Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured the Tor service. That all works. Now comes the part which doesn't work: I configured a couple of iptables rules to redirect the FON traffic via the normal internet connection and the FON-client traffic through Tor. This somewhat works: the FON router can register itself at FON but somehow after a while fon says the router is offline. The iptables rules are:

    # 192.168.69.0/24 -> fon lan

# destinations not routed through Tor
NON_TOR="192.168.0.0/16 172.29.0.0/24"

# TOR user
TOR_UID="117"

# Tor's TransPort
TRANS_PORT="9040"

# interface to tor router
INT_IF="eth2"
# interface to internet
EXT_IF="eth0"

iptables -F
iptables -t nat -F

iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
# radius
for i in 160 161 162 163
do
    iptables -A INPUT -i $INT_IF -p udp --destination-port 1812:1813 -j ACCEPT
    iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A INPUT -i $INT_IF -p tcp --destination-port 1812:1813 -j ACCEPT
    iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A INPUT -i $INT_IF -p udp --destination-port 1812:1813 -j ACCEPT
done
# 1938
iptables -A INPUT -i $INT_IF -p tcp --destination-port 1938 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1938 -d 213.134.45.190 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1938 -d 213.134.45.190 -j ACCEPT
# 53
iptables -A INPUT -i $INT_IF -p udp --destination-port 53 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 53 -d 213.134.45.190 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 53 -d 213.134.45.190 -j ACCEPT
# 1937
iptables -A INPUT -i $INT_IF -p tcp --destination-port 1937 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1937 -d 213.134.45.191 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1937 -d 213.134.45.191 -j ACCEPT
# 123
iptables -A INPUT -i $INT_IF -p udp --destination-port 123 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 123 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 123 -j ACCEPT

iptables -A FORWARD -i eth2 -o $EXT_IF -d 192.168.0.0/16 -j REJECT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -d 0.0.0.0/0 -j REJECT
iptables -t nat -A OUTPUT -o lo -j RETURN
iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
for NET in $NON_TOR; do
  iptables -t nat -A OUTPUT -d $NET -j RETURN
  iptables -t nat -A PREROUTING -i $INT_IF -d $NET -j RETURN
done
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for NET in $NON_TOR 127.0.0.0/8; do
  iptables -A OUTPUT -d $NET -j ACCEPT
done
iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
iptables -A OUTPUT -j REJECT
share|improve this question
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.