Mastering Network Privacy: Building a Custom Secure Internet Stack

Mastering Network Privacy: Building a Custom Secure Internet StackMastering Network Privacy: Building a Custom Secure Internet Stack

The network for creativity

Join 1.25M professional creatives like you

Connect with clients, get discovered, and run your business 100% commission-free

Creatives on Contra have earned over $150M and we are just getting started

Back to feedPost

Favour Dilichukwu Ozioma

• Jun 8

Initially started this to kill ads, but it ended up becoming a masterclass in network hardening. I am currently winning the war against trackers, but I am losing the battle against Reddit’s bot detection. A small price to pay for a cleaner internet.

Project Overview

Reclaimed network sovereignty by engineering a custom, hardened privacy stack. Tired of pervasive data-mining and tracking, I designed a solution that filters internet traffic at the source, ensuring privacy and security for all connected devices.

Network Architecture Diagram

Client Devices (Always-on VPN) | v WireGuard Encrypted Tunnel (Kill-Switch Enabled) | v Azure VM (Ubuntu 24.04 LTS, Standard_B2ls_v2) | +---> [Unbound DNS (Recursive) + Steven Black Blocklist] | v Clean Internet Traffic (Filtered Ads/Trackers)

Technical Architecture

Infrastructure: Deployed on Azure (Austria East region) using a Standard_B2ls_v2 (2 vcpus, 4 GiB memory) Linux instance.

Network-Level Security Hardening: The VM is secured via Azure Network Security Group (NSG) policies. By explicitly omitting an Inbound Security Rule for Port 22 (SSH), all public SSH access is blocked at the infrastructure level, rendering the VM invisible to public internet brute-force attempts.

Access Paradigm: Remote administration is performed "inside the wire." Management access is only available after establishing an encrypted connection via the WireGuard tunnel (Port 51820).

DNS Privacy (Unbound Recursive Resolver): Configured Unbound as a full recursive DNS resolver without external forwarders. By performing all DNS resolution directly, the system eliminates reliance on third-party upstream providers (like Google or ISP DNS), significantly reducing the potential for external tracking of DNS query patterns.

Client Security & Always-on Connectivity: Configured client devices with "Always-on" VPN functionality to ensure continuous encryption. Implemented a network kill-switch on clients, which explicitly blocks all internet traffic if the VPN connection is dropped, preventing accidental data leaks outside the encrypted tunnel.

Automated Filtering: Leveraged Steven Black’s unified hosts list (169,000+ blocked domains).

Automation: Bash-scripted blocklist management with custom whitelisting and a weekly cron job for automated updates.

Challenges & Learnings

Performance Optimization: Migrated from a GUI-based solution (Pritunl) to a native WireGuard configuration to achieve lower latency and granular system control.

Security Discipline: Managing a headless VM without public SSH access requires precise configuration; the system is optimized for isolation rather than ease-of-use.

Bot Mitigation: High-level privacy filtering often triggers aggressive bot-detection on major platforms (like Reddit), necessitating frequent manual authentication.

Cloud Security Systems Engineering Azure Linux Upbound

Lotte Frieda

• 2d

The client was an outreach-driven professional , either in sales, recruitment, or B2B consulting ... who had built up a substantial LinkedIn network over time but had no organized way to leverage it. Their connections existed only inside LinkedIn's ecosystem, making it impossible to run targeted email campaigns, segment contacts by industry or seniority, or feed prospects into a CRM or outreach tool. Every time they needed to reach out to a specific type of contact ... say, Managing Directors at accounting firms ... they had to manually scroll through their connections one by one. There was no master list, no exportable data, and no way to filter by job title, company, or sector. They were sitting on a goldmine of warm contacts with no infrastructure to mine it.

