Fix macOS PF rules to route traffic to HTTP proxy with TLS termination

- Change PF rules to redirect all TCP traffic to port 8080 (HTTP proxy with TLS termination)
- Previously was incorrectly routing to port 8443 (HTTPS proxy)
- HTTP proxy with TLS termination can handle both HTTP and HTTPS traffic
- Fixes 'client sent HTTP request to HTTPS server' error on macOS
- Update comments and logging to reflect correct proxy usage

Co-authored-by: f0ssel <[email protected]>

Author: blink-so[bot]

namespace/macos.go

@@ -222,28 +222,28 @@ func (m *MacOSNetJail) createPFRules() (string, error) {
 # COMPREHENSIVE APPROACH: Intercept ALL TCP traffic from the jailed group
 # This ensures NO TCP traffic can bypass the proxy by using alternative ports
 
-# First, redirect ALL TCP traffic arriving on lo0 to our HTTPS proxy port
-# The HTTPS proxy can handle both HTTP and HTTPS traffic
+# First, redirect ALL TCP traffic arriving on lo0 to our HTTP proxy with TLS termination
+# The HTTP proxy with TLS termination can handle both HTTP and HTTPS traffic
 rdr pass on lo0 inet proto tcp from any to any -> 127.0.0.1 port %d
 
 # Route ALL TCP traffic from boundary group to lo0 where it will be redirected
 pass out route-to (lo0 127.0.0.1) inet proto tcp from any to any group %d keep state
 
 # Also handle ALL TCP traffic on the specific interface from the group
-pass out on %s route-to (lo0 127.0.0.1) inet proto tcp from any to any group %d keep state
+pass out route-to (lo0 127.0.0.1) on %s inet proto tcp from any to any group %d keep state
 
 # Allow all loopback traffic
 pass on lo0 all
 `,
 		m.restrictedGid,
 		iface,
-		m.httpsProxyPort, // Use HTTPS proxy port for all TCP traffic
+		m.httpProxyPort, // Use HTTP proxy with TLS termination for all TCP traffic
 		m.restrictedGid,
 		iface,
 		m.restrictedGid,
 	)
 
-	m.logger.Debug("Comprehensive TCP jailing enabled for macOS", "group_id", m.restrictedGid, "proxy_port", m.httpsProxyPort)
+	m.logger.Debug("Comprehensive TCP jailing enabled for macOS", "group_id", m.restrictedGid, "proxy_port", m.httpProxyPort)
 	return rules, nil
 }