TPROXY capture mode requires the native addon (Linux + CAP_N

Error message

TPROXY capture mode requires the native addon (Linux + CAP_NET_ADMIN).

What it means

Error "TPROXY capture mode requires the native addon (Linux + CAP_NET_ADMIN)." thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/mitm/tproxy/captureMode.ts:164

  client.pipe(upstream);
  upstream.pipe(client);
}

/**
 * Start TPROXY capture: apply the rules, open the transparent listener, and wire
 * the per-connection forwarder. Returns a handle whose `stop()` closes the
 * listener and reverts the rules (crash-safe teardown). Throws (after reverting)
 * if anything fails to come up.
 */
export async function startTproxyCapture(
  cfg: TproxyConfig,
  options: TproxyCaptureOptions = {}
): Promise<TproxyCaptureHandle> {
  const deps: TproxyDeps = { ...realDeps, ...options.deps };

  // In production the native addon is required; tests inject createListenerFd.
  if (!options.deps?.createListenerFd && !isTransparentSocketAvailable()) {
    throw new Error("TPROXY capture mode requires the native addon (Linux + CAP_NET_ADMIN).");
  }
  const invalid = validateTproxyConfig(cfg);
  if (invalid) throw new Error(invalid);

  await deps.applyTproxy(cfg);

  // Decrypt mode: stand up the TLS-terminating engine (forwarding over the SAME
  // bypass-marked seam, anti-loop) and install its CA so clients trust the leaves.
  // `cleanup` is the symmetric teardown for both the error paths and stop().
  let engine: TlsCaptureServer | undefined;
  let uninstallCa: (() => Promise<void>) | undefined;
  const cleanup = async (): Promise<void> => {
    await engine?.close().catch(() => {});
    await uninstallCa?.().catch(() => {});
    await deps.revertTproxy(cfg).catch(() => {});
  };

  try {

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/mitm/tproxy/captureMode.ts:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/b0c2c1ac1daa5dd7. Report an issue: GitHub.