This article outlines a streamlined, expert workflow for capturing a HAR file in Chrome to detect WAF blocking patterns, while ensuring accuracy by excluding target domains from VPN inside Timus and routing them through the internet to eliminate VPN IP reputation noise.

Capture a HAR File in Google Chrome

1. Open Chrome

2. Go to the target site

3. Press F12 → DevTools

4. Select Network tab

5. Enable Preserve log

6. Refresh page (F5)

7. Right‑click any request → Save all as HAR with content

8. Save as filename.har

Detect WAF‑Blocked Status Codes (Run PowerShell as Administrator)

Get-Content "filename.har" | ConvertFrom-Json |
Select-Object -ExpandProperty log -ErrorAction SilentlyContinue |
Select-Object -ExpandProperty entries -ErrorAction SilentlyContinue |
Where-Object { $_.response.status -in 403,429,502 } |
ForEach-Object {
    [PSCustomObject]@{
        Status = $_.response.status
        URL    = $_.request.url
    }
} | Sort-Object URL -Unique

WAF Blocking Interpretation

Timus Split‑Tunnel Configuration for Target Domains

1. Go to Timus Manager → Agent Configuration → Agent Profile.

   • Edit the existing default profile or create a new one.

   • In the Source section, select the relevant target users (e.g., Users → All users).

   • Navigate to the Windows and macOS tabs and ensure Enforce Local DNS Responder is enabled as shown in the image below:
     

2. Go to Timus Manager → Agent Configuration → Tunnel Configuration.

   • Add the domains from your PowerShell output, using only the main domain.

   • For example, if the URL is test.reddit.com, add it as *.reddit.com using a wildcard, which covers all the subdomains based on the main domain.

   • Set the routing option to Through Internet | Domain as shown in the image below:
     

   • After completing the configuration, click Save.

Note: After making changes to the Split Tunnel, advise users to reconnect to the Timus VPN to ensure the new settings take effect and to fetch the latest data faster.

Updated December 26, 2025 14:09