1. if possible you should install an app-firewall on your phone (eg. netguard or afwall+) and ruthlessly cull any and all convenience software - disable untrusted sources (including the default ones!)

2. assuming you can't eliminate wifi and just use wired networking you must review the security in the wifi-ap that you connect to- if at all possible, directly connect to the admin interface of your wifi-ap using wired networking (avoid using the tethered wifi for this bit if you can):

   • ensure use of the "most secure" wifi protocol available, ie. at a minimum wpa2 and create a new (longest possible) random (high-entropy) pre-shared key
   • change the default admin password to a strong passphrase
   • if possible, disable the admin interface via wifi
   • lower the transmit power (switching to a less congested band may help here)
   • ensure there is no dmz or inbound routes configured
   • ensure wep is disabled
   • if possible, choose a more secure protocol that allows for client and server certificates when establishing the wifi-based link (unlikely on consumer-grade hardware)
   • remember: you need to update the pre-shared key on the phone, and assuming it is still compromised, this new psk will still be available to your adversary (... but that won't matter, because they can access all the packets flowing to and fro anyway!)

1. you're using a firewall on your device which is good - you should also audit the listen servers and open ports running on your device's local os and disable any services that aren't in use

2. since you already have a pre-existing vpn in use now might be a good time to plan getting a new account:

   • consider using your own- or some commercial- wireguard (or equivalent) vpn service provider
   • change your account credentials that you use to connect to your provider as they may have been stolen from your phone
   • (if at all possible don't use the new account credentials from the phone, eg. manually specify the host endpoints and pk-certs)
   • alternatively consider some other form of encrypted point-to-point tunnelling, eg, sshd socks5 proxying
   • ensure all traffic is forced through this tunnel (easier said than done)

3. you've hard-coded your dns service provider which is a step, however, check the following:

   • ensure the dns resolution is configured to occur through the vpn
   • consider the use of a locally installed dns cache that supports dnscurve or equivalent
   • ie. another option is to configure your browsers to prefer the use of dns-over-https (aka doh) resolvers to resolve host ip addies

4. on the topic of your browser:

   • configure it to force the use of https
   • consider using some extension that allows you to limit what 3rd-party resources will be loaded at time of page load, eg. ublock origin or the currently unsupported umatrix (both by the same author)

5. audit the certificate authority store to ensure nothing unexpected, and find out how this gets updated

6. also find out how your host os and other installed software is kept up-to-date automatically - are updates delivered securely?

1. if possible you should install an app-firewall on your phone (eg. netguard or afwall+) 

2. ruthlessly cull any and all pre-bundled or convenience software - disable untrusted sources (including the default ones!)

WIFI ACCESS-POINT IT CONNECTS TO

assuming you can't eliminate wifi and just use wired networking you must review the security in the wifi-ap that you connect to - if at all possible, directly connect to the admin interface of your wifi-ap using wired networking (avoid using the tethered wifi for this bit if you can):

1. change the default admin password to a strong passphrase

   • if possible, permanently disable the admin interface via wifi
   • lower the transmit power (switching to a less congested band may help here)
   • ensure there is no dmz or inbound routes configured
   • if possible, choose a more secure protocol that allows for client and server certificates when establishing the wifi-based link (unlikely on consumer-grade hardware)

2. ensure use of the "most secure" wifi protocol available, ie. at a minimum wpa2

   • create a new (longest possible) random (high-entropy) pre-shared key, eg: https://www.grc.com/passwords.htm Gibson'20
   • ensure wep is disabled
   • also disable wps (pin-code/ wifi protected setup)
   • if possible, choose a more secure protocol that allows for client and server certificates when establishing the wifi-based link (unlikely on consumer-grade hardware)
   • remember: you need to update the pre-shared key on the phone, and assuming it is still compromised, this new psk will still be available to your adversary (... but that won't matter, because they can access all the packets- encrypted or not- flowing to and fro anyway!)

1. you're using a firewall on your device which is good - you should also audit the listen servers and open ports running on your device's local os and disable any services that aren't in use

2. since you already have a pre-existing vpn in use now might be a good time to plan getting a new account:

   • consider using your own- or some commercial- wireguard (or equivalent) vpn service provider
   • change your account credentials that you use to connect to your provider as they may have been stolen from your phone
   • (if at all possible don't use the new account credentials from the phone, eg. manually specify the host endpoints and pk-certs)
   • alternatively consider some other form of encrypted point-to-point tunnelling, eg, sshd socks5 proxying
   • ensure all traffic is forced through this tunnel (easier said than done)

3. you've hard-coded your dns service provider which is a step, however, check the following:

   • ensure the dns resolution is configured to occur through the vpn
   • consider the use of a locally installed dns cache that supports dnscurve or equivalent
   • ie. another option is to configure your browsers to prefer the use of dns-over-https (aka doh) resolvers to resolve host ip addies

4. on the topic of your browser:

   • configure it to force the use of https
   • consider using some extension that allows you to limit what 3rd-party resources will be loaded at time of page load, eg. ublock origin or the currently unsupported umatrix (both by the same author) and configure this to restrict all 3rd party by default
   • review https://browserleaks.com for webrtc leaks

5. audit the certificate authority store to ensure nothing unexpected, and find out how this gets updated

6. also find out how your host os and other installed software is kept up-to-date automatically - are updates delivered securely?