Saturday, May 27, 2023

BYOPPP - Build Your Own Privacy Protection Proxy

I have read a blog post, where you can build your own privacy proxy server built on Raspberry PI. The post got me thinking about how I can use this to protect my privacy on my Android phone, and also get rid of those annoying ads. 

Since I own a Samsung Galaxy S3 LTE with Android 4.3 (with a HW based Knox counter), rooting the phone now means you break Knox, and loose warranty. Past the point of no return ...

This means I have to solve this without root. Luckily newer Androids support VPN without rooting, but setting a mandatory system-wide proxy is still not possible without root. 
But thanks to some iptables magic and Privoxy, this is not a problem anymore :) 

The ingredients to build your own privacy protection proxy:
  • One (or more) cheap VPS server(s)
  • a decent VPN program
  • Privoxy
  • iptables

VPS server

To get the cheap VPS server, I recommend using Amazon EC2, but choose whatever you like. The micro instance is very cheap (or even free), and has totally enough resources for this task. I'm using the Ubuntu free tier now and it works like a charm. And last but not least Amazon has two-factor authentication! You can set up an Ubuntu server under 10 minutes. Use the AWS region nearest to you, e.g. I choose EU - Ireland.



VPN

For the VPN program, I recommend the free version of the OpenVPN AS (EDIT: be sure to use OpenVPN AS 2.0.6 or later, both on the server and the client). Easy to set-up quick start guide is here, GUI based configuration, and one-click client installer for Android, iOS, Windows, Linux, OSX. The Ubuntu installer packages are here.




The most important settings:

  • I prefer to use the TCP 443 and UDP 53 ports for my OpenVPN setup, and let the user guess why. 
  • For good performance, UDP is preferred over TCP. 
  • VPN mode is Layer 3 (routing/NAT).
  • Don't forget to allow the configured VPN ports in the AWS firewall (security groups). 


Other VPN settings:
  • Should VPN clients have access to private subnets (non-public networks on the server side)? - Yes
  • Should client Internet traffic be routed through the VPN? - Yes

Privoxy

The next component we have to install and configure is Privoxy. As usual, "apt-get install privoxy" just works. The next step is to configure privoxy via /etc/privoxy/config file, there are two options to change:
  • listen-address your.ip.add.ress:8118
  • accept-intercepted-requests 1
Beware not to allow everyone accessing your Privoxy server in the AWS EC2 security groups, be sure it is reachable only to VPN users!

After everything is set, start privoxy with "service privoxy start", and add it to the autostart "update-rc.d privoxy defaults".

Iptables

And the final step is to configure your iptables chain to forward every web traffic from the VPN clients to the Privoxy server:

iptables -t nat -A PREROUTING -s 5.5.0.0/16 -p tcp -m multiport --dports 80,8080,81 -j DNAT --to-destination your.ip.add.ress:8118 

Optionally you can block access to all other ports as well, and what does not go through your Privoxy won't be reachable.
Based on your Linux distribution and preference, you might make this rule persistent.

Final test

Now you can connect to the VPN server from your Android device.
After logging in from a client, you get the following nice packages to install on your device:


After connecting, the final results can be seen in the following screenshots. And yes, there is a reason I chose Angry Birds as an example.

Angry Birds without Privoxy
Angry Birds with Privoxy
Stupid flashlight app with ad
Stupid flashlight app with Privoxy
Spoiler alert
If you are afraid of NSA tracking you, this post is not for you. If you want to achieve IP layer anonymity, this post is not for you. As long as you are the only one using that service, it should be trivial to see what could possibly go wrong with that.

Known issues
Whenever the Internet connection (Wifi, 3G) drops, the VPN connection drops as well, and your privacy is gone ...
Sites breaking your privacy through SSL can still do that as long as the domain is not in the Privoxy blacklist.

Additional recommendation
If you are using OSX or Windows, I can recommend Aviator to be used as your default browser. It is just great, give it a try!

PS: There are also some adblock apps removed from the official store which can block some ads, but you have to configure a proxy for every WiFi connection you use, and it is not working over 3G.



