Privoxy 4.2.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose Privoxy 4.2.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended, and the software charge is $0.04 per vCPU per hour.
• Set the security group. The listing's default group allows SSH (22) only, so restrict it to your own IP address. You will open the proxy port to your clients in Step 5.
• Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run this on your own workstation. It creates a security group that allows SSH from your management address and the proxy port from your VPC only, then launches the instance.

Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name privoxy \
  --description "Privoxy filtering proxy" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 8119 --cidr <vpc-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=privoxy}]'

You do not need --metadata-options, because the AMI already makes IMDSv2 required.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It generates this instance's proxy password and stores only a SHA-512 hash of it in the HAProxy configuration. It then starts Privoxy and HAProxy, and checks that the front end refuses requests without the password and accepts them with it.

The details are in /root/privoxy-credentials.txt, which only root can read. This command prints everything except the password line:

sudo grep -v '^PROXY_PASSWORD=' /root/privoxy-credentials.txt

# Privoxy 4.2.0 - generated on first boot by privoxy-firstboot.service.
# The password below is unique to this instance; nothing was baked into the image. Keep this file private.
#
# VPC clients: HTTP proxy 172.31.91.209:8119 with the user and password below (open TCP 8119 in the security group to
# your VPC or client security group only - never 0.0.0.0/0). SSH tunnel:
ssh -L 8118:127.0.0.1:8118 ... then use
# 127.0.0.1:8118 as the proxy (no password; SSH is the authentication). PROXY_HOST=172.31.91.209 PROXY_PORT=8119 PROXY_USER=sac PRIVOXY_LOOPBACK=127.0.0.1:8118
# Self-test:
sudo privoxy-selftest New password:
sudo privoxy-access rotate-password Clients:
sudo privoxy-access list
# Guide: https://secureanycloud.com/stacks/privoxy-4-2-0/

PROXY_HOST is your instance's private IP address. To see the password when you need it, run sudo cat /root/privoxy-credentials.txt.

Check that the three services are active and list the listening sockets:

systemctl is-active privoxy haproxy privoxy-firstboot
sudo ss -Hltn | awk '{print $4}' | sort

active active active 0.0.0.0:22 0.0.0.0:8119 127.0.0.1:8118 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

Privoxy is on 127.0.0.1:8118 only. HAProxy, the authenticated front end, is on port 8119. The two :53 sockets belong to Ubuntu's local DNS resolver, which listens on loopback only.

The image includes a self-test that exercises the whole path without printing the password. Run it:

sudo privoxy-selftest

SELFTEST_OK privoxy+haproxy active; Privoxy 4.2.0 127.0.0.1:8118 only; 8119 407 without/with a wrong password, 200 with the instance password, 400 origin-form; ad host blocked; toggle 403, editor 404; metadata (503) and loopback (503) unreachable; guards OK

Clients in your VPC connect to the instance's private IP address on port 8119. In the EC2 console, edit the instance's security group and add an inbound rule:

• Type: Custom TCP
• Port range: 8119
• Source: your VPC CIDR (for example 10.0.0.0/16) or the security group your client instances use

Never use 0.0.0.0/0. Even then, the proxy admits only private source addresses and still needs the password, but the port should not be exposed to the internet at all.

Using the proxy from your workstation through SSH

You do not need to open any port to use Privoxy from your own machine. Forward a local port to Privoxy's loopback address over SSH. SSH is the authentication, so this path needs no proxy password:

ssh -i ~/.ssh/my-key-pair.pem -N -L 8118:127.0.0.1:8118 ubuntu@<public-ip>

Then set your browser or system HTTP and HTTPS proxy to 127.0.0.1 port 8118.

From a client instance in your VPC, pass the user and password from Step 2. With curl:

curl -sS -o /dev/null -w '%{http_code}\n' --proxy http://<PROXY_HOST>:8119 --proxy-user '<PROXY_USER>:<PROXY_PASSWORD>' https://example.com/

200

Browsers and most command-line tools ask for the proxy user name and password when the proxy answers 407 Proxy Authentication Required. They also accept the credentials in the http_proxy and https_proxy environment variables.

