vpn http über localhost-Proxy leiten? Privoxy für Clients

2CGr2A6v

Dear community,
I’m still quite a newbie to Linux in general and I want to learn by establishing actually useful projects.
The actual project is for a vpn-server to get rid of ads, cookies etc. for all clients. Meaning: No matter which browser settings or add-ons are used by vpn-clients, everyone should profit from http cleansing that is done by privoxy.
Privoxy starts a proxy on localhost.
Is it possible to route all outbound openvpn client traffic through that proxy? Thanks for your help

server conf:

port 443
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth ta.key 0
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
user nobody
group nogroup
status openvpn-status.log
verb 3
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 60
mute 20

My iptable rules are pretty close to the openvpn example:

LOOP=127.0.0.1
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -F
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i venet0 -s $LOOP -j DROP
iptables -A FORWARD -i venet0 -s $LOOP -j DROP
iptables -A INPUT -i venet0 -d $LOOP -j DROP
iptables -A FORWARD -i venet0 -d $LOOP -j DROP
iptables -A FORWARD -i venet0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i venet0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i venet0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i venet0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i venet0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i venet0 -s 10.0.0.0/8 -j DROP
iptables -A FORWARD -p tcp --sport 137:139 -o venet0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o venet0 -j DROP
iptables -A OUTPUT -p tcp --sport 137:139 -o venet0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o venet0 -j DROP
iptables -A INPUT -s $LOOP -j ACCEPT
iptables -A INPUT -d $LOOP -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 587 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -s "10.8.0.0/24" -j ACCEPT
iptables -A INPUT -p udp --dport 443 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8118
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner privoxy -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o venet0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE

knutsel

What you describe is basically what i was/am looking for, and what i've successfully been using for about half a year now. Albeit not via iptables. There's another, and much simpler way of accomplishing it: Via proxy-settings.
And that's where it gets a bit 'tricky' with OpenVPN clients, depending on which platform you work with. The iOS-app has got the needed proxy-setting ("dhcp-option PROXY_HTTP") implemented already since last year, while the Android-app still doesn't have that same option yet. After the update of the Android OpenVPN Connect app a couple of weeks ago, still no luck... 🙁

What is needed is the option for clients to make use of a proxy AFTER the connection to the OpenVPN-server is made, like described in this https://forums.openvpn.net/topic15299.html.
Both the official OpenVPN Android- and iOS-app (as well as many third party apps) have the possibility to connect to an OpenVPN-server THROUGH a proxy, but that's not what we are looking for. We need the "dhcp-option PROXY_HTTP", and that is only implemented in the iOS app yet. With that option available you simply point (via that proxy-setting) to Privoxy, and it works perfectly fine once the OpenVPN-connection is made. With Privoxy runnning on the same server as OpenVPN, if you want.
This is a very elegant and simple solution, and you don' t have to fiddle around with iptables. But the client-app has to support it...

I've been using this setup for half a year now with an iPad, and it works flawlessly. The app i'm using is actually not the official one, since the first version of the official app where that "dhcp-option PROXY_HTTP" was introduced, was also the first version that didn't support iOS 5.1 anymore. And i got the iPad 1 that only goes to iOS 5.1, so i've got to use a third party app just for that functionality, see https://forums.openvpn.net/topic14829.html.

Anyway, i'm so enthusiastic about that combination of OpenVPN and Privoxy, that i really would like to see that function implemented in the Android app as well. Since there was not a single response in my thread however, i opened a thread in the wishlist section, hoping it will be noticed there: https://forums.openvpn.net/topic16179.html.

With that option available it really is a peace of cake to combine OpenVPN with Privoxy.
Maybe you could support the request by giving a reaction in that particular thread?