TrackerControl and Tor

[marcdw]

Recently I had been setting up a couple of ROMs on my Motos (potter Nougat and Sanders Oreo) to be a bit more private and fairly minimal (UnifiedNlp instead of microG, Simple Mobile Tools as default apps on one ROM - at the system level, mostly FOSS only apps, etc.). TrackerControl (TC) of course for its intended purpose as well as a simple on/off firewall to keep some apps from accessing the net.

I’ve had Tor Browser on several ROMs but realized I didn’t make much use of it. Installed Orbot instead and configured various browsers to use it. Never used it as a VPN because I didn’t want to give up TC. So, kind of limited really.

I have a new phone with Android 11. Not rooted or unlocked (not possible yet) so can’t be debloated. Disabled almost everything Google possible and use stuff from F-Droid.
Was going to use Orbot on it but decided to try InviZible Pro instead. Has Tor, DNSCrypt, and I2P. Works as root, VPN, or proxy. Using it as VPN at the moment. All good.

So I went with InviZible on the Motos. Root mode. Definitely works. All browsers show they’re using Tor without any or minimal changes. I’m in Los Angeles County, California, USA. Browserleaks site shows the T-Mobile addresses and map to be local. After enabling InviZible I’m now in Finland, Germany, France, what have you. Good.
Then I got hit by a years old snag. Cannot retrieve MMS.

I was going through all kinds of means to get that to work to no avail. Consult the logs, whitelist any domains used for retrieving MMS plus excluding the messaging app plus any system app I thought was related. Still a no go. Turn off InviZible (and Orbot when testing that) and then the MMS immediately downloaded.
Bummer, I thought. Was about to uninstall before I checked out the InviZible help page InviZible and NetGuard firewall. Given TC’s lineage and recent addition of port forwarding, maybe I can apply that.

Yep, that was the ticket. Use InviZible Pro in proxy mode, setup TC as per NetGuard (only minor differences) and it becomes a simple frontend. All traffic is still routed through Tor and I suppose DNScrypt is used.
Normally I have all browsers excluded in TrackerControl (even the Dev recommended that) but for this I enabled all monitoring before testing.

Now here is where the TC part shines. Still can’t get MMS but all I had to do, in TC, was turn off monitoring for my messaging app. Boom, immediately the MMS came in. Simple. No need to mess around inside of InviZible to exclude apps or whitelist domains when one can easily toggle from within TC.
On another ROM where I still have RoboForm, I couldn’t access my credit card site. Flip a switch in TC and all was good.
TrackerControl becomes the easy tool for managing which apps send their traffic through Tor.

Oddly, on the Android 11 device using InviZible, OnePlus 8T w/OxygenOS 11, it doesn’t have any issues receiving MMS. It uses Silence as the messaging app.

Notes: InviZible Pro via the Play Store is version 5.0.0 and does NOT include adblocking (DNSCrypt?). That version is also in the /e/ Apps store. Probably not an issue if TrackerControl is being used.
F-Droid version (via IzzyOnDroid repo) is version 1.1.5 (November 2020). Also available direct from InviZible.net.

Edit: Many thanks to @harvey186 who pretty much showed us the way with TrackerControl back when. I dumped my regular VPNs and haven’t looked back. It just gets better.

[XjFred]

Thanks for the tip. Can you explain me why your solution (Invizible + TC) is better than the use of a regular high-end VPN (such as NordVPN for example) ?

I assume NordVPN is crypting and hiding the IP.
Invizible + TC is hiding IP via Tor and crypting also.

So what’s the point I miss ?

[marcdw]

No point really as I’ve never used NordVPN. I was just playing around with what I had. No implication on whether it’s better or worse than anything else.

There is one downside to routing all traffic through Tor, captcha city. One will find themselves constantly having to prove they’re human on lots of sites. Sometimes they’ll seem almost endless before they let you pass.
It may even happen inside apps like NewPipe where all of a sudden you’re captcha’d while trying to watch a video.

For those who use Facebook, say via a frontend like Frost, they think you’ve been hacked and cracked. Have to be reverified and forced to change passwords.

But anyway, I was just experimenting with Tor while still using TC to manage tracking and easily excluding apps from using Tor.

[XjFred]

Thanks for your feedback.

I have to add something. I tried both Invizible Pro and Orbot (each, not together) alongside TrackerControl on my non-rooted eOS Galaxy S8. In this case, when Invizible or Orbot are in proxy mode, they don’t hide my IP (tested). In VPN mode (without TC obviously), they do. But not in proxy mode. I assume the OS has to be rooted to let all the apps trafic goes through Tor.

[marcdw]

No, I don’t think root has anything to do with it. The info below is from a stock, locked, and unrooted OxygenOS 11.

InviZible Pro in proxy mode.
TrackerControl set up with port forwarding, VPN DNSes set, and socks5 proxy on with 127.0.0.1, port 9050 (for Tor).

My real location is Los Angeles County, California, U.S.A.
Carrier is T-Mobile using IPv4 (none of my ROMs use IPv6).
Besides, VPN services have only recently been supporting IPv6.

Browser used is Mull (née Fennec).

Monitoring of Mull is on in TC. Traffic is routed through Tor. IP puts me in the U.S. Midwest. Usually it’s further out in Europe.

---

Turn off monitoring of Mull in TC. Traffic no longer goes through Tor. IP is local T-Mobile.

---

On another note I find I am refused login to the forums. I have to exclude/whitelist the community domain.
Not sure if I mentioned this before. In InviZible’s proxy mode it’s not possible to whitelist domains under Fast Settings. One has to stop the services, switch to root or VPN mode, then the whitelist stuff shows. Add any needed domains, switch back to proxy mode, and start the services. Works in most cases but not all (the newly revamped XDA forums for instance).