Classic college kid Internet privacy question

[Robin Goodfellow]

Classic college kid basic Internet privacy question.
1. Kid is a freshman who was brought up on privacy.
2. Kid is in a dorm apt with school Wi-Fi & Ethernet (2 ports).
3. Understandably, kid wants privacy on his Internet connections.

Kid has the following hardware in his dorm room.
A. 5G Android smartphone
B. Desktop with Wi-Fi & Ethernet (unknown if it's both 2.4 & 5GHz)
C. Laptop with Wi-Fi & Ethernet (unknown if it's both 2.4 & 5GHz)

What options do we have?
a. Kid is on USA T-Mobile which provides only 5GB/month free hotspot.
b. I don't think a free public Wi-Fi or WISP is in the cards.
c. I doubt the school would allow Comcast cable in a dorm room.

Kid says 5GB isn't enough so I can ask his parents to change their plan
(he's my grandchild) but increasing his hotspot amount is only one possible
solution given he thinks the hotspotting is too slow already.

Personally I can go a year on 5GB of cellular data but I'm 4 times his age.
Kid today asked for a router for Christmas (I have no problem with that).
Which is what prompted this query.

What options do we have given the goal is privacy from the school?
(I didn't ask why because I'm an adult so I know anyone who asks why isn't
usually an adult because every adult understands privacy needs are basic.)

This is a technical question, not a moral question.
What are his technical options given a typical college environment?

[Marco Moock]

Am Sat, 23 Oct 2021 22:06:35 +0000

Post by Robin Goodfellow
2. Kid is in a dorm apt with school Wi-Fi & Ethernet (2 ports).

Use this net and only connect through a VPN or TOR.
Restrict that by certain firewall rules.
You can run a TOR client that provides a SOCKS proxy server. The
computer the kid uses is directly connected to that computer (not
Routing or NAT enabled, just connected via Ehernet) and only uses the
SOCKS proxy on it.

[Robin Goodfellow]

Post by Marco Moock

Post by Robin Goodfellow
2. Kid is in a dorm apt with school Wi-Fi & Ethernet (2 ports).

Use this net and only connect through a VPN or TOR.
Restrict that by certain firewall rules.
You can run a TOR client that provides a SOCKS proxy server. The
computer the kid uses is directly connected to that computer (not
Routing or NAT enabled, just connected via Ehernet) and only uses the
SOCKS proxy on it.

Thanks Marco Mock for hazarding advice, as I am well aware how risky
that is, which I very much appreciate given your knowledge of networking
surpasses that of mine.

Two things were already done, one by his parents, the other by me.
1. The parents doubled his cellular hotspot from 5GB to 10GB for $10/month
2. I flashed the extra Netgear WNR834Bv2 with this "chk" file from dd-wrt
<https://wiki.dd-wrt.com/wiki/index.php/Netgear_WNR834Bv2>
<ftp://ftp.dd-wrt.com/betas/2015/08-25-2015-r27745/broadcom/dd-wrt.v24_mini-wnr834bv2.chk>

Regarding VPN or TOR, he is mostly gaming, I think, neither of which
really lends itself to TOR (at least not the Tor Browser Bundle anyway).

I'm sure there is a way to set up the entire system on TOR/Socks
but I've tried that about 10 or 15 years ago and it was miserable
(privoxy and all that) to do.

Therefore the only TOR he's using is the Tor Browser Bundle,
which isn't, he says, useful for gaming.

The VPN he's using are the free vpns, which, as you may know,
aren't all that reliable (and which don't have many locales
inside the USA usually).

If I understand your suggestion correctly, we can set up an entire
computer to run nothing but TOR/SOCKS, which is what the kid can
connect to directly from his desktop (but he also wants to use
his phone cellular, apparently).

There is a $90 T-Mobile mobile hotspot device which, for $55/month
gives him everything he's asking for (50GB/month of cellular data)
but of course, that's $600 per year which is a bit steep of a price
to pay when he _already_ has "free" Internet provided by the school.

I'm working on figuring out how adding "VPN" to a router works,
where I've figured out that Netgear uses "chk" files first.
<https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=776979>
and then once dd-wrt is on that router, it can take a further
dd-wrt "bin" file, but I don't know (yet) which bin to use.
<https://dd-wrt.com/support/router-database/?model=WNR834B_v2>
And, I don't want to guess (as bricking is always around the corner).

At that location are seven dd-wrt "bin" files, but which one do I use?

1) DD-WRT: Broadcom Generic -= K2.4 - Mini dd-wrt.v24_std_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_std_generic.bin>

2) DD-WRT: Broadcom Generic -= K2.4 - Mini dd-wrt.v24_mini_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_mini_generic.bin>

3) DD-WRT: Broadcom Generic -= K2.4 - Micro dd-wrt.v24_micro_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_micro_generic.bin>

4) DD-WRT: Broadcom Generic -= K2.4 - Micro + OLSRD dd-wrt.v24_mini-wnr834bv2.chk
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_micro_olsrd_generic.bin>

5) DD-WRT: Broadcom Generic -= K2.4 - Mini dd-wrt.v24_nokaid_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_nokaid_generic.bin>

6) DD-WRT: Broadcom Generic -= K2.4 - Mini dd-wrt.v24_voip_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_voip_generic.bin>

7) DD-WRT: Broadcom Generic -= K2.4 - Mini dd-wrt.v24_vpn_generic.bin
<https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2020/11-03-2020-r44715/broadcom/dd-wrt.v24_vpn_generic.bin>

Notice the _last_ one has "vpn" in the name, so one might intuit
that it's the one to use, but knowing that bricking routers is a
distinct possibility, just guessing without any other data is usually
not a good idea when it comes to flashing firmware.