Continue reading

  1. Top Pentest Tools
  2. Hacking Tools Windows
  3. Hacker Tools For Mac
  4. Hack Tools Github
  5. Hacking Tools Usb
  6. Hacker Tools List
  7. Hacker Tools Hardware
  8. Pentest Tools Website
  9. Hacker Tools For Windows
  10. Hacker Tool Kit
  11. Computer Hacker
  12. How To Make Hacking Tools
  13. Growth Hacker Tools
  14. Best Hacking Tools 2019
  15. How To Install Pentest Tools In Ubuntu
  16. Tools Used For Hacking
  17. Pentest Tools Subdomain
  18. Hack Tools For Mac
  19. Kik Hack Tools
  20. Hacking Tools For Mac
  21. Hacker Tools For Pc
  22. Pentest Tools Kali Linux
  23. Pentest Tools Github
  24. Nsa Hack Tools Download
  25. Hacking Tools Usb
  26. Hack Tools For Mac
  27. Pentest Automation Tools
  28. What Are Hacking Tools
  29. Physical Pentest Tools
  30. Github Hacking Tools
  31. Hack Tool Apk
  32. Wifi Hacker Tools For Windows
  33. Top Pentest Tools
  34. Hack Tools For Windows
  35. Best Hacking Tools 2019
  36. Pentest Automation Tools
  37. Android Hack Tools Github
  38. Hacking Tools Mac
  39. Hack Rom Tools
  40. Pentest Tools Apk
  41. Hacking Tools Usb
  42. Hacking Tools For Windows 7
  43. Hacking Tools Usb
  44. Pentest Tools Alternative
  45. Hack Tools
  46. Hacker Search Tools
  47. Pentest Tools Free
  48. Hacking Tools Online
  49. Free Pentest Tools For Windows
  50. Pentest Tools Linux
  51. Hacker Tools For Windows
  52. Hacking Tools 2020
  53. Hacking Tools Name
  54. Hacking Tools Free Download
  55. World No 1 Hacker Software
  56. Pentest Tools List
  57. Pentest Tools Url Fuzzer
  58. Hacking Tools And Software
  59. Pentest Tools Subdomain
  60. Hacking Tools Kit
  61. Physical Pentest Tools
  62. Hack Tools
  63. Hack Rom Tools
  64. Pentest Tools Url Fuzzer
  65. Bluetooth Hacking Tools Kali
  66. Pentest Tools For Ubuntu
  67. Hack Website Online Tool
  68. Hacker Tools Github
  69. Hack Tools
  70. New Hacker Tools
  71. Hack Apps
  72. Pentest Tools Bluekeep
  73. Android Hack Tools Github
  74. Hacker Tools Hardware
  75. Pentest Tools Free
  76. Hackers Toolbox
  77. Beginner Hacker Tools
  78. Hacker Tools Software
  79. Black Hat Hacker Tools
  80. Hacking Tools Name
  81. Pentest Tools For Mac
  82. Hack Tool Apk No Root
  83. Hacker Tools Online
  84. Free Pentest Tools For Windows
  85. Hacker Tools
  86. Hacker Tools Online
  87. Hacker Tools For Ios
  88. Github Hacking Tools
  89. Hacking Tools Name
  90. Install Pentest Tools Ubuntu
  91. Hak5 Tools
  92. Hack Tools For Mac
  93. New Hack Tools
  94. Pentest Tools For Android
  95. Github Hacking Tools
  96. Pentest Reporting Tools
  97. Pentest Tools Linux
  98. Hack Tools
  99. Bluetooth Hacking Tools Kali
  100. Hacking Tools Download
  101. Hacker Search Tools
  102. What Are Hacking Tools
  103. Hacker Tools 2019
  104. Hacker Tools Online
  105. Pentest Box Tools Download
  106. How To Install Pentest Tools In Ubuntu
  107. Hack Tools Github
  108. Wifi Hacker Tools For Windows
  109. Hacker Tools 2019
  110. Pentest Tools Online
  111. Hack Tools Online
  112. Hacker Tools For Pc
  113. Physical Pentest Tools
  114. Ethical Hacker Tools
  115. What Are Hacking Tools
  116. Hacker Tools Apk Download
  117. Blackhat Hacker Tools
  118. Kik Hack Tools
  119. Hack Tool Apk No Root
  120. Nsa Hack Tools Download
  121. Hacking Tools For Windows Free Download
  122. How To Install Pentest Tools In Ubuntu
  123. Nsa Hacker Tools
  124. Hack Tools
  125. Hacker Tools Mac
  126. Hacker Tools 2019
  127. How To Make Hacking Tools
  128. Hacking Tools For Windows Free Download
  129. Pentest Tools For Windows
  130. Pentest Tools Apk
  131. Hacker Tools Software
  132. Hacker Techniques Tools And Incident Handling

No comments: