Защита цифровой анонимности: от теории к реальной безопасности

angust@linux-pc:~$ sudo tcpdump -i any -n 'host 8.8.8.8' -w leak_test.pcap &
angust@linux-pc:~$ sudo killall openvpn

angust@linux-pc:~$ tcpdump -r leak_test.pcap -n | head -20

10:23:45.123 IP 192.168.1.100.54321 > 8.8.8.8.53: UDP, length 512
10:23:45.125 IP 8.8.8.8.53 > 192.168.1.100.54321: UDP, length 512
10:23:46.200 IP 192.168.1.100.44321 > 142.250.185.78.443: Flags [S], seq 0

angust@linux-pc:~$ sudo tcpdump -i eth0 -n 'port 53' -w dns_leak.pcap &
angust@linux-pc:~$ curl https://example.com

angust@linux-pc:~$ tcpdump -r dns_leak.pcap -n

10:25:12.456 IP 192.168.1.100.54321 > 8.8.8.8.53: 12345+ A? example.com
10:25:12.458 IP 8.8.8.8.53 > 192.168.1.100.54321: 12345 1/0/0 A 93.184.216.34

<!DOCTYPE html>
<html>
<head>
<title>WebRTC Leak Test</title>
</head>
<body>
<h1>WebRTC IP Leak Test</h1>
<div id="result"></div>
<script>
var pc = new RTCPeerConnection({iceServers:[]});
pc.createDataChannel("");
pc.createOffer().then(offer => pc.setLocalDescription(offer));
pc.onicecandidate = function(ice) {
if (ice.candidate) {
var ip = /([0-9]{1,3}(\.[0-9]{1,3}){3})/.exec(ice.candidate.candidate)[1];
document.getElementById("result").innerHTML = "Real IP: " + ip;
}
};
</script>
</body>
</html>

angust@linux-pc:~$ ssh [email protected]

/system package update check-for-updates

/system package update download

/system package update install

/user set admin password="НовыйСильныйПароль"

/user add name=adm-sec group=full password="ЕщёОдинНадёжный"

/user remove admin

/system identity set name="Secure-USB"

/system clock set time-zone-name=Europe/Moscow

/system ntp client set enabled=yes \
server-dns-names=time.google.com,ru.pool.ntp.org

/system logging add topics=critical action=memory

/ip service disable telnet,ftp,www,www-ssl,api,api-ssl

/ip service disable mac-server,mac-winbox

/ip service set winbox address=192.168.88.10/32

/ip neighbor discovery-settings set discover-interface-list=none

/tool bandwidth-server set enabled=no

/ip cloud set ddns-enabled=no update-time=no

angust@linux-pc:~$ sudo tcpdump -i eth0 -n 'arp' -w arp_scan.pcap &
angust@linux-pc:~$ nmap -sn 192.168.88.0/24

/interface bridge filter add chain=forward action=accept \
src-mac-address=AA:BB:CC:DD:EE:FF

/interface bridge filter add chain=forward action=drop \
src-mac-address=!AA:BB:CC:DD:EE:FF

/ip address add address=192.168.88.1/24 interface=bridge-local

/interface ppp-client print detail

/interface ppp-client set ppp-out1 \
add-default-route=yes use-peer-dns=yes dial-on-demand=no \
keepalive-timeout=60 info-channel=auto data-channel=auto

/ip firewall nat add chain=srcnat out-interface=ppp-out1 \
action=masquerade comment="USB NAT"

/ip firewall filter remove [find]

/ip firewall filter

add chain=input action=accept connection-state=established,related \
comment="Рабочие сессии"

add chain=input action=accept in-interface=bridge-local \
src-address=192.168.88.10/32 comment="Мой ПК"

add chain=input action=drop in-interface=ppp-out1 \
comment="Запрет входа с модема"

add chain=input action=drop comment="Остальное отсекаем"

add chain=forward action=accept src-address=192.168.88.10/32 \
out-interface=ppp-out1 connection-state=new,established,related \
comment="Трафик ПК наружу"

add chain=forward action=drop out-interface=ppp-out1 \
comment="Всё прочее наружу блокируем"

