proxy_mobile_setup
Set up mobile capture by launching explicit and transparent proxy listeners, injecting the CA on Android, and generating an iptables script to route AP traffic.
Instructions
One-command mobile capture: start explicit + transparent listeners, optionally inject the CA on an Android device, and emit a sudo-runnable script that wires iptables/sysctl/nmcli on the AP iface. Designed to pair with the proxy-ap-card firmware (ESP32-S3 rogue AP over USB-NCM).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ap_iface | No | AP/USB interface name. Auto-detected via cdc_ncm driver if omitted. | |
| ap_subnet | No | Subnet the AP serves to clients (default: 192.168.4.0/24, matches proxy-ap-card firmware). | 192.168.4.0/24 |
| ap_address | No | Laptop-side address on the AP iface (default: 192.168.99.2/24, matches proxy-ap-card firmware). | 192.168.99.2/24 |
| block_quic | No | Drop UDP/443 on the AP iface so apps fall back to TCP/TLS (capturable). Default: true. | |
| inject_cert | No | Inject the CA into the Android device's system store. Ignored if android_serial is omitted. | |
| egress_iface | No | Host's internet-facing iface. Auto-detected from /proc/net/route if omitted. | |
| explicit_port | No | Port for the explicit HTTP proxy (default: 8080). | |
| android_serial | No | ADB serial of an Android device to inject the CA on. If omitted, no cert injection is attempted. | |
| transparent_port | No | Port for the transparent HTTPS listener (default: 8443). | |
| upstream_proxy_url | No | Optional upstream proxy URL (socks5://user:pass@host:port or http://...). Sets the global upstream for BOTH listeners. If it has a username but no password, the password is filled in from PROXY_MCP_UPSTREAM_PASSWORD, but only when PROXY_MCP_UPSTREAM_HOST is also set and matches this URL's hostname. The response reports password_source: env | url | none. |