Monday, 22 January 2024

BYOPPP - Build Your Own Privacy Protection Proxy

I have read a blog post, where you can build your own privacy proxy server built on Raspberry PI. The post got me thinking about how I can use this to protect my privacy on my Android phone, and also get rid of those annoying ads. 

Since I own a Samsung Galaxy S3 LTE with Android 4.3 (with a HW based Knox counter), rooting the phone now means you break Knox, and loose warranty. Past the point of no return ...

This means I have to solve this without root. Luckily newer Androids support VPN without rooting, but setting a mandatory system-wide proxy is still not possible without root. 
But thanks to some iptables magic and Privoxy, this is not a problem anymore :) 

The ingredients to build your own privacy protection proxy:
  • One (or more) cheap VPS server(s)
  • a decent VPN program
  • Privoxy
  • iptables

VPS server

To get the cheap VPS server, I recommend using Amazon EC2, but choose whatever you like. The micro instance is very cheap (or even free), and has totally enough resources for this task. I'm using the Ubuntu free tier now and it works like a charm. And last but not least Amazon has two-factor authentication! You can set up an Ubuntu server under 10 minutes. Use the AWS region nearest to you, e.g. I choose EU - Ireland.



VPN

For the VPN program, I recommend the free version of the OpenVPN AS (EDIT: be sure to use OpenVPN AS 2.0.6 or later, both on the server and the client). Easy to set-up quick start guide is here, GUI based configuration, and one-click client installer for Android, iOS, Windows, Linux, OSX. The Ubuntu installer packages are here.




The most important settings:

  • I prefer to use the TCP 443 and UDP 53 ports for my OpenVPN setup, and let the user guess why. 
  • For good performance, UDP is preferred over TCP. 
  • VPN mode is Layer 3 (routing/NAT).
  • Don't forget to allow the configured VPN ports in the AWS firewall (security groups). 


Other VPN settings:
  • Should VPN clients have access to private subnets (non-public networks on the server side)? - Yes
  • Should client Internet traffic be routed through the VPN? - Yes

Privoxy

The next component we have to install and configure is Privoxy. As usual, "apt-get install privoxy" just works. The next step is to configure privoxy via /etc/privoxy/config file, there are two options to change:
  • listen-address your.ip.add.ress:8118
  • accept-intercepted-requests 1
Beware not to allow everyone accessing your Privoxy server in the AWS EC2 security groups, be sure it is reachable only to VPN users!

After everything is set, start privoxy with "service privoxy start", and add it to the autostart "update-rc.d privoxy defaults".

Iptables

And the final step is to configure your iptables chain to forward every web traffic from the VPN clients to the Privoxy server:

iptables -t nat -A PREROUTING -s 5.5.0.0/16 -p tcp -m multiport --dports 80,8080,81 -j DNAT --to-destination your.ip.add.ress:8118 

Optionally you can block access to all other ports as well, and what does not go through your Privoxy won't be reachable.
Based on your Linux distribution and preference, you might make this rule persistent.

Final test

Now you can connect to the VPN server from your Android device.
After logging in from a client, you get the following nice packages to install on your device:


After connecting, the final results can be seen in the following screenshots. And yes, there is a reason I chose Angry Birds as an example.

Angry Birds without Privoxy
Angry Birds with Privoxy
Stupid flashlight app with ad
Stupid flashlight app with Privoxy
Spoiler alert
If you are afraid of NSA tracking you, this post is not for you. If you want to achieve IP layer anonymity, this post is not for you. As long as you are the only one using that service, it should be trivial to see what could possibly go wrong with that.

Known issues
Whenever the Internet connection (Wifi, 3G) drops, the VPN connection drops as well, and your privacy is gone ...
Sites breaking your privacy through SSL can still do that as long as the domain is not in the Privoxy blacklist.

Additional recommendation
If you are using OSX or Windows, I can recommend Aviator to be used as your default browser. It is just great, give it a try!

