Plug-and-Play VPN router and unblocker
black.box
is a VPN policy routing appliance, which runs on ARMv7
CPU equipped Raspberry Pi, DD-WRT routers and other[n8] devices.
Unzoner
is a subscription-based service, designed specifically for Internet content un-blocking. Together, they un-block video streaming content across tablets, smartphones, desktops, laptops and TVs over Wi-Fi or LAN. Unzoner subscriptions can also be created manually for use with compatible software, such as Tunnelblick and Kodi.
š Raspberry Pi 4 (aarch64) BETA support is out now, get your Pi!
TL;DR find a Raspbery Pi and flash it with RPi3/armv7hf or RPi4/aarch64 image or try this on a PC or router
Due to a PayPal limitation, subscriptions are not available in Germany (and China), please use Bitcoin instead or find a way to create PayPal accounts in other region(s).
black.box
(passphrase: blackbox
) or set your default gateway to the black.box
LAN IP (LAN mode) as shown on the dashblack.box
devices operate in three distinct modes. Devices connected to the black.box
Wi-Fi network or routed via the deviceās Ethernet (LAN) IP address, can (a) typically access popular streaming services from anywhere in the world; (b) to provide privacy and anonymity via 3rd party VPN providers; or (c) etablish private VPN links between two or more locations. Application source code is available at https://github.com/ab77/black.box/tree/master/src under the MIT license.
+---------+ +-----------------+
| iOS | Wi-Fi | | Google, Facebook, etc.
| Android | +-----> | black.box | +--------------------->
| | | --------- |
+---------+ | VPN policy |
| router |
+---------+ | --------- |
| macOS | Wi-Fi | VirtualBox |
| Windows | +-----> | DD-WRT |
| Linux | LAN | QEMU |
| Kodi | | Raspberry Pi |
+---------+ | etc. |
| --------- |
| Sling TV | +----------+
| Netflix | tunnel | |
| Hulu | +--------> | Exit US +----+
| etc. | | | |
| | +-----+----+ UK |
+-----------------+ | |
+----------+
In the default un-blocking mode, coupled with an active unzoner subscription, black.box
device allows access to popular streaming services in the target region from anywhere in the world. In this mode, the device additionally supports obfuscation/cloaking, in order to function in hostile deep packet inspection (DPI) environments, as well as experimental WAN acceleration mode.
PayPal subscription or Bitcoin credit is required to create a subscription. Subscriptions are priced at ā¬9.95 per month, with initial 1 month free (if paid by PayPal). PayPal subscriptions can be cancelled at any time.
Alternatively, pay up-front using Bitcoin for as much time as you need. Price quoted based on EUR/BTC exchange rate. Top-up at any point prior to the existing Bitcoin credit expiry, or after. Any unused Bitcoin credit will be rolled over if topping up prior to existing credit expiry. Topping up after credit expiry will strike a new exchange rate.
For performance reasons, un-blocking traffic is not encrypted[n4]. When policy routing is enabled (default), all traffic goes out via the local Internet interface, except for selected services. When disabled, all traffic is sent via the tunnel, except for selected services. For security reasons, the tunnel interface may be restricted to only allow specific network ports[n1] for streaming, while the local interface is always unrestricted.
In VPN mode, the device supports a number of popular VPN services, such as VPNArea and Private Internet Access. Separate subscriptions/accounts required to access supported VPN services.
In the server pairing mode, multiple devices can be used to establish private encrypted links. Leave one at home/office and dial back in securely when travelling or on holidays to access the Internet via the device in server mode. Unzoner
subscription is currently not required in this mode. LAN(s) behind server devices are not accessible (WAN only).
Once the device is running, the dash is accessible by navigating to http://blackbox.local/ while connected to the black.box
Wi-Fi network or from the LAN. Please do not share your device GUID(s) (the long alpa-numeric string you see in the dash URL) as they are effectively credentials for anyone to access your devices settings and modify them. So, keep them secret.
A live demo dashboard is available here.
If multiple regions are available to un-block, click a country flag in the top right corner of the dash. The device will re-boot with the new settings and un-block the selected country.
A number of popular services can be selected on the dash. If the service you require is missing please, email support, IRC channel #netflix-proxy on Freenode or use the live chat link on the dash to request it. Also, disabling Policy Routing
(optionally disabling Local DNS
) as well as setting all Services
to none
will make unknown services work.
Please visit PayPal to cancel your black.box
subscription.
If you donāt have a compatible device, or waiting for one to arrive, you can use your PC with QEMU or Oracle VirtualBox to run black.box
.
You can always configure compatible software on your PC, such as Tunnelblick for use with Unzoner without advanced features, such as policy based routing.
Homebrew
or MacPorts
(we just need the qemu-img
tool)brew install qemu || sudo port install qemu
mkdir -p ~/black.box\
&& cd ~/black.box\
&& wget https://s3.eu-central-1.amazonaws.com/belodetech/blackbox-qemux86_64.img.gz\
&& gunzip blackbox-qemux86_64.img.gz\
&& qemu-img resize -f raw blackbox-qemux86_64.img +2G\
&& VBoxManage convertfromraw blackbox-qemux86_64.img blackbox-qemux86_64.vdi --variant Fixed\
&& rm blackbox-qemux86_64.img
Linux 2.6 / 3.x / 4.x (64-bit)
VM called black.box
and select the blackbox-qemux86_64.vdi
imageNetwork
to Bridged Adapter
mode and select appropriate uplinkHomebrew
or MacPorts
(brew install qemu || sudo port install qemu)\
&& (brew install tuntap || sudo port install tuntaposx)
launchctl load -w /Library/LaunchDaemons/org.macports.tuntaposx.plist
mkdir -p ~/black.box\
&& cd ~/black.box\
&& wget https://s3.eu-central-1.amazonaws.com/belodetech/blackbox-qemux86_64.img.gz\
&& gunzip blackbox-qemux86_64.img.gz\
&& qemu-img resize -f raw blackbox-qemux86_64.img +2G
System Preferences > Network > Manage Virtual Interfaces
, create bridge1
and add Thunderbolt Ethernet
interface to itcat << EOF > qemu-ifup.sh
#!/bin/bash
ifconfig bridge1 addm \$1
EOF
cat << EOF > qemu-ifdown.sh
#!/bin/bash
ifconfig bridge1 deletem \$1
EOF
chmod +x qemu-ifup.sh qemu-ifdown.sh
sudo qemu-system-x86_64\
-nographic\
-drive file=blackbox-qemux86_64.img,media=disk,cache=none,format=raw\
-net nic,model=virtio,macaddr=$(echo -n "06:" ; openssl rand -hex 5 | sed 's/\(..\)/\1:/g; s/.$//')\
-net tap,script=qemu-ifup.sh,downscript=qemu-ifdown.sh\
-machine type=pc\
-m 1024\
-smp 2
if your screen devices are on the same L2 bridge as the QEMU VM, ensure DNS is pointing to the gateway IP.
mkdir -p ~/black.box\
&& cd ~/black.box\
&& wget https://s3.eu-central-1.amazonaws.com/belodetech/blackbox-qemux86_64.img.gz\
&& gunzip blackbox-qemux86_64.img.gz\
&& qemu-img resize -f raw blackbox-qemux86_64.img +2G
mkdir -p /etc/qemu\
&& echo "allow virbr0" > /etc/qemu/bridge.conf
sudo qemu-system-x86_64\
-daemonize\
-enable-kvm\
-display none\
-drive file=blackbox-qemux86_64.img,media=disk,cache=none,format=raw\
-net nic,model=virtio,macaddr=$(echo -n "06:" ; openssl rand -hex 5 | sed 's/\(..\)/\1:/g; s/.$//')\
-net bridge,br=virbr0\
-machine type=pc\
-m 1024\
-smp 2
if your screen devices are on the same L2 bridge as the QEMU VM, ensure DNS is pointing to the gateway IP.
Support for DD-WRT is available without advanced features (e.g. policy based routing) enjoyed by other device types. Requires compatible router board and firmware version.
To install black.box Unzoner MyPage extension:
DD-WRT
firmware (ensure cURL
and OpenVPN v2.4
are present in the installed firmware)Native IPv6 from ISP
under Setup -> IPv6
Administration -> Commands
page and runcurl --silent https://dd-wrt.unzoner.com/ddwrt | sh
Status -> MyPage
, sign-up and connectSupport for Kodi is available without advanced features (e.g. policy based routing) enjoyed by other device types. Requires OpenVPN v2.4 or later.
