks5 resolves the name on the client, so WireLens sees an address instead of the host you asked for.

Allow LAN access binds the port on every interface instead of only 127.0.0.1. Remote clients still have to pair, as with the HTTP listener, because an open SOCKS port on a network is an open relay.

The SOCKS proxy is free.

Upstream proxy#

Behind a corporate proxy, WireLens needs to reach servers through it too. Tools ▸ Upstream Proxy routes WireLens's own connections to origins through an external proxy:

• HTTP or HTTPS proxy, using CONNECT, with Basic or Digest authentication.
• SOCKS5 proxy.
• PAC file, so the same rules your organisation already publishes decide which proxy each host uses.
• Bypass patterns for hosts that should always go direct.

Your apps keep pointing at WireLens; WireLens chains to the upstream proxy. The upstream proxy is free. The MCP tool is set_upstream_proxy.

Reverse proxy#

Some clients cannot be pointed at a proxy at all. Tools ▸ Reverse Proxy gives them a local port that forwards to one origin:

1. Add a listener: a local port, and the origin it forwards to, such as https://api.example.com.
2. Start capture. Reverse proxy listeners bind when capture starts.
3. Point the client at the local port. Every request is forwarded to the origin and appears in Capture as an ordinary flow.

The client's path and query are kept, and the destination always comes from the listener, never from the request. Set the listen scheme to https to terminate TLS on the listener: it presents a WireLens certificate for the origin's hostname, which is exactly what a client with a hosts-file entry pointing that name at 127.0.0.1 expects.

Preserve Host header decides what the origin sees. Off, WireLens rewrites Host to the origin; on, it forwards the client's value, which a virtual-hosted origin may need.

Map Local, Rewrite, Breakpoints and Scripting all apply to reverse-proxied traffic.

The free plan includes one reverse proxy listener; Pro removes the limit. The MCP tool is add_reverse_proxy.