This front end uses HTTP Basic authentication on the proxy connection itself, which is not encrypted. Keep the proxy port inside your VPC, and use the SSH tunnel above when you connect across the internet.

Without credentials, the front end answers 407 and offers the Basic challenge:

curl -s -D - -o /dev/null -x http://127.0.0.1:8119 http://example.com/ | head -3

HTTP/1.1 407 Unauthorized content-length: 112 cache-control: no-cache

Privoxy's own status page is served through the proxy. On the instance, the loopback port answers without a password:

curl -s -x http://127.0.0.1:8118 http://config.privoxy.org/ | sed -e 's/<[^>]*>//g' | grep -A1 'This is Privoxy'

This is Privoxy 4.2.0 on localhost (127.0.0.1), port 8118, enabled

Remote toggling and the web actions editor are refused, so nobody who uses the proxy can switch filtering off or change its rules:

curl -s -o /dev/null -w 'toggle %{http_code}\n' -x http://127.0.0.1:8118 'http://config.privoxy.org/toggle?set=disable'
curl -s -o /dev/null -w 'editor %{http_code}\n' -x http://127.0.0.1:8118 'http://config.privoxy.org/edit-actions-list?f=user'

toggle 403 editor 404

A proxy that fetches any URL could be used to read the instance metadata service or to reach services that listen only on the instance itself. Privoxy refuses both:

curl -s -o /dev/null -w 'metadata %{http_code}\n' -x http://127.0.0.1:8118 http://169.254.169.254/latest/meta-data/
curl -s -o /dev/null -w 'loopback ssh %{http_code}\n' -x http://127.0.0.1:8118 http://127.0.0.1:22/

metadata 503 loopback ssh 503

503 is Privoxy's "connection failed" page. Its destination rules refused the address before any connection was made.

Independently of those rules, both services are blocked from 169.254.169.254 at the system level (systemctl show -p IPAddressDeny privoxy haproxy).

Privoxy's default actions block common ad and tracking hosts. A request to a host whose name matches an ad pattern is answered by Privoxy itself:

curl -s -o /dev/null -w '%{http_code}\n' -x http://127.0.0.1:8118 http://ads.example.com/

403

The rule sets are in /etc/privoxy. The files match-all.action, default.action and default.filter are upstream's, user.action and user.filter are yours to edit, and sac.action holds the SecureAnyCloud defaults. Privoxy re-reads changed files automatically.

To check which actions apply to a URL, open http://config.privoxy.org/show-url-info through the proxy.

If your clients use addresses outside the private ranges (for example, a 100.64.0.0/10 secondary VPC range), add them to the front end's source list:

sudo privoxy-access list
sudo privoxy-access allow <vpc-cidr>

privoxy-access refuses 0.0.0.0/0 and any network wider than /8, checks the configuration and reloads HAProxy. To take a network out again, run sudo privoxy-access remove <CIDR>. The security group still decides who can reach port 8119 at all.

To replace the proxy password, run:

sudo privoxy-access rotate-password

This command generates a new password, replaces the hash in /etc/haproxy/haproxy.cfg, reloads HAProxy and writes the new password to /root/privoxy-credentials.txt. The old password stops working immediately.

CONNECT tunnels are allowed to port 443 only. To allow another port, edit the {+limit-connect{443}} line in /etc/privoxy/sac.action, for example to {+limit-connect{443,8443}}. Privoxy picks up the change on the next request.

Read the recent Privoxy and HAProxy messages from the journal:

sudo journalctl -u privoxy -u haproxy -n 20 --no-pager

Privoxy runs in the foreground under systemd, so its messages go to the journal. The shipped configuration enables only debug 4096 (start-up messages and warnings) and debug 8192 (errors), so the requests Privoxy serves are not logged. An error message can quote the address it refused, for example after a denied attempt to use the remote toggle page.

The start guard refuses debug 1, which logs every request URL, unless you first create /etc/privoxy/ALLOW-REQUEST-LOGGING. URLs can carry personal data and tokens. HAProxy logs each connection's client address, status and size without the request line.