Hello!
I made my own iptables bash script for redirection of local traffic through
Tor. I built upon the examples from
https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy while
adding in some extra functionality that I'd like. This being:
- Disable redirection for every user in the system user group "nontor"
- Full IPv6 support
The user account running the Tor service (debian-tor) is in the nontor group.
So are some other service users which need to communicate directly to the
internet.
The script is attached to this mail.
To add IPv6 functionality, I mostly just repeated the rules from iptables in
ip6tables. This worked for the most part, but IPv6 traffic to onion services
doesn't work if I just allow loopback traffic to "::1". I need to allow
outgoing traffic to the lo interface (see line 52 in script), which concerns
me a little bit but is probably just a property of IPv6. When sniffing
loopback traffic, I can see that the IPv6 traffic to Tor's TransPort has my
primary network interface's (eth0) global IP address (2a02:...) as it's
desination address.
In torrc I added:
VirtualAddrNetworkIPv4 10.192.0.0/10
VirtualAddrNetworkIPv6 1337::/16
AutomapHostsonResolve 1
TransPort 9040
TransPort [::1]:9040
DNSPort 53
DNSPort [::1]:53
Can someone please take a look at the script and look for weaknesses or come
up with possible improvements? I am wondering if there are any risks with
allowing output to the lo interface and if "1337::/16" is a bad idea for
VirtualAddrNetworkIPv6.
Thank you!
--
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
