capture.sh

#!/bin/bash

capture_file=$(mktemp /tmp/capture.XXX)
keylog_file=$(mktemp /tmp/keylog.XXX)

capture_filter="port 443 or port 80 or port 8883"

add_firewall_rules () {
  echo "Setting up firewall rules"
  iptables -t nat -A PREROUTING -i wg0 -p tcp --dport 80 -j REDIRECT --to-port 8080
  iptables -t nat -A PREROUTING -i wg0 -p tcp --dport 443 -j REDIRECT --to-port 8080
  echo "Done"
}

remove_firewall_rules () {
  echo "Removing firewall rules"
  iptables -t nat -D PREROUTING -i wg0 -p tcp --dport 80 -j REDIRECT --to-port 8080
  iptables -t nat -D PREROUTING -i wg0 -p tcp --dport 443 -j REDIRECT --to-port 8080
  echo "Done"
}

add_firewall_rules

post_capture () {
  remove_firewall_rules
}

trap 'kill %1; kill %2; post_capture' SIGINT; \
  tcpdump -i wg0 -w ${capture_file} ${capture_filter} & \
  MITMPROXY_SSLKEYLOGFILE="${keylog_file}" mitmdump -m transparent --showhost --no-http2