PS: There are also some adblock apps removed from the official store which can block some ads, but you have to configure a proxy for every WiFi connection you use, and it is not working over 3G.



Related news


  1. Pentest Tools Online
  2. Hacking Tools Windows
  3. Underground Hacker Sites
  4. Hacking Tools Software
  5. Black Hat Hacker Tools
  6. Pentest Tools Free
  7. Hacker Tools Github
  8. Hack Tools For Windows
  9. Hack Tools For Windows
  10. Hackrf Tools
  11. Hacker Tools List
  12. Hacker Tools List
  13. Hacking Tools Free Download
  14. Hack App
  15. Physical Pentest Tools
  16. Pentest Tools Website
  17. Kik Hack Tools
  18. Computer Hacker
  19. Hack Tools
  20. Hacker Tools 2020
  21. Ethical Hacker Tools
  22. Hacks And Tools
  23. Hacking App
  24. Hack Tools For Ubuntu
  25. How To Install Pentest Tools In Ubuntu
  26. Hacking Tools For Beginners
  27. Pentest Reporting Tools
  28. Hack Tools Online
  29. Beginner Hacker Tools
  30. Hacker Tools Apk
  31. Pentest Tools Download
  32. Pentest Tools For Ubuntu
  33. Usb Pentest Tools
  34. Usb Pentest Tools
  35. Pentest Tools Nmap
  36. Hack Tools 2019
  37. Hacker Tools For Pc
  38. Nsa Hacker Tools
  39. Free Pentest Tools For Windows
  40. Hack Rom Tools
  41. Hacker Search Tools
  42. Hacker Tools 2019
  43. Wifi Hacker Tools For Windows
  44. Hack Tools Github
  45. Hacker Search Tools
  46. Hacking Tools For Games
  47. Hacker Tools 2019
  48. Hacker Tools For Windows
  49. Hack App
  50. How To Install Pentest Tools In Ubuntu
  51. Physical Pentest Tools
  52. Hacker Techniques Tools And Incident Handling
  53. Pentest Tools Linux
  54. Hack Website Online Tool
  55. Pentest Tools List
  56. Blackhat Hacker Tools
  57. Hacker Tools For Ios
  58. Kik Hack Tools
  59. Hacking Tools Free Download
  60. Pentest Tools Framework
  61. Hacking Tools Github
  62. Hacker Search Tools
  63. Hack Apps
  64. Hack Apps
  65. Pentest Tools Port Scanner
  66. Hackers Toolbox
  67. Hack Tools For Ubuntu
  68. Pentest Tools Subdomain
  69. Blackhat Hacker Tools
  70. Pentest Reporting Tools
  71. Hacker Techniques Tools And Incident Handling
  72. Hacking Tools For Kali Linux
  73. Pentest Tools For Android
  74. Hacking Tools Kit
  75. Pentest Tools Port Scanner
  76. Hacker Search Tools
  77. Hacking Tools For Windows Free Download
  78. Hacker Security Tools
  79. New Hack Tools
  80. Hack Tools For Ubuntu
  81. Hacker Tools 2020
  82. Hacks And Tools
  83. Top Pentest Tools
  84. Hack Tools For Pc
  85. Hack Tools For Ubuntu
  86. Pentest Tools For Windows
  87. Pentest Tools Linux
  88. Pentest Tools Website
  89. Pentest Tools For Mac
  90. Hack Tools For Pc
  91. Game Hacking
  92. Hacker Tools Mac
  93. Hack Tools 2019
  94. Hacker Tools 2019
  95. Pentest Tools Kali Linux
  96. Hacking Tools Mac
  97. Pentest Reporting Tools
  98. What Are Hacking Tools
  99. Hacker Tools Github
  100. Growth Hacker Tools
  101. Hacking Tools Windows
  102. Pentest Reporting Tools
  103. Hack Tools Pc
  104. Nsa Hack Tools Download
  105. Pentest Tools Nmap
  106. Hacking Tools

0 comments:

Post a Comment