Other devices and access control

Any device that can reach your Mac over the network can send its traffic through Cloak Proxy: a phone, a tablet, another Mac, a Windows or Linux computer, or a smart TV. This page covers the three pieces they share: letting other devices connect, limiting which ones may, and the certificate page they download the Cloak Proxy certificate from.

Let other devices connect

By default Cloak Proxy listens only on 127.0.0.1, so only programs on this Mac can use it. To accept other devices, it has to listen on all network interfaces.

1. Open Settings (⌘ ,) and choose General.

2. Under Listening, turn on Allow other devices to connect (phones, other computers).

   An orange note appears: Anyone on your network can use this proxy while it’s on. Turn it off when you’re done with device debugging. Below it, This Mac’s address shows the address and port to enter on other devices, for example 192.168.1.20:9090.

3. Click Apply & Restart Proxy.

123

The Listening section of Settings › General.

1. The port Cloak Proxy listens on
2. Lets phones and other computers connect
3. Applies the change and restarts the proxy

×

You can also click Allow Other Devices to Connect on the iPhone & iPad tab of Device & Runtime Setup. It turns the setting on and restarts the proxy in one step. In Search Everything (⇧ ⌘ A), type “Allow Other Devices to Connect” to jump to the setting.

Listening settings

Setting	What it does
Port	The port Cloak Proxy listens on. Default 9090. Enter a number from 1 to 65535; other values are ignored when you apply.
Allow other devices to connect (phones, other computers)	Off: listens on 127.0.0.1, this Mac only. On: listens on 0.0.0.0, every network interface.
This Mac’s address	Shown while the toggle is on. Your Mac’s local IP address and the port, selectable for copying.
Apply & Restart Proxy	Saves the port and the toggle, then restarts the proxy. Dimmed until you change something.

Restarting the proxy closes open connections. If the macOS proxy was on, Cloak Proxy turns it off and back on so it points at the new port. While other devices are allowed, the status pill in the toolbar shows 0.0.0.0:9090 in place of 127.0.0.1:9090.

Turning this on also opens the SOCKS5 proxy and reverse proxies in Settings › Network to the network, if you use them, because they listen on the same interfaces as the main proxy.

This exposes the proxy to your network

While other devices may connect, anyone on the same network who knows your Mac’s address can send traffic through Cloak Proxy, and it goes out from your Mac. On shared or public Wi-Fi, restrict it with Allowed devices, and turn the setting off as soon as you finish debugging.

Allow only specific devices

Allowed devices is an IP allow list. When other devices may connect, Cloak Proxy accepts a connection from another device only if its address matches an enabled entry. This Mac is always allowed.

1. Open Settings and choose Network.

2. Under Allowed devices, click Add Address.

   A new entry appears, filled in with your Mac’s subnet, for example 192.168.1.* when the Mac’s address is 192.168.1.20.

3. Edit the entry to match the device you want to allow, for example 192.168.1.42 for one phone. Add more entries for more devices.

4. Click Apply & Restart Proxy.

1234

Allowed devices in Settings › Network. The list is empty, so any device may connect.

1. Adds an entry, filled in with your Mac's subnet
2. An empty list accepts any device on your network
3. Discards changes you haven't applied
4. Saves the list and restarts the proxy

×

Allowed devices options

Control	What it does
Switch on an entry	Turns that entry on or off without deleting it.
Address field	The address to accept. Placeholder 192.168.1.*.
− button	Deletes the entry.
Add Address	Adds an entry for your Mac’s subnet, or 192.168.1.* if Cloak Proxy can’t find your Mac’s address.
Revert	Discards changes on the Network page that you haven’t applied.
Apply & Restart Proxy	Saves the Network page and restarts the proxy. Dimmed until you change something.

You can also jump to the list from Search Everything by typing “Allowed Devices”.

Address patterns

Pattern	Matches
192.168.1.42	Exactly that address.
192.168.1.*	Any address that starts with 192.168.1.
10.0.0.1?	10.0.0.10 to 10.0.0.19 (? matches one character).

Patterns use * and ? wildcards. CIDR ranges such as 192.168.1.0/24 aren’t supported.

An empty list allows everyone

If the list is empty, or every entry is switched off, Cloak Proxy accepts any device on your network. Keep at least one enabled entry while you want to restrict access.

