Privoxy

Privoxy is a non-caching web proxy server with advanced filtering capabilities which can improve privacy. It works by removing or modifying elements of a HTTP request and its response, either on the headers or on the body of the request.

Although comparable to some browser extensions, being a server, it allows different programs to use it, removing the need to add extensions to each browser and with it, its potential associated problems like incompatibilities between extensions. It also helps to reduce browser fingerprinting thanks to the reduction of installed extensions.

It may be combined with caching proxies like squid to improve its overall speed.

Installation

USE flags

Emerge

To install net-proxy/privoxy :

Service

OpenRC

To have privoxy start at boot:

To start manually:

systemd

To have privoxy start at boot:

To start manually:

Configuration

Once the server is running, clients have to be made aware of it, to do so, the proxy configuration can be adjusted on each program. But many applications, such as browsers, Wget, Yt-dlp, and others, evaluate a system variable and no longer need to be manually configured to use the web proxy. Create a new file, e.g., /etc/env.d/99proxy with:

export http_proxy="http://127.0.0.1:8118"
export https_proxy="http://127.0.0.1:8118"

and activate it:

Enable logging

These are the recommended settings:

debug 1 # Log the destination for each request. See also debug 1024.
debug 1024 # Log the destination for requests Privoxy didn't let through, and the reason why.
debug 4096 # Startup banner and warnings
debug 8192 # Non-fatal errors

Clients

Firefox

Edit > Settings > Network Settings > Settings > Manual proxy configuration

HTTP Proxy 127.0.0.1 Port 8118

Mark the checkbox Also use this proxy for HTTPS

Chromium

Advanced configuration

The default values on Privoxy should work well for most cases, but further configuration can be made using the following methods.

Web configuration

Pointing a browser like Firefox to status and configuration page.

Editing configuration files manually

All the configuration files are located at /etc/privoxy.

The following are two common cases for modifying the base configuration:

To change the default port where Privoxy listens

Look for:

listen-address 192.168.0.1:8118

Change it to the desired port, for instance, if the desired port is 8080:

listen-address 192.168.0.1:8080

To block specific sites

Using a text editor as root edit /etc/privoxy/user.action, and add this at the end:

{ +block-as-image{reason to block} }
.example.com
.example2.com

Testing

Once the server is running, different tools and methods can be used to test if it is working properly.

lsof

If no client has been used yet, only the first line will be present. If a client has issued a request then more results will be present on the output of the command:

privoxy 5482 privoxy 4u IPv4 15135 0t0 TCP localhost:8118 (LISTEN)
privoxy 5482 privoxy 7u IPv4 246374 0t0 TCP localhost:8118->localhost:54486 (ESTABLISHED)
privoxy 5482 privoxy 9u IPv4 246376 0t0 TCP localhost:55012->localhost:9050 (ESTABLISHED)

nmap

Starting Nmap 7.92 ( https://nmap.org ) at 2021年10月20日 10:07 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000050s latency).
PORT STATE SERVICE
8118/tcp open privoxy
Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds

On a browser

Following the link config.privoxy.org will trigger a default filter on privoxy which will serve a page with the text:

This is Privoxy 3.0.32 on localhost (127.0.0.1), port 8118, enabled

a section with the Privoxy Menu and a section with support links.

Usage

By itself

Once clients are made aware of the proxy by adjusting their settings to point to the privoxy server they will start using it, including any changes made to the configuration files since the server doesn't have to be restarted to update its behaviour

Forwarding traffic through Tor

Tor is a powerful tool for the anonymity seekers and for many years has been used in combination with privoxy.

As root edit /etc/privoxy/config, look for:

# forward-socks5t / 127.0.0.1:9050 .

Change it to:

forward-socks5t / 127.0.0.1:9050 .

Using Squid as cache proxy

After installing Squid and Privoxy, set the clients to use Squid and set Squid to forward traffic to Privoxy.

For instance, change the proxy configuration on Firefox following the steps mentioned above but instead of port 8118 set it to 3128. After that, as root edit /etc/squid/squid.conf and add the following lines:

# Forward request to Privoxy
cache_peer 127.0.0.1 parent 8118 7 no-query default no-digest no-netdb-exchange
# ACL for FTP
acl ftp proto FTP
# No FTP through Privoxy
always_direct allow ftp
# Immediate restart
shutdown_lifetime 0 seconds
httpd_suppress_version_string on
forwarded_for off
never_direct allow all

Using Squid + Privoxy + Tor

After following all the steps above, the full chain should be working. To confirm that everything is working fine, visit the following 2 URLs.

1. config.privoxy.org
2. Tor check

The first URL should get the same result as the browser test done before.

The second URL should end in a page with the text Congratulations. This browser is configured to use Tor.

Caveats

Although removing elements from the page makes it lighter and the privoxy process tiself is not big or slow, if too many filters are working at the same time, the final result may be a bit slower than browsing without privoxy.

See also

• Squid — a web cache and a proxy server application used speed up web browsing.
• Tor — an onion routing Internet anonymity system.

External resources

• Quickstart to Using Privoxy
• Privoxy Frequently Asked Questions
• Official User manual
• Privoxy questions on StackExchange
• Onion link to the Privoxy Home page
• Test of a request page (only works if Privoxy is working)
• Check rules applied to a page (only works if Privoxy is working)

• Daemons
• Proxy
• Server
• Web servers