System traffic interception

How to steer a program's or the whole machine's traffic into a port without configuring a proxy in the application: the privileged service, installing it, managing it from the tray and the API fields.

What interception is

An ordinary BlankTrail Proxy port is a proxy: the application has to know its address and be able to use it. Interception solves the opposite problem — the operating system itself steers traffic into the port, with nothing configured in the application. That is how programs with no proxy settings at all are covered.

This needs a privileged Windows service: the product itself runs without administrator rights and cannot change the machine's routing. The service is called BlankTrailNetHelper, is installed separately and is managed from the tray menu.

WarningThe default interception scope is the WHOLE SYSTEM, not selected programs. A port opened with intercept and no explicit intercept_scope takes over all machine traffic, including remote desktop and management tools. If you want individual programs, set scope "process" explicitly.

What the service does to the machine

While no port asks for interception the service changes nothing: it is registered and waiting. The changes appear only when a port with interception is open, and are removed when it closes.

Brings up a virtual network adapter (the Wintun driver) and assigns it an address.
Adds two routes — 0.0.0.0/1 and 128.0.0.0/1. Together they override the default route WITHOUT deleting it: the existing route stays in place and takes over again as soon as interception is removed.
Announces its own DNS resolver on that adapter. Without it your provider would still see the names, even while the traffic itself leaves through the proxy exit.

WarningThe capture covers IPv4 only. If the machine has a live global IPv6 address — usually handed out by your provider or home router — the service refuses the capture ENTIRELY, in the system scope and in the process scope alike, and refuses before it touches the network at all. What you see: the port opens but there is no interception; on the port card intercept_state becomes degraded and intercept_reason names the cause outright. The fix is to disable IPv6 on the machine's network adapter, not to reinstall the service, switch accounts or reinstall the product. The leak audit refuses to start for the same reason, with the code ipv6_present.

NoteThe service serves one copy of the product at a time. With two copies of BlankTrail Proxy running, the second gets a refusal with code busy — this is not a clash with a third-party VPN or antivirus, it is your own second copy. Close it.

Interception can be controlled only from the Windows account the product was installed under: the service control channel is open to that owner, to administrators and to SYSTEM. On a machine with several accounts a second user will see "service not responding" even though the service is running.

When the service is installed

During installation the task page offers "System traffic interception". It registers the service.
The task is visible ONLY in an install "for all users". In a per-user install it is absent entirely — deliberately, not by oversight: a product installed into your own profile lives where you can write, and a SYSTEM autostart service pointed there would be a ready privilege-escalation path.
Registration requires an administrator confirmation. Declining does not fail setup; interception simply stays unavailable — the service can be installed later from the tray menu.

NoteOn upgrade the service re-registers itself if it was installed before — otherwise interception would silently break after every update. It is removed when the product is uninstalled.

On an upgrade the service re-registers if it was installed before — even if the checkbox was not touched.
When the product is uninstalled, removing the service asks for administrator rights in a SEPARATE window. Declining it uninstalls the product and leaves the service in the system — it can be removed later by installing the product again and uninstalling with the confirmation given.

🔴 In an administrative install this item is TICKED in advance: an administrator who simply presses “Next” registers the service. To skip it the box must be unticked by hand — setup does not break because of that, interception simply stays unavailable until the service is installed from the tray menu.

Managing it from the tray

The tray icon menu has a "TUN helper" group. Its title shows the state of the service, and its items show what makes sense in that state. The state is re-read every three seconds, so the menu notices a service that died or came up outside it.

State	What it means	What is offered
not installed	The service is not registered.	Install
stopped	The service is registered but not running.	Start
running	The service is ready to accept interception rules.	Stop, Restart
paused	The service was paused by the manager.	Stop, Restart
starting / stopping	A transitional state: the request was accepted and the manager is carrying it out.	Nothing — wait for it to finish.
state unknown	The service manager did not answer. Usually this means the query failed, not that the service is missing.	Nothing.

WarningEach of the four actions elevates: Windows shows an administrator prompt. Closing it does nothing and reports no error — the menu stays as it was and the service does not start. That is expected: declining elevation is not treated as a failure.

Who may drive interception

The service's control channel is open to SYSTEM, to the machine's administrators, and to THE account the service was installed from. The owner is recorded when the service is registered.

WarningHence a non-obvious consequence on a machine with several accounts and on a terminal server: a second user starts the same product and sees “the service does not answer” (code unreachable), although the service is running and obeys the first user. The cure is to install the service again from the needed account — the “Install” item in the “TUN helper” tray group.

The two interception scopes

Scope	What reaches the port	Limits
`system`	All machine traffic. This is the default.	Only ONE port may hold this scope: a second one is refused with "system interception is already taken by another port".
`process`	Only traffic of the listed programs (intercept_apps — paths to executables).	One program can be intercepted by one port only. There is no exit watchdog in this mode: if the exit disappears, one application suffers rather than the whole machine.

NoteAn application that pins the certificates of the sites it talks to will stop working on a per-process port: such a port terminates TLS at itself and re-originates the connection. That is a consequence of the design, not a defect.

A port with interception

Such a port does NOT listen as a proxy: nothing can connect to its number from outside, and the tunnel is its only entrance. An application you point at that proxy address by hand will get a connection refusal; conversely, a proxy setting left in place will route the application past interception.

Interception cannot be turned on, off or reconfigured on an already open port — the attempt answers 400. Close the port and open it again with the fields you need.

Port state	What it means
`active`	The rule was accepted by the service and traffic is flowing to the port.
`degraded`	The port is open, but the interception rule did not take effect: interception is not actually happening. The most common cause is a live global IPv6 on the machine: the capture covers IPv4 only and then refuses entirely. After that, a service that is unreachable or busy. The exact cause is named by the intercept_reason field.
`released`	The rule was released — for example, the port is closing.

NoteIf the exit stays unavailable for ten minutes the watchdog releases interception itself and gives traffic back to the machine: without it a lost exit would mean a machine with no network. On an idle machine the probe is sparse, so in practice the release takes up to fifteen minutes. There is no watchdog in per-process mode.

Interception over the API

Ask GET /api/v1/system/intercept whether interception is available, and GET /api/v1/system/processes for the list of programs for the process scope; both cards, with all fields and examples, live in the API reference.

API reference — ports and trafficThe cards of both system endpoints and every port-opening field.

The code field is meant for a program and does not change; reason is meant for a human and may change. The values of code are:

code	What happened	What to do
`off`	This build or platform does not support interception.	Interception is available on Windows.
`not_installed`	The service manager answered that the service does not exist.	Install it from the "TUN helper" tray group, or reinstall the product for all users.
`unreachable`	The service does not answer on the control channel.	Check that it is running and that you are working under the account the product was installed from.
`busy`	The service is alive but another copy of the product already owns the control channel.	Close the second copy of BlankTrail Proxy.

Interception itself is switched on WHEN THE PORT IS OPENED, by three fields in the body of POST /api/v1/ports/open:

Parameter	Type	Required	Description
`intercept`	`bool`	No	Turn interception on for this port. Off by default.
`intercept_scope`	`string`	No	"system" — all machine traffic, "process" — only the listed programs. An empty value means "system".
`intercept_apps`	`string[]`	No	Paths to executables for the "process" scope.

Example (curl)

curl -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"port":8080,"intercept":true,"intercept_scope":"process",
        "intercept_apps":["C:/Program Files/MyApp/app.exe"]}' \
  http://127.0.0.1:8891/api/v1/ports/open

The port card (GET /api/v1/ports) returns the same fields plus intercept_state and intercept_reason — the state of the rule and the reason if it did not come up.