Network configuration: Preventing my computer being used as a proxy?

Question

I recently installed an extension for Chrome called Hola (skip to next paragraph if you know it). It calls itself a VPN, but is basically a proxy pool AFAIK. You can choose a country from a list in a per website basis and your connection to that website comes from an IP from the selected country from there onwards. Meanwhile, you serve as a proxy for other users.

I tried using it at my uni but it was stuck at "initializing", and after a few tests (different browsers, different computers) I could only conclude that it was being blocked somehow. Which made me wonder: My computer is in a vulnerable position if it can be used by others as a proxy, possibly without my knowledge. So I was wondering which aspect of my network I need to configure in order to avoid this kind of thing. I am currently using this script to generate my firewall rules (iptables):

# Flush all rules
iptables -F
iptables -X

# Allow unlimited traffic on localhost (breaks MPI programs otherwise)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A FORWARD -o lo -j ACCEPT

# Allow SSH traffic
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow incomming traffic from estabilished and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Policy: Allow outgoing, deny incoming and forwarding
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP

I imagined the drop policy in "forward" would be enough, but it doesn't seem so. Is there anything I can do at the firewall level to block things like Hola? If not, what should I be doing?

Answer 1

Your question of why the forward rule doesn't work is essentially a networking question, so I'll explain using an analogy. Imagine there are three people involved in the sending of a letter - Alice, Bob, and you. Alice wants to get a message to Bob, but using you as a middleman (proxy). Alice could use one of two techniques:

Method 1: Write a letter containing the message, stick it in an envelope, and address the envelope to Bob. However, instead of giving the envelope directly to Bob, she drops it off on your doorstep. She hopes you'll be kind enough to find it, recognize that the envelope isn't addressed to you, and find Bob to give it to him.

Method 2: Write a letter, to you, that says: "Can you find Bob and tell him [message]?" Stick the letter in an envelope, and address the envelope to you. You (or perhaps the Hola app running on your computer) open the envelope, read the letter, and tell Bob the message.

Firewalls are rather dumb, in that they can only understand basic information like Source IP, Destination IP, port, and some other bits of metadata. They can't actually understand the contents of the packets. It's analogous to only being able to look at the outside of the envelope, without being able to read the letter inside. So even though both of the above methods would result in the same outcome (in essence, Alice getting a message to Bob using you as a proxy), the forward chain only recognizes the first one as forwarding. As far as the firewall is concerned, in the second case Alice and you are the only parties involved in the conversation. It has no idea of Bob's involvement, as it would need to "read" the letter to know that.

As far as blocking Hola, it seems that Hola traffic can be detected, but you'll need a tool that can "read the letter," so to speak, by performing deep packet inspection and application layer filtering. Usually this is accomplished using an intrusion detection system as opposed to a basic firewall, and I suspect it's how your uni is blocking Hola. If you don't want your computer used as a proxy, your best bet would be to just not use Hola.