0

Trying to set up Tor transparent proxy on a separate machine with two interfaces which is working like a gateway:
Workstation -> (wlan0) Gateway Tor Proxy (wlan1) -> Internet
I took an iptables configuration from Tor website. The problem it is not working and blocking traffic. I found out that these commands near to the end are blocking (when I comment them all is good):

sudo iptables -A INPUT -j DROP
sudo iptables -A FORWARD -j DROP
...
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT DROP

I marked it in the code below with '#----------- if I leave this, all traffic is blocked:' Please advise what is wrong.

### set variables
#the UID that Tor runs as (varies from system to system)
_tor_uid="109"

#Tor's TransPort
_trans_port="9040"

#Tor's DNSPort
_dns_port="5353"

#Tor's VirtualAddrNetworkIPv4
_virt_addr="10.192.0.0/10"

#your outgoing and incoming interfaces
_out_if="wlan1"
_inc_if="wlan0"

#LAN destinations that shouldn't be routed through Tor
_non_tor="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"

#Other IANA reserved blocks (These are not processed by tor and dropped by default)
_resv_iana="0.0.0.0/8 100.64.0.0/10 169.254.0.0/16 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3"

### Don't lock yourself out after the flush
#sudo iptables -P INPUT ACCEPT
#sudo iptables -P OUTPUT ACCEPT

### flush iptables
sudo iptables -F
sudo iptables -t nat -F

### set iptables *nat
#*nat PREROUTING (For middlebox)
sudo iptables -t nat -A PREROUTING -d $_virt_addr -i $_inc_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
sudo iptables -t nat -A PREROUTING -i $_inc_if -p udp --dport 5353 -j REDIRECT --to-ports $_dns_port
sudo iptables -t nat -A PREROUTING -i $_inc_if -p udp --dport 53 -j REDIRECT --to-ports $_dns_port


#allow lan access for hosts in $_non_tor
for _lan in $_non_tor; do
   sudo iptables -t nat -A PREROUTING -i $_inc_if -d $_lan -j RETURN
done


for _iana in $_resv_iana; do
   sudo iptables -t nat -A PREROUTING -i $_inc_if -d $_iana -j RETURN
done

sudo iptables -t nat -A PREROUTING -i $_inc_if -p tcp --syn -j REDIRECT --to-ports $_trans_port

# additional:    
sudo iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP
sudo iptables -A OUTPUT -m state --state INVALID -j DROP
sudo iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP
sudo iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP


#*nat OUTPUT (For local redirection)
sudo iptables -t nat -A OUTPUT -d $_virt_addr -p tcp --syn -j REDIRECT --to-ports $_trans_port
sudo iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports $_dns_port
sudo iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
sudo iptables -t nat -A OUTPUT -o lo -j RETURN


#allow lan access for hosts in $_non_tor
for _lan in $_non_tor; do
   sudo iptables -t nat -A OUTPUT -d $_lan -j RETURN
done

for _lan in $_resv_iana; do
   sudo iptables -t nat -A OUTPUT -d $_lan -j RETURN
done

#redirect all other pre-routing and output to Tor
sudo iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port


### set iptables *filter
#*filter INPUT
sudo iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT


#Don't forget to grant yourself ssh access for remote machines before the DROP.
#iptables -A INPUT -i $_out_if -p tcp --dport 22 -m state --state NEW -j ACCEPT

#----------- if I leave this, all traffic is blocked:
sudo iptables -A INPUT -j DROP

#*filter FORWARD
#----------- if I leave this, all traffic is blocked:
sudo iptables -A FORWARD -j DROP


#*filter OUTPUT
sudo iptables -A OUTPUT -m state --state INVALID -j DROP
sudo iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT

#allow Tor process output
sudo iptables -A OUTPUT -o $_out_if -m owner --uid-owner $_tor_uid -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT

#allow loopback output
sudo iptables -A OUTPUT -d 127.0.0.1/32 -o lo -j ACCEPT

#tor transproxy magic
sudo iptables -A OUTPUT -d 127.0.0.1/32 -p tcp --syn --dport $_trans_port -j ACCEPT

#allow lan access for hosts in $_non_tor
for _lan in $_non_tor; do
 sudo iptables -A OUTPUT -d $_lan -j ACCEPT
done

sudo iptables -A OUTPUT -j LOG --log-prefix "Dropped OUTPUT packet: " --log-level 7 --log-uid
sudo iptables -A OUTPUT -j DROP


#Set default policies to DROP
#----------- if I leave this, all traffic is blocked:
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT DROP
  • Take a look at Whonix they do this in their iptables configurations. – Kristopher Ives Dec 20 '16 at 9:07
  • Thanks but I do need this config on a router-type equipment where I can't set up Whonix – Gob Dec 21 '16 at 16:04
  • I have discovered that – Gob Dec 21 '16 at 16:05
  • I have discovered that those two rules blocks my connections: iptables -A INPUT -j DROP iptables -P INPUT DROP this is how it is appear in log: Dec 21 15:58:06 rp kernel: [ 7926.905478] Dropped: IN=wlan0 OUT= MAC=b8:27:eb:8c:2d:e4:6c:88:14:71:66:74:08:00 SRC=172.24.1.138 DST=172.24.1.1 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=52545 DF PROTO=UDP SPT=52948 DPT=5353 LEN=34 so it looks like that NAT PREROUTING doesn't applied: iptables -t nat -A PREROUTING -i $_inc_if -p udp --dport 53 -j REDIRECT --to-ports $_dns_port Can anyone explain? – Gob Dec 21 '16 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.