[Privoxy-users] Privoxy on router firmwares poses a huge security risk

[Ian Silvester]

Thanks for the heads-up to this community and for discussing the issue on the dd-wrt forums. Clearly it's a side-effect of that specific configuration so there's no change required (or possible) to Privoxy to correct the problem. 

Just out of curiosity, what is the advantage of running policy based routing for your VPN? 

Cheers, 

Ian

On Mon, 30 Dec 2019, at 13:37, tolis81 at protonmail.com wrote:
> Enable OVPN with PBR. Enable privoxy. Check any http ip leak test page 
> like dnsleak.com or whatismyipv6.com
> 
> This is happening since when enabling Policy Based Routing the router 
> is not on VPN and since privoxy relies on router, intercepting http 
> traffic from these sites exposes your real IP.
> 
> Applies on any open source router firmware.
> 
> https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322517&start=0
> 
> This is actually very difficult to find out since more ipleak test 
> sites are on https but you are actually exposed with the combination of 
> PBR & privoxy.
> 
> I bet a lot of people are already fully exposed and not even knowing about it...
> 
> Sent from ProtonMail mobile
> _______________________________________________
> Privoxy-users mailing list
> Privoxy-users at lists.privoxy.org
> https://lists.privoxy.org/mailman/listinfo/privoxy-users
>