I extracted, cleaned, and organized the client's full LinkedIn connections data into a structured Google Sheets database with seven clearly labeled columns ... First Name, Surname, Job Title, Company, Email, Phone Number, and a direct LinkedIn Profile Link. Every row was verified and formatted consistently so the data was immediately usable for outreach, CRM import, or campaign segmentation. The spreadsheet covered a diverse range of decision-makers including Managing Directors, Chief Marketing Officers, Head of Sectors, Vice Presidents, Associate Directors, and Business Accountants ... spanning industries from accountancy and consulting to brand management and financial services. Each contact's LinkedIn profile link was embedded directly in the sheet for one-click access, making it easy to personalize outreach before sending. The final deliverable was a clean, filterable, ready-to-use lead database the client could plug straight into any email tool, CRM, or outreach sequence.

The delivered spreadsheet gave the client instant access to a fully organized, actionable contact database that had previously been locked inside LinkedIn's interface. What once required hours of manual searching and copy-pasting was now a single, filterable file the client could sort by job title, company, or industry in seconds. The structured format meant the data could be imported directly into tools like GoHighLevel, HubSpot, Apollo, or Instantly without any reformatting. The client was able to immediately launch targeted email and LinkedIn outreach campaigns to specific segments ... for example, filtering only Managing Directors in the accounting sector for a specific service pitch. By turning a passive network into an active, organized lead database, the client gained a concrete outreach asset that could generate pipeline on demand ... making every future campaign faster, more targeted, and significantly more effective.

Data Entry Microsoft Excel

Geethasree Naguboina

pro

• 1d

This is such a clean breakdown of a real client problem — the "goldmine with no infrastructure" framing is exactly right. So many professionals have hundreds of warm connections they've never been able to act on systematically.

I do similar work — extracting, cleaning and...

Seif Ahmed

• Jun 8

Working on BlockSocial, the ultimate private social network!🚀

socialmedia socialnetwork

Seif Ahmed

• Jun 8

Hey everyone! Feel free to drop your feedback or any ideas for improvement below. 🔥

Lotte Frieda

• 2d

The client was a coaching business running paid ads and generating inbound leads through their funnel ... but the follow-up process was entirely manual. Their team was copy-pasting emails, forgetting to send WhatsApp messages, and had no consistent system for nurturing prospects who didn't buy immediately. Leads were going cold within 24–48 hours because there was no structured sequence to keep them warm. There was also no intelligent branching ... every lead was treated the same regardless of whether they had replied or engaged. The result was a leaking pipeline: they were spending money to attract leads and then losing them through sheer inaction. They needed a fully automated nurture system that could follow up, adapt to lead behavior, and close the gap between interest and conversion ... without requiring manual effort from the team.

I built a fully automated nurturing sequence inside GoHighLevel (HostProtect) that combined email, WhatsApp, timed wait steps, and conditional branching into one intelligent workflow. The sequence was designed to engage leads across multiple touchpoints ... starting with an initial email and wait step, followed by a second email, then a WhatsApp message for higher-intent outreach, and a further email series timed to maximize open rates. The critical feature was a conditional logic node that evaluated whether the contact had replied at any point. If they had, the workflow routed them into a live branch for personalized follow-up. If none of the conditions were met, the sequence gracefully exited rather than over-messaging unresponsive leads. This protected sender reputation and kept the pipeline clean. Every step was mapped, tested, and labeled clearly so the client's team could manage and update the workflow independently going forward.

The completed workflow transformed the client's follow-up process from a manual, inconsistent effort into a reliable, always-on nurture machine. Leads entering the funnel were now automatically walked through a structured multi-channel sequence ... receiving the right message at the right time without any manual intervention. The conditional branching meant that engaged leads were identified and fast-tracked for personal outreach, while unresponsive contacts were exited cleanly without damaging deliverability. The client's team went from spending hours chasing leads to simply monitoring the pipeline as the system did the work. Response rates improved because touchpoints were timely and varied across email and WhatsApp rather than relying on a single channel. The business now had a scalable, repeatable follow-up process that worked around the clock ... turning cold leads into warm conversations and warm conversations into closed clients.