Reqable Forwarder

中文版

Transparent TLS proxy forwarder for Android mobile traffic capture. Bypasses VPN and proxy detection in most apps.

Routes app HTTPS traffic (via iptables DNAT) through a local transparent proxy, which extracts TLS SNI and forwards to Reqable via HTTP CONNECT. Reqable handles all TLS decryption using its system-trusted CA certificate.

Unlike VPN-based tools, this operates at the kernel layer (iptables NAT) — the app sees no VPN interface, no proxy settings (http.proxyHost is null), and no process injection — making it invisible to common VPN detection, proxy detection, and anti-capture mechanisms.

Architecture

Phone App → iptables DNAT → Forwarder (:8088) → CONNECT tunnel → Reqable (:9000) → Real Server
                                              ↑ SNI extraction         ↑ TLS MITM (Reqable CA)
                                              ↑ Skip list bypass       ↑ Decrypt & display

Prerequisites

• PC: Python 3.12+, Dear PyGui (pip install dearpygui), Reqable desktop app
• Phone: Rooted Android, ADB connected
• Certificate: Reqable CA installed as system trust (via Magisk/KernelSU or manual push to /system/etc/security/cacerts/ and /apex/com.android.conscrypt/cacerts/)

Quick Start

# 1. Open Reqable on PC (proxy mode, port 9000)

# 2. Start forwarder
cd proxy
pip install dearpygui
python reqable_fwd.py

# 3. Select ADB device, click START

# 4. Launch target app on phone

Configuration

fwd_config.json (auto-created on first run):

Field	Description	Default
listen.host	Proxy listen address	10.225.250.24
listen.port	Proxy listen port	8088
reqable.host	Reqable address	10.225.250.24
reqable.port	Reqable proxy port	9000
adb	ADB executable path	adb
device	ADB device serial (auto-detected)	""
target_app	Android package to capture	com.moutai.mall
skip_snis	Domains to bypass (no MITM)	[]

UI Overview

• Left Panel: ADB device selection, Reqable address, Skip domain management
• Center Panel: iptables NAT rules (live refresh)
• Right Panel: START/STOP controls, connection status
• Bottom: Traffic log (connection events, ADB operations)

Domains in the Skip list are forwarded directly to the real server without MITM. Useful for security SDK domains that detect TLS interception.

How It Works

1. iptables DNAT: Redirects all TCP/443 from target app UID to listen.host:listen.port
2. SNI Extraction: Reads TLS ClientHello to get the target hostname
3. Skip Check: Bypasses MITM for domains in skip_snis (raw TCP passthrough)
4. CONNECT Tunnel: Sends CONNECT host:443 to Reqable's HTTP proxy
5. Reable MITM: Reqable establishes TLS with real server using its own CA, decrypts traffic
6. Traffic Display: All decrypted HTTP shown in Reqable's UI

ADB Commands Used

stat -c %u /data/data/<package>    # Get app UID
iptables -t nat -F OUTPUT          # Clear rules
iptables -t nat -A OUTPUT ... DNAT  # Add redirect rule
iptables -t nat -L OUTPUT -n       # List rules