Traffic goes around a configured proxy: where the line falls

You press Test, and a request goes through the proxy to an outside source that names the exit country. Four sources stand in the queue, and the asking stops at the first that answers. An answer means the host is alive, the password fitted and the country known.

Past that the dot promises nothing. The browser decides which connections go through the proxy, and it decides by the wording of the rule, not the colour.

1. 1

   The host answers

   A request reached the proxy and came back.

2. 2

   The country is named

   The exit address arrives from independent sources over a secure link.

3. 3

   Coverage is not promised

   Which schemes go that way, green never says.

The proxy address reaches the browser as one line of rule. Two wordings of that line exist, and the difference costs you all your real traffic.

A line like http=host:port means go through this proxy for http addresses only. Every https address then opens direct, from your home address, with no error shown.

A space at the edge, a scheme in the field, a login in the address: the browser cannot read that line. It does not complain, it goes direct, and the profile reaches the network on your own address.

So a bad address is better met with a refusal. A profile that never opened costs less than one opened on a wrong address.

1. 1

   A space or a path inside

   The browser cannot read that line and applies no proxy.

2. 2

   No connection kind chosen

   The address you typed would vanish whole, password included.

3. 3

   The profile does not start

   A refusal is honest where a direct exit is not.

A profile's proxy can be your own server over SSH, and the browser knows nothing about it. A tunnel is raised beside the profile, and the browser receives a plain socks5 on a local address.

The lock on an unusable proxy knows about SSH separately: if a launch path forgets to raise the tunnel, it runs into the lock and is refused. Quietly going direct with such a proxy is impossible on any path.

So the exit through your own server has two conditions instead of one: the host name and the port have to parse, and the tunnel has to be up before the window opens. Miss either, and the profile does not start.

Voice and video in a browser do not travel as ordinary requests. They open a direct connection between two machines, and it finds the shortest path by itself.

So a page with a call reads your home address while the rest goes through the proxy. One browser setting closes that, forbidding the connection to leave around it.

In the default WebRTC mode the program gives a profile with a proxy a rule for direct connections: no UDP without the proxy. ARMANOS Browser gets it on its launch line and the built-in engine on the profile window, and the page with the call cannot see it; all it sees is the absence of your home address among the candidates.

The rule follows the profile's WebRTC mode. Real leaves it off on purpose, and an extension with the privacy permission can override it; the profile window names such an extension, and Test fingerprint measures with the profile's extensions.

Network diagnostics (Network > Run diagnostics, the WebRTC leak protection row) starts the engine your profiles open with, on a test profile behind a stand-in proxy, and asks for candidates from a STUN server on this computer's local network address: a request that reaches that server went past the proxy. Candidates are parsed line by line, and an address ending in «.local» is not counted as a leak: the browser substitutes it for the home address on its own.

When the measurement fails, the row says so: «Could not be measured». That answer and «No leak: the test request did not go past the proxy» are two different answers, and it does not pass off the first as the second. On a leak the row says the request went straight from this computer, or names the addresses that went around the proxy.

The clock, the languages and the fonts are read straight off the browser, not the request header. They are produced on your machine and never pass through a proxy.

For them to agree with the address, the exit country has to be learned first. The profile asks for it the way it will go later, over a secure connection.

A profile opens the ARMANOS start page, and the exit address sits on it: the one the site will see. A verdict beside it compares that address with your real one.

Addresses that match mean the proxy dropped and work has to stop. When your own real address is unknown, no verdict appears: an invented all good is worse than a blank.

1. 1

   The addresses differ

   The proxy works, and the site is not seeing you.

2. 2

   The addresses match

   The proxy dropped, and the site sees the real you.

3. 3

   Your own address is unknown

   No verdict: a guess here is worse than a blank.

An Android handset hands a page three connection fields a desktop lacks. A site reads them in one line, and a profile without them answers like a desktop.

They have to appear as three, and with values of their own. A host wifi and a host infinity there give a phone profile away as loudly as their absence.

A phone profile does not draw its connection kind by lot but derives it from latency by the browser's own thresholds: from 2010 ms it is slow-2g, from 1420 it is 2g, from 272 it is 3g, below that 4g. The pair «4g at 300 ms latency» does not occur in a real browser, and it will not occur here either.

The bandwidth ceiling comes from the same table the browser uses: 100 for LTE, and 11, 54 or 600 for Wi-Fi. Two rules hold the three fields together: the ceiling is never below the reported speed, and the subtype matches its kind.

A desktop profile gets none of these fields, and that is no omission: a real browser on a desktop has none of them either. An empty field is more honest here than a plausible one.

Open the profile and read the exit address on its start page. Then open any outside page about your address: the country has to be the same.

Then check what travels outside ordinary requests: a call and the profile clock. One value out of line means the site sees the same gap.

1. 1

   Compare two addresses

   The one on the profile's start page and one from outside.

2. 2

   Check the direct connection

   A page with a call shows where that connection leaves.

3. 3

   Line up clock and language

   Country by clock and language has to match the address.