One blocked and one allowed request to example.com
Five lifelines: curl inside m101-policy, the forward proxy on gateway.docker.internal:3128, sandboxd with its authorizer, the policy store, and example.com. The first CONNECT is checked by sandboxd, finds no applicable policy, and the proxy answers 403 Forbidden inside the TLS session with a 90-byte approval message, then logs the host as blocked with proxy type forward. An allow rule for example.com is written in the sandbox scope. The second CONNECT is allowed as forward-bypass, the proxy opens a tunnel without inspection, example.com answers HTTP/2 200, and the host is logged as allowed.
curl inside
proxy :3128
sandboxd
policy store
example.com
1
CONNECT example.com:443
HTTPS_PROXY in the environment
2
op(net:connect:tcp, example.com:443)
3
match rules for sandbox:m101-policy
4
no applicable policies
5
No matching allow rule (default deny)
6
HTTP/1.1 403 Forbidden, 90 bytes
inside TLS, under the proxy CA
7
log: blocked example.com:443 forward
8
policy allow network --sandbox m101-policy
rule <uuid> example.com [tcp]
9
CONNECT example.com:443
10
allowed, forward-bypass
11
TLS tunnel, no inspection
HTTP/1.0 200 Connection established
12
HTTP/2 200, server: cloudflare
13
log: allowed example.com:443 forward-bypass