Android Proxy Settings with iptables

Introduction

During an Android security assessment, I encountered an application that was ignoring traditional interception methods such as:

System proxy , Wi-Fi proxy configuration , VPN-based interception

The application was using direct sockets and native/custom networking, so the traffic never reached Burp Suite.

Using iptables

To force the traffic through Burp Suite, I used iptables at the kernel networking layer:

iptables -t nat -A OUTPUT \ 
-p tcp \ --dport 443 \ 
-j DNAT \ 
--to-destination <BURP_IP>:8080

This redirects outgoing TCP traffic targeting port 443 to the Burp Suite listener.

Important Note

This technique handles traffic redirection, not TLS validation.

This is technique only supported rooted device

If the application uses certificate pinning, you may still need to handle pinning separately before HTTPS traffic can be inspected.

Also keep in mind that this rule targets TCP/443. Applications using QUIC/HTTP3 or other protocols may require a different approach.

Quick Reference

Useful when an Android application bypasses the normal proxy configuration and communicates directly with its backend.