[tor-talk] howto: Raspberry Pi as transparent tor proxy

Wed Oct 31 06:23:26 UTC 2012

Very nice,

For firewall you can consider the following

iptables -F
iptables -X
iptables -Z
iptables -t nat -Z 2>/dev/null
iptables -t mangle -Z
iptables -t nat -F
iptables -t mangle -F

    iptables -P INPUT DROP
    iptables -P FORWARD DROP
    iptables -P OUTPUT DROP

    # Established incoming connections are accepted.
    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    # Traffic on the loopback interface is accepted.
    iptables -A INPUT -i lo -j ACCEPT

	iptables -A OUTPUT -j ACCEPT -p icmp

    # Established outgoing connections are accepted.
    iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    # Internal network connections are accepted.
    iptables -A OUTPUT -d 127.0.0.0/255.0.0.0 -j ACCEPT

    # Local network connections should not go through Tor but DNS shall be
    # rejected.
    iptables -N lan
    iptables -A lan -p TCP --dport domain -j REJECT
    iptables -A lan -p UDP --dport domain -j REJECT
    iptables -A lan -j ACCEPT

    # Sort out traffic to local network
    # Note that we exclude the VirtualAddrNetwork used for .onion:s here.
    iptables -A OUTPUT -d 192.168.0.0/255.255.0.0 -j lan
    iptables -A OUTPUT -d 10.0.0.0/255.0.0.0 -j lan
    iptables -A OUTPUT -d 172.16.0.0/255.240.0.0 -j lan

iptables -t nat -A OUTPUT ! -o lo -p tcp  -m tcp -j REDIRECT --to-ports 9040
iptables -t nat -A OUTPUT -p udp --dport 53 -m state --state NEW -j REDIRECT --to-ports 53
iptables -t filter -A OUTPUT -p tcp -m tcp --dport 9040 -j ACCEPT
iptables -t filter -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
#iptables -t filter -A OUTPUT ! -o lan -j DROP

    # Everything else is dropped.
#    iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable

    # log incomming connection attempts
    iptables -A INPUT -p tcp -m tcp -m state --state NEW -j LOG --log-prefix "input(tcp) " -m limit --limit 1/minute
    iptables -A INPUT ! -p tcp -j LOG --log-prefix "input(all) " -m limit --limit 1/minute

    # some kernel enhancement

    # ; ignore broadcast
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 

    # ; disable forwarding
    echo 0 > /proc/sys/net/ipv4/ip_forward

    # ; enable tcp syn cookie protection
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies

    # ; ignore buggus icmp responses
    echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

    # ; ignore all icmp
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all 

    # ; ip spoofing protection
    for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
      echo 1 > $f
    done

    # Don't accept or send ICMP redirects.
    for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done
    for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done

    # Disable Source Routed Packets
    for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
      echo 0 > $f
    done 

    # ; Log martian
    for f in /proc/sys/net/ipv4/conf/*/log_martians; do
      echo 1 > $f
    done

    # Disable proxy_arp.
    for i in /proc/sys/net/ipv4/conf/*/proxy_arp; do echo 0 > $i; done

    # Reduce number of possible SYN Floods
    echo "512" >/proc/sys/net/ipv4/tcp_max_syn_backlog

On Mon, 29 Oct 2012 20:52:10 +0100
Sven Wolf <torproject at fusion-zone.net> wrote:

> Hi all,
> 
> here're some informations how I configured my Raspberry Pi as an 
> transparent tor proxy for my home network.
> 
> Currently in my opinion the Raspberry Pi is a cheap and flexible 
> platform for this task. I thought about to use an
> dd-wrt based router as a transparent tor proxy but there a no current 
> optware packages for the dd-wrt/openwrt platform and
> also there is no final tutorial which describes in detail how to set up 
> a transparent tor proxy on the dd-wrt/openwrt platform
> 
> 
> My configuration is:
> - 256 mb Raspberry Pi
> - usb wifi adapter TP-Link WL-722N with an external antenna (drivers are 
> already included in the current Raspian os)
> - 4 port D-Link usb hub DUB-H4
> - hama power supply
> - sandisk 4 gb sdcard
> - Raspian Linux
> 
> for other supported hardware please look at:
> http://www.elinux.org/RPi_VerifiedPeripherals
> 
> 
> For the wirless accesspoint configuration I followed the instruction from:
> http://sirlagz.net/2012/08/09/how-to-use-the-raspberry-pi-as-a-wireless-access-pointrouter-part-1/ 
> 
> 
> Here are my steps for the setup. I've installed following additional 
> packages:
> dnsmasq
> dnsutils
> hostapd
> iw
> net-tools
> tor
> 
> First: create/modify /etc/dnsmasq.conf
> 
> interface=wlan0
> dhcp-range=10.0.0.2,10.0.0.10,255.255.255.0,24h
> dhcp-option=3,10.0.0.1
> 
> 
> Second: create/modify /etc/hostap/hostapd
> 
> interface=wlan0
> driver=nl80211
> ctrl_interface=/var/run/hostapd
> ctrl_interface_group=0
> ssid=<your ssid>
> hw_mode=g
> channel=<your channel, e.g. 11>
> wpa=2
> wpa_passphrase=<your passphrase>
> wpa_key_mgmt=WPA-PSK
> wpa_pairwise=CCMP
> rsn_pairwise=CCMP
> 
> 
> For the Tor and iptables configuration I followed the instructions from:
> https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy#AnonymizingMiddlebox 
> 
> I didn't modify /etc/resolv.conf to 127.0.0.1 because I had problems 
> with the network connection directly on the Raspberry Pi.
> E.g. it wasn't possible to download Raspian packages or to open websites 
> with lynx.
> 
> 
> Third: create/modify /etc/torrc
> 
> Log notice file /var/log/tor/notices.log
> VirtualAddrNetwork 10.192.0.0/10
> AutomapHostsSuffixes .onion,.exit
> AutomapHostsOnResolve 1
> TransPort 9040
> TransListenAddress 10.0.0.1
> DNSPort 53
> DNSListenAddress 10.0.0.1
> 
> Fourth: create an executable script at /etc/network/if-pre-up.d, e.g. 
> /etc/network/if-pre-up.d/iptables.sh with following content
> 
> #!/bin/bash
> /sbin/iptables-restore < /etc/iptables.rules
> 
> Fifth: enter the iptables ruleset directly on the shell
> 
> iptables -F
> iptables -t nat -F
> 
> iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT 
> --to-ports 53
> iptables -t nat -A PREROUTING -i wlan0 -p tcp --syn -j REDIRECT 
> --to-ports 9040
> 
> Sixth: create /etc/iptables.rules like this
> iptables-save > /etc/iptables.rules
> 
> In my opionion there is room for improvment. Maybe someone have 
> additional ideas or configuration recommendations, e.g. for the firewall.
> The missing RTC don't seem to be a problem for this configuration. But 
> there is an tutorial how to add an RTC to the Raspberry Pi:
> http://www.raspberrypi.org/phpBB3/viewtopic.php?f=44&t=16218
> 
> 
> Thanks and best regards,
> Sven
> 
> _______________________________________________
> tor-talk mailing list
> tor-talk at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk