Sys-myst: residential proxies for negligible cost get around tor/vpn hating websites with mysterium network proxyvm

Community Guides
1

Mysterium Network is a decentralized network of computers that provides proxy services. It runs on the polygon blockchain and uses MYST token. Here is how you can set it up as a proxyvm.

Install qubes-core-agent-networking

download the dpkg myst_linux_amd64.deb from github. Install with ‘dpkg -i myst_linux_amd64.deb’. Install dependencies with ‘apt install -f’.

Because we are only using the client and not running a node disable the node service and start the consumer service

systemctl mask mysterium-node && systemctl enable mysterium-consumer

also edit the defaults for myst service in /etc/default/mysterium-node

Define additional args for myst service (see myst --help for full list)

CONF_DIR=“–config-dir=/etc/mysterium-node”
SCRIPT_DIR=“–script-dir=/etc/mysterium-node”
RUN_DIR=“–runtime-dir=/var/run/mysterium-node”
DATA_DIR=“–data-dir=/var/lib/mysterium-node”
DAEMON_OPTS=“–log-level=disabled --ui.enable=false --firewall.killSwitch.always --keystore.lightweight --consumer”
SERVICE_OPTS=“”

go to /usr/lib/systemd/system/mysterium-consumer.service and comment out Requires and After network-online.target. This makes the service start after boot it doesn’t have to wait.

add to rc.local in proxyvm
echo ‘nameserver 9.9.9.9’ > /etc/resolv.conf
python3 /usr/lib/qubes/qubes-setup-dnat-to-ns

overriding the dns 9.9.9.9 is used since it is widely used and ends up to be around the same location as the proxy

installing myst also installs the myst cli.

To register an identity you will need MYST token on the polygon network. Make sure to send it to the Channel address of the identity and not the identity itself

identities new (password)
identities unlock 0x… (password)
identities register 0x…
identities get 0x… (this is where you can see the channel address)

the file where your identity is saved in is in /var/lib/mysterium-node/keystore this file must be moved to the templatevm to be preserved.

I have also provided some scripts to better integrate here. connect-myst should be moved to bin in sys-myst. the files in qubes-rpc/appvm should be moved to /etc/qubes-rpc in sys-myst. myst.Notify should be moved to /etc/qubes-rpc in dom0.

the python scripts expect a python virtual environment. To install:
python -m venv ‘.venv’
source ‘.venv/bin/activate’
pip install -r requirements.txt

this allows other qubes to start a connection or connect to a specific provider or get connection details. also enables notifications since it takes a while to connect.

1 Like
Can i create a reddit.com account that doesn´t get automatically banned using qubes OS4.3.0?
2

Thank you. I have never heard of Mysterium until now.

Is there a way to do all this behind Tor instead of clearnet, so that Mysterium simply “unfilters” the hosts that would not allow incoming Tor connections?

1 Like
3

Yes you should be able to put this behind sys-whonix and whatever browser qube you have behind that:

browser > sys-myst > sys-whonix

while whonix-ws is still:

whonix-ws > sys-whonix

everything in browser would first go through tor then the residential proxy and whatever website you are visiting would see the residential proxy

4

I am a little confused as this:

browser > sys-myst > sys-whonix

seems contrary to:

while whonix-ws is still:

whonix-ws > sys-whonix

everything in browser would first go through tor then the residential proxy and whatever website you are visiting would see the residential proxy

What I am looking for is:

VM → sys-whonix → sys-myst → destination censored host

Could you please clarify the answer?

5

with VM > sys-whonix > sys-myst > destination

Sys-whonix will apply Tor encryption to the VM traffic. Then sys-myst will apply its wireguard encryption to the encrypted Tor traffic and send it to the residential proxy.

On the other side the residential proxy will remove the wireguard encryption before sending the encrypted Tor traffic to the Tor entry node. The result of this is the censored host will still see the Tor exit node as the source IP address.

This setup is if you want to hide your actual IP from the Tor entry node.

6

The result of this is the censored host will still see the Tor exit node as the source IP address.

That is identical to simply using Tor. What is the role of MYST then?

IIUC, the role of mysterium to hide the originating address (with which the client initiates the connection), thus allowing access to the destination host through a different (myst) address. Am I missing something?

This setup is if you want to hide your actual IP from the Tor entry node.

My goal is to hide the actual (ISP provided) address from the MYST proxy and still be able to access hosts that are not accessible through Tor, AKA Tor unfiltering.

7

Right, so browser > sys-myst > sys-whonix is the way to go.
the MYST proxy would see the address of the Tor exit node and any websites you visit would see the address of the residential proxy

8

Thanks. I will have to test this.

9

How do i top this up so i can activate it?

I sent $10 on polygon of MYST to both the identity address and channel address from myst cli and nothing shows in balance. Did i do it wrong? Is it ETH MYST?

10

Did it work for you? I am interested in this.

11

Haven’t had the time to test yet.