Advise on the benefit of a firewalled router

[Notconnected]

Hello everyone, am new here, have lots of questions.
I currently can only access the internet over my mobile phone
using it as a hotspot to wirelessly connect my laptop to the internet.
So given my ISP can see everything I do online, is there any point
in setting up an Opnsense box, connecting my laptop to it, and connecting the wan port to my phone.
What protection or security will this provide me with, or as I suspect my ISP will still have the same look into my browsing and online life.
I hope someone will take the time to explan what can and can not be gained from using a firewalled router between my laptop and my mobile phone.

Thanks in advance

 

[Notconnected]

Anyone care to comment, thanks.

 

[dave14305]

You don’t use a firewall to prevent snooping by the ISP. You use a firewall to keep unwanted traffic entering or exiting your network. You encrypt traffic if you want privacy from snooping.

If your mobile phone is your only connection, what security does it offer today? I’ve never relied on a mobile phone as a hotspot. Can your internet addresses be pinged? Are they CGNAT addresses? Any IPv6?

 

[Notconnected]

You don’t use a firewall to prevent snooping by the ISP. You use a firewall to keep unwanted traffic entering or exiting your network. You encrypt traffic if you want privacy from snooping.

If your mobile phone is your only connection, what security does it offer today? I’ve never relied on a mobile phone as a hotspot. Can your internet addresses be pinged? Are they CGNAT addresses? Any IPv6?

Thank you for posting.
I use my mobile phone because they will not provide land line never mind fiber where I am
out in the country.firewall.
I do not use my mobile phone for browsing, only to connect my laptop to the internet via my router /
I have Opnsense set up to use quad9 for DNS resolution via unbound.
What protection will this give me, will my ISP still see all my online browsing activity,
or will the connection from my firewall to quad9 circumvent my ISP's snooping.

UPDATE, I forgot to mention I use a managed switch before the router / firewall,
it can do VLAN's.
My main concern is my ISP's spying, nothing to hide, but am not happy to have someone
snooping around, or selling any information they get.

 

[Tech9]

The only way to hide your online activity from your ISP is running a VPN on your computer. In this case you replace the physical ISP (the mobile network operator) with virtual one (the VPN service provider) and the latter can see your activity. Some people trust commercial VPN providers more based on aggressive (often false) advertisement. You don't need this additional OPNSense device. Your computer has firewall, the OS is monitoring for suspicious activity, modern browsers use Safe Browsing.

 

[Notconnected]

The only way to hide your online activity from your ISP is running a VPN on your computer. In this case you replace the physical ISP (the mobile network operator) with virtual one (the VPN service provider) and the latter can see your activity. Some people trust commercial VPN providers more based on aggressive (often false) advertisement. You don't need this additional OPNSense device. Your computer has firewall, the OS is monitoring for suspicious activity, modern browsers use Safe Browsing.

Hi, thanks for posting.
I have a switch before the router so I can connect all my computing devices to it via ethernet, then ethernet cable to router.
I should say I also use a hotspot from the WAN on my router / firewall bridged to my phone, this bridge to my mobile phone is the
only wireless link in the chain.
I use linux on all my computing devices but did not want to set up firewalls on them all, so got a router / firewall.

Would setting up a VPN on the router / firewall be the same as setting up a VPN on all my devices.

 

[Tech9]

If your ultimate goal is to hide your online activity - you can't. Someone will always be able to see what are you doing online regardless of your routers, connections, DNS settings and encryptions.

 

[Notconnected]

If your ultimate goal is to hide your online activity - you can't. Someone will always be able to see what are you doing online regardless of your routers, connections, DNS settings and encryptions.

Well then there is no point in being online and hoping to not be categorised labelled and spied upon.
Thanks for the heads up.

 

[Tech9]

You are in the middle of nowhere, no? Nothing to worry about. You may get some extra adds, eventually. Your bank, phone operator, Apple, Microsoft, Google, etc. (long list) combined already know more details about you than your closest relative.

 

[Notconnected]

You are in the middle of nowhere, no? Nothing to worry about. You may get some extra adds, eventually. Your bank, phone operator, Apple, Microsoft, Google, etc. (long list) combined already know more details about you than your closest relative.