/ip firewall filter add chain=input in-interface=ppp-out1 \
protocol=icmp action=drop comment="Block ping"

/ipv6 settings set disable-ipv6=yes

/ip dns set allow-remote-requests=no \
use-doh-server="https://dns.google/dns-query" \
doh-ca-file=dynamic

/system scheduler add interval=1w name=auto-backup \
on-event="/system backup save name=SecureUSB"

/export file=SecureUSB-config

:local pppIfName "ppp-out1"
:local apnName "internet"
:local dialNumber "*99#"
:local infoChannel "auto"
:local dataChannel "auto"
:local pppUser ""
:local pppPassword ""

/log info ("[3G/LTE SETUP] Настраиваю интерфейс " . $pppIfName)

:if ([/interface ppp-client find where name=$pppIfName] = "") do={
/log error ("PPP-интерфейс " . $pppIfName . " не найден — проверьте USB-модем")
:error "PPP interface not found"
}

/interface ppp-client set $pppIfName info-channel=$infoChannel data-channel=$dataChannel

/interface ppp-client set $pppIfName \
apn=$apnName phone=$dialNumber user=$pppUser password=$pppPassword \
allow=pap,chap dial-on-demand=no add-default-route=yes \
default-route-distance=0 use-peer-dns=yes keepalive-timeout=60

/interface enable $pppIfName

/ip dns set allow-remote-requests=yes use-doh-server="" servers=""

/log info "[3G/LTE SETUP] DNS готов"

:if ([/ip firewall nat find where chain=srcnat and out-interface=$pppIfName \
and action=masquerade] = "") do={
/ip firewall nat add chain=srcnat out-interface=$pppIfName \
action=masquerade comment="3G/LTE auto NAT"
/log info "[3G/LTE SETUP] Добавлен NAT masquerade"
} else={
/log info "[3G/LTE SETUP] NAT уже существует"
}

:delay 3s

/tool ping address=8.8.8.8 interval=1s count=5 interface=$pppIfName

/log info "[3G/LTE SETUP] Проверка завершена"

sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

sudo swapoff /swapfile

sudo rm /swapfile

sudo nano /etc/fstab # закомментируйте строку со swap

sudo lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT

sudo wipefs -a /dev/sdb

sudo sgdisk --zap-all /dev/sdb

sudo parted /dev/sdb --script mklabel gpt

sudo parted /dev/sdb --script mkpart primary 1MiB 100%

sudo cryptsetup luksFormat /dev/sdb1

sudo cryptsetup open /dev/sdb1 cryptdata

sudo pvcreate /dev/mapper/cryptdata

sudo vgcreate vgdata /dev/mapper/cryptdata

sudo lvcreate -L 100G -n data vgdata

sudo mkfs.ext4 /dev/vgdata/data

sudo mkdir -p /mnt/data

sudo mount /dev/vgdata/data /mnt/data

sudo blkid /dev/sdb1

sudo nano /etc/crypttab # cryptdata UUID=... none luks

sudo nano /etc/fstab # /dev/vgdata/data /mnt/data ext4 defaults 0 2

sudo systemctl daemon-reload

sudo systemctl restart cryptsetup.target

sudo mount -a

sudo cryptsetup luksAddKey /dev/sdb1

sudo cryptsetup -v status cryptdata

sudo cryptsetup luksDump /dev/sdb1

sudo apt install -y iptables-persistent

sudo iptables -F

sudo iptables -N PASSVPN

sudo iptables -N BLOCKANY

sudo iptables -A OUTPUT -o tun+ -j ACCEPT

sudo iptables -A OUTPUT -o lo+ -j ACCEPT

sudo iptables -A OUTPUT -j PASSVPN

sudo iptables -A OUTPUT -j BLOCKANY

sudo iptables -A PASSVPN -d 127.0.0.1 -j ACCEPT

sudo iptables -A PASSVPN -d ВАШ_VPN_IP -j ACCEPT

sudo iptables -A BLOCKANY -j DROP

sudo iptables-save | sudo tee /etc/iptables/rules.v4

sudo systemctl enable netfilter-persistent.service

sudo apt install proxychains4