To install and connect:
blackbox
VPN providerSupport for Tunnelblick as well as OpenVPN Windows client(s) is available without advanced features (e.g. policy based routing) enjoyed by other device types. Requires OpenVPN v2.4 or later.
To install and connect:
blackbox
VPN profile for your desired region, import it into Tunnelblick and connectSupport for OpenVPN Connect on iOS is available without advanced features (e.g. policy based routing) enjoyed by other device types.
To install and connect:
blackbox
VPN profile (TCP) for your desired regionSupport for OpenVPN Connect on Android is available without advanced features (e.g. policy based routing) enjoyed by other device types.
To install and connect:
blackbox
VPN profile (TCP) for your desired regionSupport for Tomato flashed routers is planned in the future.
black.box
appliances can functions in a number of modes. In the default un-blocking
mode, the device automatically connects to the least busy black.box
exit-node in the target region and routes traffic through the tunnel, while advertising a local Wi-Fi AP to all consumer devices within range.
In server
mode, the device advertises its private GUID
and listens for incoming VPN connections from paired device(s). Device(s) in paired
mode, which have specified the private GUID
in their configuration, locate and connect to the server
node, while advertising a local Wi-Fi AP to all consumer devices within range. This mode is useful for establishing point to point links betwen two of more locations.
In VPN
mode, the device supports connecting to a number of popular VPN services, such as PIA, VPNArea and VanishedVPN. Additional VPN providers can be easily integrated.
There are two more system modes the device can function in, namely exit-node
and double-vpn
. These are suitable for white-labelling of the black.box
service and are not available via the dash. In exit-node
mode, black.box
devices advertise themselves to devices running in un-blocking
mode. This mode is useful for deploying black.box
exit-nodes anywhere in the world with an Internet connection and a power socket. In double-vpn
mode, devices both listen for incoming VPN client connections, as well as establish a outbound connection to a down-stream VPN server.
black.box
devices run on ResinOS, using resin.io management back-end. OpenVPN 2.4 is used for building black.box
VPN tunnels, whether encrypted or otherwise. OpenSSL is compiled with NEON support to accelerate certain cryptographic functions on the ARMv7
CPUs and linked with OpenVPN. Stunnel and WANProxy are use for obfuscation and/or acceleration. You can expect to get anywhere from 5Mbit/s to 10Mbit/s through the Pi Ethernet interface in unblocking mode and less in VPN mode. VPN providers which use default SHA1 authentication should be a little faster, due to ARMv7 NEON optimisations.
Python 2.7 is used for the main application, together with Linux Bash shell scripts to help interface with the operating system. All Python code is compiled into executables using Nuitka on dynamically provisioned Digital Ocean Droplets for both armv7l
(QEMU) and x86_64
architectures and shipped to devices in a secure manner, by first encrypting the payload using OpenSSL. Devices are managed using resin.io
IoT infrastructure, which runs the black.box
code inside Docker containers on custom ResinOS images. All runtime code is unpacked onto encrypted disk partitions inside Docker containers with all transient data stored in memory only and disk encryption keys never recorded.
Amazon AWS (EBS) is used to host both the black.box
API (demo) and the device dashboard (demo), which are implemented in Python-Flask and Bootstrap. Amazon RDS is used for transient data storage, persisting for no longer than one hour, and Redis is used for caching.
For subscriptions, the black.box
API talks to the PayPal Subscriptions API to set-up monthly subscriptions. For Bitcoin payments, the BlockCypher API provides nesessary WebHooks to advise the black.box
API when a payment has been received as well as a WebSocket notification for the dashboard. No Bitcoin payment provider (middle-man) is used in the Bitcoin payment flow.
Additional management VPS is used to provide ipinfo
support services as well as execute automated headless video playback tests using Selenium WebDriver wrapped in Python.
80/tcp
, 443/tcp
and 53/udp
blackbox.local
from your LAN. If you have multiple black.box
devices on your LAN, the second device will be called blackbox-2.local
, the third blackbox-3.local
and so on. Maximum 5 devices supported.Policy Routing
and Local DNS
on the dash if you are having issues with a particular service. If you have router(s) on your network assigning IPv6 addresses, some IPv6 enabled services may not work (i.e. Netflix). Try disabling IPv6 on your network if this is the case.-- v1.0
© 2016 Unzoner