woops, didn't see the last row mentioning debian-tor user, my bad :( good to know about ntp, I'll add it to my own stuff later.
Sorry for the noise, being sick doesn't help much reading iptables rules :/ On 10/21/2014 07:57 PM, elrippo wrote: > Hmmm, at point 5.f.) that's exactly what i propose. Please do not forget > to let your relay do the NTP without TOR, becuase of the latency. > > Read down below.... > > > > --------------------------------------------------------------------------------------------------- > > > > f.) Now let's configure our second scenario, where the middlebox is > handing over to Tor, acting as an ExitRelay and the traffic of the > router is also handed to Tor. > > /etc/tor/torrc > > VirtualAddrNetworkIPv4 172.16.0.0/12 > > TransPort 9040 > > TransPort 192.168.100.1:9040 > > TransPort 192.168.200.1:9040 > > AutomapHostsOnResolve 1 > > DNSPort 9053 > > DNSPort 192.168.100.1:9053 > > DNSPort 192.168.200.1:9053 > > SocksPort 127.0.0.1:9050 > > ControlPort 9051 > > HashedControlPassword 16:somewilddigitsofsomekindofnumbers > > ORPort 9001 > > Nickname PickYourNicknameLikeCounterNSAServer > > ContactInfo Random Person [email protected] > > DirPort 9030 > > DirPortFrontPage /path/to/your/tor-exit-notice.html > > ExitPolicy accept *:22,accept *:80,accept *:443,reject *:* > > /etc/firewall/tor-only.bash > > #!/bin/bash > > modprobe ip_tables > > modprobe ip_nat_ftp > > modprobe ip_nat_irc > > modprobe ip_conntrack > > modprobe ip_conntrack_irc > > modprobe ip_conntrack_ftp > > modprobe ip_nat_ftp > > modprobe ipt_limit > > modprobe ipt_multiport > > modprobe iptable_mangle > > modprobe ipt_state > > modprobe iptable_filter > > modprobe iptable_nat > > modprobe ipt_REJECT > > modprobe ipt_LOG > > modprobe xt_recent > > modprobe ipt_mac > > #################################################################### > > # Remove all rules > > iptables -F > > iptables -X > > iptables -t nat -F > > #################################################################### > > # First set the default behaviour > > iptables -P INPUT DROP > > iptables -P OUTPUT DROP > > iptables -P FORWARD DROP > > #################################################################### > > ################################################################################ > > # INPUT INCOMMING rules for ALL INTERFACES # > > ################################################################################ > > # ALLOW ESTABLISHED and RELATED incoming connections > > iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A INPUT -i wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT > > ################################################################################ > > # OUTPUT OUTGOING rules for ALL INTERFACES # > > ################################################################################ > > iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A OUTPUT -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A OUTPUT -o wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT > > ################################################################################ > > # ALLOW self communication > > iptables -A INPUT -i lo -j ACCEPT > > iptables -A OUTPUT -o lo -j ACCEPT > > ################################################################################ > > # ALLOW incomming connections on our internal interfaces > > iptables -A INPUT -i eth1 -j ACCEPT > > iptables -A INPUT -i wlan0 -j ACCEPT > > iptables -t nat -A PREROUTING -i eth1 -p udp -m udp --dport 123 -j > REDIRECT --to-ports 123 > > iptables -t nat -A PREROUTING -i eth1 -p udp --dport 53 -j REDIRECT > --to-ports 9053 > > iptables -t nat -A PREROUTING -i eth1 -p tcp --syn -j REDIRECT > --to-ports 9040 > > iptables -t nat -A PREROUTING -i wlan0 -p udp -m udp --dport 123 -j > REDIRECT --to-ports 123 > > iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT > --to-ports 9053 > > iptables -t nat -A PREROUTING -i wlan0 -p tcp --syn -j REDIRECT > --to-ports 9040 > > iptables -t nat -A OUTPUT -o lo -j RETURN > > iptables -t nat -A OUTPUT -m owner --uid-owner "debian-tor" -j RETURN > > iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 9053 > > iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports 9040 > > iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > > iptables -A OUTPUT -m owner --uid-owner "debian-tor" -j ACCEPT > > for NET in 127.0.0.0/8; do > > iptables -A OUTPUT -d $NET -j ACCEPT > > done > > iptables -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT > > iptables -A OUTPUT -j REJECT > > Make this script executable and load it on system start. This script > assumes that the Tor instance is also started at system start > > I hope you had some fun anonyminizing your traffic :D > > Read you later ;) > > > --------------------------------------------------------------------------------------------------- > > > > On Dienstag, 21. Oktober 2014, 07:41:15 CJ wrote: > >> > >> On 10/20/2014 06:09 PM, Elrippo wrote: > >> > Try https://elrippoisland.net/public/how_to/anonymity.html > >> > >> hmm, there are some issues with the proposed iptables rules… > >> I'd rather read Mike's blog post[1] and take his scripts in order to > >> lock OUTPUT chain for good, allowing only debian-tor user traffic to go > >> out. Sadly you won't be able to filter out traffic as on Android, as > >> most of the application will run with your own user. But Tor does have > >> his dedicated user, so some magic is still possible in order to prevent > >> any leak. > >> > >> Something like that *should* be OK: > >> > >> # lock down network > >> $ipt -P OUTPUT DROP > >> $ipt -P INPUT DROP > >> $ipt -P FORWARD DROP > >> > >> # allow local connections > >> $ipt -I OUTPUT -o lo -j ACCEPT > >> $ipt -I INPUT -i lo -j ACCEPT > >> # allow debian-tor outputs > >> $ipt -I OUTPUT -m owner --uid-owner debian-tor -j ACCEPT > >> # allow related/established incoming > >> $ipt -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > >> > >> # redirect DNS traffic > >> $ipt -t nat -I PREROUTING ! -i lo -p udp --dport 53 -j REDIRECT > >> --to-ports $DNSPROXY > >> # redirect tcp to transproxy > >> $ipt -t nat -I PREROUTING ! -i lo -p tcp --syn -j REDIRECT --to-ports > >> $TRANSPROXY > >> > >> more or less. I don't have the whole stuff in head, and my script is at > >> home. > >> > >> Use with care, as it might as well lock you out ;). > >> You should add the DNSProxy and TransProxy settings as well in your torrc. > >> > >> Cheers, > >> > >> C. > >> > >> [1] > >> > https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy > >> > >> > > >> > Am 20. Oktober 2014 17:52:18 MESZ, schrieb Robert Watson > <[email protected]>: > >> >> could someone please clarify a question I have about configuring tor & > >> >> iptables. I'm using a dual nic centos server with squid/privoxy/tor > >> >> behind > >> >> a ISP router. My internet nic (eth0) gets a dhcp address so I wasn't > >> >> sure > >> >> how to set SocksBindAddress to the eth0 address? Is there a > >> >> SocksBindAdapter setting available? > >> >> My tor.conf: > >> >> *SocksPort 9150 #privoxy socks5 port* > >> > > >> >> *SocksBindAddress 127.0.0.1* > >> >> *SocksPolicy accept 127.0.0.1* > >> >> *SocksPolicy reject ** > >> >> *AllowUnverifiedNodes middle,rendezvous* > >> >> *Log notice syslog* > >> >> *RunAsDaemon 1* > >> >> *User tor* > >> >> *CircuitBuildTimeout 30* > >> >> *NumEntryGuards 6* > >> >> *KeepalivePeriod 60* > >> >> *NewCircuitPeriod 15* > >> >> *DataDirectory /var/lib/tor* > >> >> *PidFile /var/run/tor/tor.pid* > >> >> *Log notice file /var/log/tor/tor.log* > >> > > >> >> I was thinking I would have to forward eth0:9050 to lo:9050 with these > >> >> rules: > >> >> *-A FORWARD -i lo -o eth0 -p tcp --dport 9050 -j ACCEPT* > >> >> *-A FORWARD -i eth0 -o lo -m state --state ESTABLISHED,RELATED -j > >> >> ACCEPT* > >> > > >> >> Any advice would be appreciated. > >> >> Robert > >> >> -- > >> >> tor-talk mailing list - [email protected] > >> >> To unsubscribe or change other settings go to > >> >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > >> > > >> > > >> > >> > > > > -- > > We don't bubble you, we don't spoof you ;) > > Keep your data encrypted! > > Log you soon, > > your Admin > > [email protected] > > > > Encrypted messages are welcome. > > 0x84DF1F7E6AE03644 > > > > -----BEGIN PGP PUBLIC KEY BLOCK----- > > Version: GnuPG v1.4.11 (GNU/Linux) > > > > mQINBFH797MBEAC0Y0NeI7lmDR9szTEcWuHuRe0r/WjSRC0Nr5nXsghuMcxpJ3Dd > > BOBimi4hdMMK4iqPVMwNw6GpKYR3A9LHHjbYRXHUKrJmB+BaJVyzJXN5H6XvxTTb > > UfX+DaXAGJW/G+3cBB3qm/QaU8QGkBKfXq0DLTaTGPkGKxEAldj/8onGZhawdJs+ > > B92JrW+S2HDh15pIuXzSqe7eCcIOdvvwfWe0fJi2AraA7LYGpxP6GcC/b9JJpbq5 > > Y6DfE2Aun9ZK3iHqURyrms0Whbv1CgmUahL2MVYCsTsXwe0GwlAxxKvjXAiXuo+R > > 9wO5wsXvVVSVNqsk9Yqi+wYzdPKndTU0GyxSApQHroF+cxaZ8Lk0xloj18+LdCSs > > e5IiTSXH0MMsDdWWdHlrgk+bgDG+0Gu3ne4vMwGdKO7AhYgQW/ueMy4RnkG/nsV9 > > jry5BO4gGAI1Ij8KvqUzEnvJFGE3ptJogU+zazWWDUWmL3ecKb3aDRlJFnZ3kJ5h > > q8GolZVjpk99V+4B5WVRPXdej/p5J19tXycK/jdNmr4oC8NyUhIpe8xHELnfoB4z > > +rxiTx+KMnW0rY8EQg8O2ixEYt5my90IwQkxcxIxextVrqjJjYn8extc2/v8yGzI > > KmTEJxdADB5v/Jx4HiLHNDSfBUb8gfONCkNSTYvTcSwTjWzHOkXeE/9ZbQARAQAB > > tD5lbHJpcHBvIChrZWVwIHlvdXIgZGF0YSBlbmNyeXB0ZWQpIDxlbHJpcHBvQGVs > > cmlwcG9pc2xhbmQubmV0PokCOAQTAQIAIgUCUfv3swIbLwYLCQgHAwIGFQgCCQoL > > BBYCAwECHgECF4AACgkQhN8ffmrgNkT8+BAAoAXBqu4/O2Cs5FSWWZpzgScNEgq7 > > uHhOKeYmRfgKlOUPoYlPB1DBqdOAXSKb9OvsmyOvpoGnqijB7aAJBoyQYW/OCQgd > > U8L4eTCf4yRZnfFLdgskcPfN1p0Rs/yinGEooBJFtYa7mT6J0UTW2JjCLZK2AFCW > > oF+KBu5JICXGBXigb2ZbX1jWjxP5H1RidQw6HF5z4z34SjLWAOOeZ8B/Xfz6Fs0s > > IAuLu2O4HE4DI8Qu196LhSVHHgr3uMTkvN1t5nKwyjrRQztwXXk9qIomII3ydNYb > > BYAGdWNNMfLb1kmDwC5wQHAFvSP1aiMF3aKAY+gl2wXSGO6JqM0SteJS3dytIljI > > kzu0atc9HuGs/HDQgdmpAS4WU2YefEr/WieltSiAKlwuC+3wg+CONJ6TE1vgNDU/ > > axerttb0jq7UQb/nAp05bsrB7XH1Vs+1ON9lUPEfWRmwQcrVK5JUrUWa/4tA/UeM > > XvFcPFtFluGTlLewgJIqcvjPXFwpbDZprXJsMkwew/A6B6n3+0sbgf7p3QSGkVbi > > dwQAymTbHdYqLnbcnKZhjto3Wjw1J5QB2wuiRYlpjV3i7AWTGlqoSTOWCCV+HamQ > > qeFYNYAWNFx3+J/oi7xDi8t9bHVNA205equ+y2sj3G5uGJ6LSHQ8AXp9uOipUUvU > > 1MJN0yLXr9PIwvi5Ag0EUfv3swEQAL0+MnxHGrTjSYdfdua4SBpmytDONM1EngeY > > s+WyaC/760MughKbaysI/nK2LB1vnwEY7f3NM4fxBx8u2T7VBm6Ez6Fs23Bb8Rkz > > f97bPSdxCmg64GPHfLA9uwTIXcYS+MpI86WOf6eWY0rRpf7Y9Nl7YoUNvzOyUPqc > > ggdcnHce8zYv7A/WS8flZDm8tVFPsHrQDEwNMws7ZhiNnHkeZeRJrvCuB7oEVich > > O/ROYoA5o6NozWYQbjxe1f6Yur4Q10qgVcxVnyLFJSbg6vZSzL7KYh3Z5iBOzPHt > > 7cwEDrW8W4Kl2Qj8rhJ4Wxs94CAtua7IXK44sVZWQbyHcOXRikgGMZKkEZzVCQa5 > > KD1u1ZrcBCyuMAir0hsmS3jhCUwpiE2c3SRk8O8CgixhTcBk0X/k9ZFu3Hbi1JMB > > FLzs/Nq3tYAYvVivhPloSxmYBPsafYHCZM83yBNNsralXh5zjB+di90G+AMXt2PN > > LTcdovZuWtC0s8/jrx+zv/AA4FAGYU9OVl+YL9ybFX8gSdMEcixyzQcKfiFBjpWv > > 5iFrwIuDlaXMcheyrhc9aGOxfx44OXc505+VjO/1Q/8EOWlJ6UwOi6GMkj5T+RFJ > > MDyP0UixS7dt6wTuD5t6PRuyWWxZswgrbL9hjwGFr154Z19TWeNWc23pWtUvQJos > > UCxl2nFHABEBAAGJBD4EGAECAAkFAlH797MCGy4CKQkQhN8ffmrgNkTBXSAEGQEC > > AAYFAlH797MACgkQJEPd69lQ0evA+Q/+M7lSFlrQWiRsFqDjh+kTJc+0OEBCvnfo > > N2KPyXXbfc//qup55PfEygE6C60zvrlv3WE33GZ5GS5MLuDMP82b+a5Yt16NQU7L > > WtAg1g0S0BvazW+28TgnfO8bhbGaFeE9ccw3xLmlbwZQ3f3LtMKdwFIROiG6hvAs > > 9U54QYti3tv9DowRYYWpdr0Ga8RqeGNtCKc0v2opy51MpzKWjwUW0i3XlSlyY8Lj > > 1KT8PyznNPw32nYpmDizz+0OUJNnn/kT+GnFoR3DJnFosTOrnxFJp+N+nejMp/gW > > r9NM0/E7H+P53IiytBOt5/0vsOaCFGdYGhKEjmJi3dHS4Xk1ObD1mjdD1YDOlWWU > > 3Md6BDHd4W7Q8gT7oQfTIMLd3HzV+WNPIdocPLBaeA/tRD8Pg5CCmncAmSub4F5T > > An7FlnACtSOv3cIWQ0TymS42DihDaJ5d1RvNzKw+zHYdPvf471JFZR3TDhkPbLIr > > 9czR7kbpnXRwchgwXQn306NVWf37TgA8wpbnFTazZ38iOeqcb9oKprqnbgEdr3PN > > OhKSlMTkzAqf3MEi2Fyua4BADMhS3oBwCRgDTlt6wquEytpNSlZaHnyiyIgOpekF > > Uy5K3w8NhHqeifRPrNb/UcCbXtXz+puqIEZHMenpv6FRlTTKpdoHoVXSkp1TPMGN > > /VaCiLbP4Z3xEw/9EbAJJkhmmx1Qw3ueoqc4h1MmhUtIdxSZ/oA9SjwlnY++zvaZ > > 6w1wTS4P+OUkETNDtItdpxXMJ9qfSy9voAQc2K43WMZCCmpPJYSdqaZZNPFj+Ne8 > > 6FNtNKuUkXREybpHwlVAXnHzInmFOOM9RAmF70r3zEmKt77W1ztBLo2o9X79gPgL > > u9ThgrH6Oc2k46n+9nc3joccr7miiX/bp976DNWcWdOYThiSSOCb8Zw9/Zs935i1 > > wUVkYTj24tmBH4H5ov9ib7RPmU21ru458RbUKG0ONAqBtAHNyXHzUnXsrke+D4VW > > MI06YcXSk8YeYgQ8GxgHQc+W2bb8LIbKN1hEYJ0wzM62vKR2/Oiwuf8lXutIKTuz > > +v7Vj1PQd66DGHsxtWRaWnr1c54JTL2wICHJYKFH4grp7864+GL/uQ1O/Z/XxVku > > E1JQ/AnwBGU1M1S6otwWGWVRjzEzQtxsfcCEPvV/9td3FIFQAbGTPb+48XFU+TY9 > > 8AlcXBlDzXq7c5f8Evn/oSIsZDt63K4HNTmMGqOTl/p1aA0e4eyX76LczY06rDP5 > > GMSNs+AHmYgZiS4RYhRUIvS9uLXMnnDAMYst0SDl2orDUUeHBTzu0rchyknBZMGP > > p5wQuWQ9CFlV+dj3UYbrBwC1lTkAMXRG2vlhA0V0TZqos7A5D4VHgSUQQjE= > > =otlL > > -----END PGP PUBLIC KEY BLOCK----- > > > -- tor-talk mailing list - [email protected] To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