When a device’s address doesn’t match, Cloak Proxy closes the connection at once and writes this line to its log at ~/Library/Logs/CloakProxy/cloak-proxy.log:

Refused a connection from 192.168.1.77: not in the allowed client list

Check the log to find the address a device actually connects from. Device addresses can change when they reconnect, so prefer a router reservation or a subnet pattern for devices you debug often.

Get the certificate from http://cloak.proxy

Cloak Proxy serves a small certificate page to any device that uses it as a proxy. Devices that should have their HTTPS decrypted download the root certificate there and install it.

Through the proxy

After the device’s proxy points at Cloak Proxy, open any of these in its browser:

• http://cloak.proxy
• http://cert.cloak
• http://cloakproxy.local

Cloak Proxy answers these names itself; they don’t exist on the internet. Use http://cloak.proxy first. Many systems send .local names straight to the local network instead of through a proxy (the Mac’s default Bypass list includes *.local), so http://cloakproxy.local may not reach Cloak Proxy.

Straight from your Mac's address

Open your Mac’s address and port, for example http://192.168.1.20:9090/. This works before you set the device’s proxy, as long as other devices may connect.

The QR code on the iPhone & iPad tab of Device & Runtime Setup opens exactly this address. Any phone camera that reads QR codes can use it.

The page is titled Cloak Proxy. It reminds you to install the certificate only on devices you own and are debugging, and to remove it when you’re done. It has two download buttons:

Button	Format	Saved as	Use it for
Download certificate (PEM, iOS / macOS)	PEM (text)	cloak-proxy-ca.pem	iPhone, iPad, Macs
Download certificate (DER, Android / Windows)	DER (binary)	cloak-proxy-ca.crt	Android, Windows

You can also link straight to a file:

Path	Returns
/cert.pem	The certificate in PEM format.
/ssl	The certificate in PEM format, saved as cloak-proxy-ca.crt.
/cert.crt, /cert.cer	The certificate in DER format.
Any other path	The certificate page.

For example, curl -o cloak-proxy-ca.pem http://192.168.1.20:9090/cert.pem downloads it on another computer.

The page only hands out the certificate, never its private key. The control API at /api/ on the same port refuses other devices with The API is only available on this Mac, even while they may use the proxy.

Set up another computer

1. On the Mac running Cloak Proxy, turn on Allow other devices to connect and add the computer to Allowed devices.

2. On the other computer, set the HTTP and HTTPS proxy to your Mac’s address and port, for example 192.168.1.20 and 9090. Use its system network settings, or the browser’s or program’s own proxy setting.

3. Open http://cloak.proxy and download the certificate: PEM for a Mac, DER for Windows.

4. Install it as a trusted root certificate. On a Mac, open the file, add it to the keychain, and set it to Always Trust. On Windows, open the file, choose Install Certificate, and place it in Trusted Root Certification Authorities.

Its traffic appears in the sidebar under the computer’s IP address, with a phone icon like any other remote device.

Security checklist

Decrypt only traffic you're allowed to see

A device that trusts your certificate sends you readable copies of its HTTPS traffic for the hosts in SSL Proxying. Install the certificate only on your own devices, or on devices whose owner has given you permission. Testing someone else’s service needs their written permission.

• Keep Allow other devices to connect off unless you’re debugging a device right now.
• Use Allowed devices whenever you’re on a network you don’t control.
• Never share cloak-proxy-ca-key.pem from ~/Library/Application Support/CloakProxy/. It’s the certificate’s private key; anyone with it can decrypt traffic from every device that trusts your certificate.
• Remove the proxy and the certificate from devices when you’re done. A device whose proxy points at your Mac loses its connection when Cloak Proxy isn’t running.
• If a device with your certificate is lost, or the key may have leaked, click Regenerate Certificate… in Settings › Certificate. Devices and simulators that trust the current certificate then need the new one installed.

See Security and privacy for the full picture.

Turn it off

1. Remove the proxy setting from every device you set up.

2. In Settings › General, turn off Allow other devices to connect (phones, other computers) and click Apply & Restart Proxy. Cloak Proxy goes back to listening on 127.0.0.1 only.

3. Optionally, clear Allowed devices in Settings › Network, or switch its entries off, and click Apply & Restart Proxy.

Related

iPhone and iPadWi-Fi proxy and certificate profile, step by step.

Network settingsPort, external proxy, SOCKS5, reverse proxies and more.

CertificateInstall, remove, regenerate or replace the root certificate.

Security and privacyWhat stays on your Mac and how to remove everything.