Thanks.

 

[kuchkovsky]

Hello everyone, am new here, have lots of questions.
I currently can only access the internet over my mobile phone
using it as a hotspot to wirelessly connect my laptop to the internet.
So given my ISP can see everything I do online, is there any point
in setting up an Opnsense box, connecting my laptop to it, and connecting the wan port to my phone.
What protection or security will this provide me with, or as I suspect my ISP will still have the same look into my browsing and online life.
I hope someone will take the time to explan what can and can not be gained from using a firewalled router between my laptop and my mobile phone.

Thanks in advance

A few recommendations for your privacy:
1. If you don't trust your ISP, you can use any commercial VPN provider you find more trustworthy. But there's probably no need for that unless you live in a country with political censorship or mass surveillance (which is more common in developing or authoritarian states).
2. If you're an Apple user, you use Safari, and you decide you don't need a traditional commercial VPN, I recommend enabling iCloud Private Relay. This feature replaces your IP address with generic ones from Cloudflare. It's like a VPN, but without changing your location. Also, there's a similar service for other platforms called Cloudflare WARP. Unlike Private Relay, it explicitly mentions that it collects some information about you to improve its services, but maybe you will find it more trustworthy than your ISP.
3. Consider automatically connecting to a VPN when you use public Wi-Fi networks (it's really easy to do on iOS because it natively supports such triggers, and many apps like WireGuard or Passepartout support them; also, there are third-party workarounds available for Android), or don't use them at all. Even though they generally don't know what's inside your traffic because of HTTPS, they can still collect some basic info about your online behavior.
4. What I would definitely recommend is using an encrypted DNS provider like NextDNS or a similar self-hosted solution like AdGuard Home. Enable a moderately aggressive tracking blocking list like Hagezi Multi PRO++. Configure it on a router level and on your mobile devices, so you're protected when you use your cellular network as well. Also, use a good ad blocker for your browser like AdGuard, and enable tracking protection filters. All this will greatly reduce the amount of so-called "analytics" and "telemetry" that spy on you online.
5. It's a big one, but consider using an OS that is better for privacy: Linux > macOS > Windows; iOS > Android (except for some very nerdy custom ROMs). If you use Windows and don't want to change it, you can use apps like O&O ShutUp10++ that disable at least some of the tracking features.
6. Consider using a better browser for privacy: Firefox > Safari > Chrome.
7. Opt out of all "telemetry," "usage data collection," "customer experience programs," "personalized ads," and similar features in the software you use. These options send data about how you use the software back to the vendor, even if they claim it's anonymized.
8. Avoid internet-connected devices from manufacturers with poor privacy practices, especially low-cost brands from mainland China. These often include hardcoded backdoors, lack software updates, and tend to "phone home" without user consent.
9. Don't forget to use up-to-date software with automatic updates. While it's not directly related to privacy, vulnerabilities in old software can lead to your device being hacked and your data exposed to hackers.
10. Protect your online accounts to avoid being hacked. Always use strong passwords, and always enable MFA and passkeys if they are available. A good password manager is a must-have.

Regarding OPNsense, it's mostly not related to privacy, and it won't help you. You need to focus on the devices you actually use on your LAN and their software.

You can't completely hide from online tracking. But you can still have much better privacy. It's all up to you.

 

[NXIL]

I use my mobile phone because they will not provide land line never mind fiber where I am
out in the country.

Starlink.

www.starlink.com/us/?srsltid=AfmBOoo2tp_wGxnb_lyt-3mpNOy-QaVM743Dq-jPbzQIPFTP0ywtpCWk

What protection will this give me, will my ISP still see all my online browsing activity,

A firewall does not protect your data from your ISP. A VPN could.

I use linux on all my computing devices but did not want to set up firewalls on them all, so got a router / firewall.

Linux does not protect your traffic anymore than MacOS or Windows. It's traffic. VPN.

Your bank, phone operator, Apple, Microsoft, Google, etc. (long list) combined already know more details about you than your closest relative.

As Tech9 says, there is a LONG list of companies that sell YOU. Not sure what country you are in, but in USA there are license plate readers everywhere. Most people don't know about them. They catch your vehicle as it passes by the license plate reader cameras, which, as I said, are everywhere. Auto insurance companies can use that data--it's not private, you're in public when you are driving. There are many other uses for it.

Your cell phone data, your movement tracked by google maps (it's a symbiotic relationship--google uses your information to tell others how traffic is moving on the roads), and yes as Tech9 says, your credit report/banking report/zip code/etc are all analyzed and packaged.

If you want privacy: cash or bitcoin (and it can be tracked too, see some FBI cases with regard to that), walk or bike everywhere, wear a hat and sunglasses, etc--don't even wan to tell you about facial recognition cameras!

And Starlink: don't dismiss it because Elon. It's more than Elon.

 

[Notconnected]

A few recommendations for your privacy:
1. If you don't trust your ISP, you can use any commercial VPN provider you find more trustworthy. But there's probably no need for that unless you live in a country with political censorship or mass surveillance (which is more common in developing or authoritarian states).
2. If you're an Apple user, you use Safari, and you decide you don't need a traditional commercial VPN, I recommend enabling iCloud Private Relay. This feature replaces your IP address with generic ones from Cloudflare. It's like a VPN, but without changing your location. Also, there's a similar service for other platforms called Cloudflare WARP. Unlike Private Relay, it explicitly mentions that it collects some information about you to improve its services, but maybe you will find it more trustworthy than your ISP.
3. Consider automatically connecting to a VPN when you use public Wi-Fi networks (it's really easy to do on iOS because it natively supports such triggers, and many apps like WireGuard or Passepartout support them; also, there are third-party workarounds available for Android), or don't use them at all. Even though they generally don't know what's inside your traffic because of HTTPS, they can still collect some basic info about your online behavior.
4. What I would definitely recommend is using an encrypted DNS provider like NextDNS or a similar self-hosted solution like AdGuard Home. Enable a moderately aggressive tracking blocking list like Hagezi Multi PRO++. Configure it on a router level and on your mobile devices, so you're protected when you use your cellular network as well. Also, use a good ad blocker for your browser like AdGuard, and enable tracking protection filters. All this will greatly reduce the amount of so-called "analytics" and "telemetry" that spy on you online.
5. It's a big one, but consider using an OS that is better for privacy: Linux > macOS > Windows; iOS > Android (except for some very nerdy custom ROMs). If you use Windows and don't want to change it, you can use apps like O&O ShutUp10++ that disable at least some of the tracking features.
6. Consider using a better browser for privacy: Firefox > Safari > Chrome.
7. Opt out of all "telemetry," "usage data collection," "customer experience programs," "personalized ads," and similar features in the software you use. These options send data about how you use the software back to the vendor, even if they claim it's anonymized.
8. Avoid internet-connected devices from manufacturers with poor privacy practices, especially low-cost brands from mainland China. These often include hardcoded backdoors, lack software updates, and tend to "phone home" without user consent.
9. Don't forget to use up-to-date software with automatic updates. While it's not directly related to privacy, vulnerabilities in old software can lead to your device being hacked and your data exposed to hackers.
10. Protect your online accounts to avoid being hacked. Always use strong passwords, and always enable MFA and passkeys if they are available. A good password manager is a must-have.

Regarding OPNsense, it's mostly not related to privacy, and it won't help you. You need to focus on the devices you actually use on your LAN and their software.

You can't completely hide from online tracking. But you can still have much better privacy. It's all up to you.

Thank you for posting.
I ditched windows decades ago, I have some apple devices but only use them for basic communication, no giveaway content or searches that would identify my beliefs or views or intentions.

Opnsense has all the plugins, wire guard, secure DNS and much more, that is why I use it, as well as to keep cameras off the WAN.

I will look into a VPN for my phone. I already use secure DNS.

And yes, hate speech laws are now a threat to anyone who tells the truth online or questions the elites. Only a few days ago Germany raieded the homes of people for their posts.
People are being crippled now with what they can say and need to avoid the speech police.

