Since I have been unable to make Linux network namespaces work to use PBR on OpenWRT I want to install Tinyproxy so I can route at least browser traffic through a specific interface.
I'm wondering how best to configure and secure it. First, there's the line on the wiki page: "Configure the firewall to filter/block client traffic aimed directly to the WAN. Clients must still be able to reach the proxy from the LAN side, but not the WAN. If this step is omitted clients can reconfigure their proxy settings to not use a proxy and bypass the proxy without any effort."
I don't expect any naughty clients on the LAN but I do want to be certain nothing from the WAN can do anything. I believe I have already excluded that by setting my LAN IP-range on the Allow list. Which brings me to the second point. Do I need the 127.0.0.1 on the Allow list for it to work? I don't really see any reason why OpenWRT itself would have to be a Tinyproxy client.
And third, the ever annoying IPv6. There are some IPv6 suggestions on the Wiki page, but I'm not sure if those are only for 12.09 or are still relevant. Also, I'm still struggling with the ISP-assigned PD addresses over which I can not exercise any control (wish it were possible to tell OpenWRT to assign specific addresses from its range like reservations). I have no clue how to make that work. I suppose if I configure only an IPv4 address for the proxy on the clients, they should only use IPv4 for such traffic, but I am one of those people who would like to at least know how to configure it fully if possible.
Does anybody have tips and tricks for me before I permanently enable Tinyproxy on my router?
What makes you believe that you could? Today's internet is almost exclusively https based, which can't be proxied (without MitM wildcard certificates deployed to all clients, possible, but…).
Well, technically I'm routing everything but Tiny. Default route goes through VPN, but I use PBR to route other things through the ISP. Since Tiny will use the default route, I can set a system in PBR to use the ISP, then configure the proxy in its browsers to effectively go through the VPN.
It's not what I really wanted. On Windows I can simply add DSCP tags to applications, but unfortunately on Linux it seems I need this monstrosity:
And at the end of that thread somebody suggested a proxy so out of desperation after years of trying to migrate over to Linux, I figured I would at least try that then. If it is the best I can accomplish it will have to do.
In case, you are happy with just routing http(s) traffic via special interface/IP, tinyproxy will suffice. And proxy config for the browsers using explicit setting, i.g. using wpad functionality. Note, that for this strategy, using squid-proxy is more flexible, as you can select the clients to be routed via special interface/IP within the proxy, using ACL (Access Control Lists). I.e. you can just configure usage of proxy via wpad for all clients, and within squid you select clients by IP to use special interface. Will simplify management, I guess. However, to master squid setup is more complicated compared to tinyproxy.
Even that is already more than I really need. The default route on OpenWRT should be the VPN. It's pretty much this one exception which needs to be the other way around so that work traffic goes through the ISP but I can still use the workstation for some personal browsing as well. If there are certain non-HTTPS applications I guess I will just have to live with that as setting up SOCKS5 is possibly as complicated as that network namespace.
But I still don't know about the original questions. Do I really need 127.0.0.1 in there? Do I need to do a special configuration for IPv6? And is it secure or does it require extra configurations?
For SOCKS5 you probably need a partner server. Not many destinations support SOCKS5 directly. BUT: SOCKS5 has the advantage then, to proxy all traffic, not only http(s). And it can be done transparently, i.e. I am using hev-socks5-tproxy on my openwrt router, and have a small, cheap VPS as socks5-server in DE. Not a simple setup, though. Dunno about usage of namespaces or IPv6. 127.0.0.1 should not be necessary for tinyproxy, as no http(s) locally generated. Unless you use DoH. tinyproxy will be secure, when listening to local ports only.