Hello! I made my own iptables bash script for redirection of local traffic through Tor. I built upon the examples from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy while adding in some extra functionality that I'd like. This being:
- Disable redirection for every user in the system user group "nontor" - Full IPv6 support The user account running the Tor service (debian-tor) is in the nontor group. So are some other service users which need to communicate directly to the internet. The script is attached to this mail. To add IPv6 functionality, I mostly just repeated the rules from iptables in ip6tables. This worked for the most part, but IPv6 traffic to onion services doesn't work if I just allow loopback traffic to "::1". I need to allow outgoing traffic to the lo interface (see line 52 in script), which concerns me a little bit but is probably just a property of IPv6. When sniffing loopback traffic, I can see that the IPv6 traffic to Tor's TransPort has my primary network interface's (eth0) global IP address (2a02:...) as it's desination address. In torrc I added: VirtualAddrNetworkIPv4 10.192.0.0/10 VirtualAddrNetworkIPv6 1337::/16 AutomapHostsonResolve 1 TransPort 9040 TransPort [::1]:9040 DNSPort 53 DNSPort [::1]:53 Can someone please take a look at the script and look for weaknesses or come up with possible improvements? I am wondering if there are any risks with allowing output to the lo interface and if "1337::/16" is a bad idea for VirtualAddrNetworkIPv6. Thank you! -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk