Skip to content
/ javid-mask Public

Privacy Protection Suite for Starlink Users in Iran

License

MIT license
3 stars 1 fork Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

Iman/javid-mask

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
sifter
sifter
 
 
singleton
singleton
 
 
triangle
triangle
 
 
.gitignore
.gitignore
 
 
LICENSE
LICENSE
 
 
README.fa.md
README.fa.md
 
 
README.md
README.md
 
 
iran_blocklist.txt
iran_blocklist.txt
 
 

Repository files navigation

Javid Mask - Privacy Protection Suite for Starlink Users in Iran

English | فارسی

A comprehensive suite of Ansible-automated privacy protection solutions using Raspberry Pi, designed to protect Starlink users in Iran from identity correlation attacks.

Author: Iman Samizadeh Licence: MIT Repository: https://github.com/Iman/javid-mask Last Updated: 2026-02-01

The Problem: Identity Correlation Attack

When a Starlink user in Iran accidentally visits an Iranian website, their identity can be exposed through cookies, browser fingerprints, or login sessions:

BEFORE (Normal Iranian ISP):
┌──────────────┐      ┌─────────────────┐
│ User         │─────►│ Iranian Website │
│ Cookie: Reza │      │ (digikala.com)  │
│ IP: Iran     │      │ Logs: Reza=Iran │
└──────────────┘      └─────────────────┘

AFTER (Starlink - DANGEROUS):
┌──────────────┐      ┌─────────────────┐
│ User         │─────►│ Iranian Website │
│ Cookie: Reza │      │ (digikala.com)  │
│ IP: USA!     │      │ Logs: Reza=USA!!│  ◄── RED FLAG
└──────────────┘      └─────────────────┘       "Reza has Starlink"

The risk: Iranian authorities can identify Starlink users by correlating:

  • Same cookies/fingerprints + foreign IP = Starlink user identified
  • Login sessions from foreign IPs = identity exposed
  • Browser fingerprints (Canvas, WebGL) identify devices across IPs

The Solution: Three Privacy Architectures

This project provides three complementary architectures, each offering different levels of protection:

Architecture Sifter Singleton Triangle
Complexity Simple Moderate Advanced
Primary Use DNS Server WiFi Gateway VPN Gateway
WiFi Access Point ❌ ✅ ✅
Proxy (VLESS/VMess) ❌ ✅ ❌
VPN (WireGuard) ❌ ❌ ✅
Traffic Encryption DNS only Full (via proxy) Full (via VPN)
Exit IP Your IP Your IP VPS IP
Kill Switch ❌ ❌ ✅
VPS Required ❌ ❌ ✅
DNS Filtering 1.6M+ 1.6M+ 3.2M+ (double)
Iranian Domains Blocked 131K+ 131K+ 131K+
Iranian IPs Blocked 763 CIDRs 763 CIDRs 763 CIDRs

Project Architectures

Sifter (DNS-Only)

View Sifter Documentation →

The simplest architecture - a pure DNS server that all your home devices point to.

Best for:

  • Users wanting minimal setup
  • Protecting all devices on existing network
  • DNS-level blocking only

Features:

  • Pi-hole DNS filtering (1.6M+ domains)
  • Iranian domain blocking (131,576+ domains)
  • Iranian IP blocking (763 CIDRs)
  • DNS-over-HTTPS (Cloudflare)
  • IPv6 leak prevention
Home Devices → DNS to Pi → Pi-hole → Cloudflared → Internet
                              ↓
                    Iranian domains blocked

Singleton (WiFi AP + Proxy)

View Singleton Documentation →

A self-contained WiFi access point with built-in proxy support for VLESS/VMess protocols.

Best for:

  • Users needing isolated WiFi network
  • Proxy protocol support (anti-DPI)
  • Single-device deployment

Features:

  • Isolated WiFi network (10.50.0.0/24)
  • Pi-hole DNS filtering (1.6M+ domains)
  • 3x-UI/Xray proxy (VLESS/VMess/Reality)
  • Iranian IP/domain blocking
  • DNS-over-HTTPS
WiFi Clients → WiFi AP → Pi-hole → nftables → Xray Proxy → Internet
                            ↓           ↓
                    DNS filtered   Iranian IPs blocked

Triangle (WiFi AP + VPN)

View Triangle Documentation →

A distributed architecture with WireGuard VPN tunnel to a VPS, providing IP masking and kill switch.

Best for:

  • Maximum privacy protection
  • Geographic IP masking
  • ISP surveillance protection

Features:

  • WireGuard VPN tunnel to VPS
  • Double Pi-hole (Pi + VPS)
  • All traffic exits via VPS IP
  • Kill switch (blocks if tunnel fails)
  • Iranian IP/domain blocking on both nodes
WiFi Clients → WiFi AP → Pi-hole → WireGuard → VPS Pi-hole → Internet
                            ↓                       ↓
                    DNS filtered (2x)      Traffic exits via VPS IP

Protection Comparison

Leak Protection Matrix

Leak Type Sifter Singleton Triangle
DNS Leak ✅ DoH ✅ DoH ✅ Double DoH
IPv6 Leak ✅ Disabled ✅ Disabled ✅ Disabled
Iranian Domain ✅ 131K+ ✅ 131K+ ✅ 131K+
Iranian IP ✅ 763 CIDRs ✅ 763 CIDRs ✅ 763 CIDRs
Cookie Correlation ✅ Blocked ✅ Blocked ✅ Blocked
WebRTC Leak ⚠️ Browser ⚠️ Browser ⚠️ Browser
IP Masking ❌ ❌ ✅ VPS IP
Kill Switch ❌ ❌ ✅
DPI Resistance ❌ ✅ Reality ✅ WireGuard

Network vs Browser Protection

All architectures protect at the network level (automatic), but some threats require browser configuration (manual):

NETWORK LEVEL (Automatic):
├── DNS filtering (Pi-hole)
├── Iranian domain blocking (131K+)
├── Iranian IP blocking (763 CIDRs)
├── DNS encryption (DoH)
└── IPv6 blocking

BROWSER LEVEL (User must configure):
├── WebRTC leak prevention
├── Canvas/WebGL fingerprinting
├── Cookie management
└── JavaScript fingerprinting

MikroTik vs Raspberry Pi Comparison

Some users may ask if a MikroTik router can provide the same protection. While MikroTik is excellent networking hardware, it has critical limitations for this privacy protection use case:

Feature MikroTik Raspberry Pi Winner
DNS Blocking (1.6M+ domains) ❌ Max ~100K ✅ 1.6M+ unlimited Raspberry Pi
Iranian Domain Blocking (131K+) ❌ Insufficient resources ✅ Full support Raspberry Pi
DNS-over-HTTPS (DoH) ⚠️ Limited (v7+ only) ✅ Full (Cloudflared) Raspberry Pi
VLESS/VMess Proxy ❌ Not supported ✅ Xray with Reality Raspberry Pi
Reality Protocol (Anti-DPI) ❌ Not supported ✅ Full support Raspberry Pi
WireGuard VPN ✅ Supported ✅ Full support Tie
Double DNS Filtering ❌ Complex ✅ Easy (Pi + VPS) Raspberry Pi
Iranian IP Blocking (763 CIDRs) ✅ Supported ✅ Supported Tie
Web Management ✅ WebFig/WinBox ✅ Pi-hole/3x-UI Tie
Power Consumption ✅ ~5W ⚠️ ~10-15W MikroTik
Cost ~$50-100 ~$80-120 (Pi 5 + SD) Tie
Software Flexibility ⚠️ RouterOS limited ✅ Full Linux Raspberry Pi

Key MikroTik Limitations

1. DNS Blocklist Capacity

MikroTik devices have hardware limits on DNS regex entries:

  • Entry-level models: ~10,000 entries
  • Mid-range models: ~50,000 entries
  • High-end models: ~100,000 entries

Our use case requires:

  • Pi-hole blocklists: 1.6M+ domains
  • Iranian domains: 131,576+ domains
  • Total: Need 1.7M+ domain capacity

2. No Proxy Protocol Support

MikroTik cannot:

  • Run VLESS/VMess proxies
  • Implement Reality protocol (anti-DPI)
  • Act as Xray endpoint
  • Provide application-layer obfuscation

3. DoH Limitations

  • Only RouterOS v7+ supports DoH
  • More complex configuration than Cloudflared
  • Lower performance under heavy load

When MikroTik Is Suitable

MikroTik is excellent for:

  • ✅ Simple DNS filtering (thousands, not millions)
  • ✅ WireGuard/IPsec routing
  • ✅ Bandwidth management and QoS
  • ✅ Enterprise networks with advanced switching
  • ✅ Implementations needing IP blocking only

For our specific scenario (Starlink identity protection with comprehensive DNS filtering, Iranian domains, and proxy obfuscation), Raspberry Pi is the only practical choice.

Quick Start

Choose Your Architecture

  1. Sifter - If you want DNS-only protection with minimal setup
  2. Singleton - If you want WiFi AP with proxy support
  3. Triangle - If you want maximum protection with VPN and kill switch

Hardware Requirements

Component Minimum Recommended
Raspberry Pi Pi 3B+ Pi 5 (4GB)
MicroSD Card 16GB Class 10 32GB A2
Ethernet 100Mbps 1Gbps
Power Supply 5V 2.5A 5V 5A (Pi 5)
VPS (Triangle only) 512MB RAM 1GB+ RAM

Software Requirements

  • Raspberry Pi OS (Debian 13 "Trixie" or newer)
  • Ansible 2.9+ on control machine
  • SSH access to Raspberry Pi

Directory Structure

javid-mask/
├── README.md                 # This file
├── README.fa.md              # Persian documentation
│
├── sifter/                   # DNS-Only Architecture
│   ├── README.md
│   ├── README.fa.md
│   ├── ansible/
│   └── diagrams/
│
├── singleton/                # WiFi AP + Proxy Architecture
│   ├── README.md
│   ├── README.fa.md
│   ├── ansible/
│   └── diagrams/
│
└── triangle/                 # WiFi AP + VPN Architecture
    ├── README.md
    ├── README.fa.md
    ├── ansible/
    └── diagrams/

Iranian Domain & IP Sources

All architectures use the same comprehensive blocklists:

Source Type Count Updates
bootmortis/iran-hosted-domains Domains 131,576+ Weekly
liketolivefree/iran_domain-ip Domains ~50,000 Weekly
herrbischoff/country-ip-blocks IPs 763 CIDRs Daily

Browser Hardening (Required for All Architectures)

Network-level protection blocks Iranian connections, but browser-level threats require manual configuration:

Firefox (Recommended)

about:config settings:
├── media.peerconnection.enabled → false     (Disable WebRTC)
├── privacy.resistFingerprinting → true      (Anti-fingerprinting)
├── network.dns.disableIPv6 → true           (Disable IPv6 DNS)
├── geo.enabled → false                      (Disable geolocation)
└── privacy.trackingprotection.enabled → true

Recommended Extensions

Extension Purpose
uBlock Origin Ad/tracker blocking, WebRTC control
NoScript JavaScript control
Cookie AutoDelete Automatic cookie cleanup

Licence

MIT Licence

Copyright (c) 2026 Iman Samizadeh

Credits

Maintainer: Iman Samizadeh Project: javid-mask (Starlink Privacy Protection Suite)

About

Privacy Protection Suite for Starlink Users in Iran

Topics

dns raspberry-pi ansible privacy proxy pi-hole vps pi vpn ip iran dns-over-https pi-hole-blocklists vps-setup pi-hole-lists dns-filter starlink ip-ban raspberry-pi-5 iran-domain

Resources

Readme

License

MIT license
Activity

Stars

3 stars

Watchers

0 watching

Forks

1 fork
Report repository

Releases

No releases published

Packages

No packages published

Languages