I think the VPN router "might" replace your "TOR/SOCKS computer" in
the suggested scenario (as I don't have an extra PC to give the kid).

If I understand VPN routers, we still need to pay for a reliable VPN
service but after that, the school will only see the (faked) MAC
address of the VPN router for _all_ his traffic (whether it's Wi-Fi
or Ethernet from his phone or from his desktop or from his laptop).

And, if I understand it correctly, _all_ that traffic will be
connected to a single IP address (of the VPN) and it will all
be encrypted.

The school will know he's using VPN, and they'll know all the
metadata of the size and timing of the packets, but that's it
(am I correct?)

If that's a good plan (lowest cost, best compromise on privacy),
then all I need to do now is find a tutorial for setting up
dd-wrt as a VPN router. I think I need to flash another "bin" file
(after the initial "chk" file though - but I don't know which one).

In theory, does this sound like a low-cost plan that "can" work?
1. I put VPN on the extra router & set the MAC to look like a PC
2. I set dd-wrt to always log into a (paid?) public VPN service
3. The kid connects _everything_ to that VPN router

Does _that_ approach give the kid the privacy he is asking for?

[Marco Moock]

Am Sun, 24 Oct 2021 18:33:02 +0000

Post by Robin Goodfellow
Regarding VPN or TOR, he is mostly gaming, I think, neither of which
really lends itself to TOR (at least not the Tor Browser Bundle anyway).
I'm sure there is a way to set up the entire system on TOR/Socks
but I've tried that about 10 or 15 years ago and it was miserable
(privoxy and all that) to do.

It works, but tor has high latency and because of that isn't capable
for real time communication like gaming.

Post by Robin Goodfellow
The VPN he's using are the free vpns, which, as you may know,
aren't all that reliable (and which don't have many locales
inside the USA usually).
If I understand your suggestion correctly, we can set up an entire
computer to run nothing but TOR/SOCKS, which is what the kid can
connect to directly from his desktop (but he also wants to use
his phone cellular, apparently).

Much harder because Google and Apple are bad companies restricting what
users can do and restrict proxy usage to web browsers only. As I know
Android only supports an HTTP proxy, so you would need an HTTP/SOCKS
proxy connector too.

Post by Robin Goodfellow
I'm working on figuring out how adding "VPN" to a router works,

That would be a solution. The kid is then directly connected via the
VPN and the VPN router creates the VPN tunnel.

Post by Robin Goodfellow
I think the VPN router "might" replace your "TOR/SOCKS computer" in
the suggested scenario (as I don't have an extra PC to give the kid).

Yes, makes it much easier.

Post by Robin Goodfellow
If I understand VPN routers, we still need to pay for a reliable VPN
service but after that, the school will only see the (faked) MAC
address of the VPN router for _all_ his traffic (whether it's Wi-Fi
or Ethernet from his phone or from his desktop or from his laptop).

True. They only see that VPN routers interface to them and the metadata.

Post by Robin Goodfellow
And, if I understand it correctly, _all_ that traffic will be
connected to a single IP address (of the VPN) and it will all
be encrypted.

Depends on the VPN operator. Some use IPv4-NAT, some give you public
IPv4 addresses.
IPv6 is normally global, so every device gets its own global IPv6
address.

Post by Robin Goodfellow
The school will know he's using VPN, and they'll know all the
metadata of the size and timing of the packets, but that's it
(am I correct?)

True

Post by Robin Goodfellow
If that's a good plan (lowest cost, best compromise on privacy),
then all I need to do now is find a tutorial for setting up
dd-wrt as a VPN router. I think I need to flash another "bin" file
(after the initial "chk" file though - but I don't know which one).

You nee a router that a) supports dd-wrt and is able to flash foreign
firmware. There are many models that support that, but some
manufactures create barriers to do so, for my TP Link I needed to set
up a TFTP server and use the recovery feature of that device to install
a foreign (non TP link) firmware on it.

Post by Robin Goodfellow
In theory, does this sound like a low-cost plan that "can" work?
1. I put VPN on the extra router & set the MAC to look like a PC
2. I set dd-wrt to always log into a (paid?) public VPN service
3. The kid connects _everything_ to that VPN router

Sound ok

Post by Robin Goodfellow
Does _that_ approach give the kid the privacy he is asking for?

It gives you protection against surveillance from the scholl, but
nothing else.
Also think about locking the computer when not using and encrypting all
hard disks to ensure nobody can gain access to the data/manipulate the
computer this way.