A pocket router nothing leaks past
Portable hardened stand
OpenWrtAmneziaWGnftablesCudy TR3000What it is
A pocket router hides all traffic from the attached device inside an obfuscated tunnel and prevents anything from leaking around it. The uplink is a phone over USB tethering — no SIM in the router. Framed honestly: the goal is to substantially raise the detection threshold and the cost of analysis, not to promise untraceability.
Proof
$ nft list chain inet fw4 forward
oifname != "awg0" counter drop
# nothing leaves outside the tunnel, DNS included
Layers of defence
01AmneziaWG 2.0 tunnel
Obfuscation (junk packets, magic headers) for resistance to DPI classification at intermediate nodes.
02Kill-switch, fail-closed
If the VPN drops, the LAB segment goes offline honestly — zero traffic leaks into the mobile network. nftables routes the segment to the tunnel only.
03DNS-lock & IPv6-off
DNS is intercepted and locked to the tunnel resolver; IPv6 is off on WAN and LAN so it can't bypass the tunnel.
04Lower device signature
TTL normalization, MAC randomization on the USB uplink, Wi-Fi off — the carrier sees less of a recognizable sharing point.
A combined auto-validator scores 10/10 PASS on the live router. Honest boundaries stated: TTL is applied but can't be confirmed from our side, and the stand does not protect against server compromise or the phone's radio identity at the carrier.