 

[Notconnected]

Starlink.

www.starlink.com/us/?srsltid=AfmBOoo2tp_wGxnb_lyt-3mpNOy-QaVM743Dq-jPbzQIPFTP0ywtpCWk



A firewall does not protect your data from your ISP. A VPN could.



Linux does not protect your traffic anymore than MacOS or Windows. It's traffic. VPN.



As Tech9 says, there is a LONG list of companies that sell YOU. Not sure what country you are in, but in USA there are license plate readers everywhere. Most people don't know about them. They catch your vehicle as it passes by the license plate reader cameras, which, as I said, are everywhere. Auto insurance companies can use that data--it's not private, you're in public when you are driving. There are many other uses for it.

Your cell phone data, your movement tracked by google maps (it's a symbiotic relationship--google uses your information to tell others how traffic is moving on the roads), and yes as Tech9 says, your credit report/banking report/zip code/etc are all analyzed and packaged.

If you want privacy: cash or bitcoin (and it can be tracked too, see some FBI cases with regard to that), walk or bike everywhere, wear a hat and sunglasses, etc--don't even wan to tell you about facial recognition cameras!

And Starlink: don't dismiss it because Elon. It's more than Elon. wwill

Thank you for posting.
Yes, there is a lot of data collectors around now, I was hoping Musk would come out with a phone that is free of all that, time will tell, the phone is definitely the biggest culprit around for listening in and otherwise sending everything back to big brother.
Starlink am not sure on, you said at the end of your comment to not dismiss it because it was Elon,
do you mean he too will be collecting user infor, or just because he is not everyones favourite.

I think I will go with a VPN on my phone, just need to settle on one that works on Android.
Protonmail do a VPN, but they don't publish any audit fighres or proof of audit results.
They also have to deal with new laws in their home country regarding keeping records for a year,
they have not commented on what records they are required to keep, this puts me off because they could be made under law keep all that goes that passes through their VPN network.
I know in the past they handed records over under court order, so much for their anonymity.
I wrote to them and got no response when I inquired about their policies and the law.

 

[NXIL]

I have a switch before the router

I do not think that works.

The router hands out local IP addresses. If switch is before router, between router and internet, then it can't hand out IP addresses.

 

[NXIL]

Starlink am not sure on, you said at the end of your comment to not dismiss it because it was Elon,
do you mean he too will be collecting user info, or just because he is not everyones favourite.

Definitely because he is not everyone's favorite/controversial.

Protonmail do a VPN, but they don't publish any audit fighres or proof of audit results.

I trust Proton (with my email) and they really seem to do things right. But, as you said, who can you trust? But, I do not have any audit/traffic/legitimate data or proof.

 

[Tech9]

I know in the past they handed records over under court order, so much for their anonymity.

Illegal activities are in violation of User Agreement with any commercial VPN. If you get to court order no VPN will protect you for $5/month subscription fee. There is no "anonymity" when connected to Internet. If you do everything possible to hide you'll potentially draw more attention to your account. Make sure you know what are you doing.

 

[Notconnected]

I do not think that works.

The router hands out local IP addresses. If switch is before router, between router and internet, then it can't hand out IP addresses.

I think it is normal, switch connected to router, router to internet, it sure would not work the other way around.

 

[Notconnected]

Illegal activities are in violation of User Agreement with any commercial VPN. If you get to court order no VPN will protect you for $5/month subscription fee. There is no "anonymity" when connected to Internet. If you do everything possible to hide you'll potentially draw more attention to your account. Make sure you know what are you doing.

I agree, accept am not involved in illegal activities, I just want to keep my business to me and browse the internet without corporations listening in and cashing in selling every piece of information they steal over and over and over to anyone who wants it.

 

[Tech9]

In this case you have to give up all the services from Google, Microsoft, Apple, Meta, etc.; stop using online stores like Amazon, Walmart, Costco, Target, etc.; close all bank accounts, mortgages, car leases, never use toll roads, etc.; discontinue all streaming services accounts, online subscriptions, cell phone plans, etc.; switch to paper bills only to PO box or better go off grid completely; go in public with shades and fake beard so surveillance cameras don't recognize you. I'm sure someone else will add more privacy ideas.

You have to find the balance between levels of privacy and convenience.