How to forward TCP traffic to LAN server instead of actual destination server

[ipartola]

I am trying to figure out what a particular mobile app on my phone is doing when it's talking to its mothership server via HTTPS. I created a simple HTTP/HTTPS proxy server that I am running on my laptop and I want to use my OPNSense router/firewall to redirect all traffic such that when my phone tries to connect to the given server, it instead goes to my laptop. Specifically:

Phone: 172.20.20.249
Laptop: 172.20.20.160
Server: example.com

I want to set a rule that whenever my phone tries to connect to example.com:443 instead it connects to 172.20.20.160:443. Would I do this with a firewall rule under Rules? A one-to-one NAT? Something else? Thanks in advance!

P.S.: I should mention that it seems the app is connecting by IP address and not using DNS at all which would have been easier to redirect.

[bartjsmit]

You're probably better off with Squid and/or packet capture on the firewall to analyse a phone home connection.

Bart...

[ipartola]

Unfortunately that wouldn’t work. It’s HTTPS, not HTTP so packet capture only tells me what IPs my phone is communicating with, not the contents. This particular app, I suspect, doesn’t verify the TLS certificate as the server presents a default self-signed one. By inserting my own proxy between the app and their server I can hopefully capture what data is actually being exchanged and potentially create my own version of the app that would work better.

For some more context, the app controls a proprietary piece of consumer hardware and is the only way to interface with that hardware. It’s decent hardware but the app leaves something to be desired: for example trying to edit what is essentially a spreadsheet on a phone sucks.

[bartjsmit]

By inserting my own proxy between the app and their server I can hopefully capture what data is actually being exchanged and potentially create my own version of the app that would work better.

Squid is part of OPNsense - Services, Web Proxy, Administration, Enable proxy. Forward Proxy, Enable SSL inspection. You can also insert it as a transparent proxy but mind the HTTP breakage that inflicts.

Bart...