Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured the Tor service. That all works. Now comes the part which doesn't work: I configured a couple of iptables rules to redirect the FON traffic via the normal internet connection and the FON-client traffic through Tor. This somewhat works: the FON router can register itself at FON but somehow after a while fon says the router is offline. The iptables rules are:

    # 192.168.69.0/24 -> fon lan

# destinations not routed through Tor
NON_TOR="192.168.0.0/16 172.29.0.0/24"

# TOR user
TOR_UID="117"

# Tor's TransPort
TRANS_PORT="9040"

# interface to tor router
INT_IF="eth2"
# interface to internet
EXT_IF="eth0"

iptables -F
iptables -t nat -F

iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
# radius
for i in 160 161 162 163
do
    iptables -A INPUT -i $INT_IF -p udp --destination-port 1812:1813 -j ACCEPT
    iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A INPUT -i $INT_IF -p tcp --destination-port 1812:1813 -j ACCEPT
    iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1812:1813 -d 213.134.45.$i -j ACCEPT
    iptables -A INPUT -i $INT_IF -p udp --destination-port 1812:1813 -j ACCEPT
done
# 1938
iptables -A INPUT -i $INT_IF -p tcp --destination-port 1938 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1938 -d 213.134.45.190 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1938 -d 213.134.45.190 -j ACCEPT
# 53
iptables -A INPUT -i $INT_IF -p udp --destination-port 53 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 53 -d 213.134.45.190 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 53 -d 213.134.45.190 -j ACCEPT
# 1937
iptables -A INPUT -i $INT_IF -p tcp --destination-port 1937 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p tcp -s 192.168.69.0/24 --destination-port 1937 -d 213.134.45.191 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.69.0/24 --destination-port 1937 -d 213.134.45.191 -j ACCEPT
# 123
iptables -A INPUT -i $INT_IF -p udp --destination-port 123 -j ACCEPT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -s 192.168.69.0/24 --destination-port 123 -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.69.0/24 --destination-port 123 -j ACCEPT

iptables -A FORWARD -i eth2 -o $EXT_IF -d 192.168.0.0/16 -j REJECT
iptables -A FORWARD -i eth2 -o $EXT_IF -p udp -d 0.0.0.0/0 -j REJECT
iptables -t nat -A OUTPUT -o lo -j RETURN
iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
for NET in $NON_TOR; do
  iptables -t nat -A OUTPUT -d $NET -j RETURN
  iptables -t nat -A PREROUTING -i $INT_IF -d $NET -j RETURN
done
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for NET in $NON_TOR 127.0.0.0/8; do
  iptables -A OUTPUT -d $NET -j ACCEPT
done
iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
iptables -A OUTPUT -j REJECT
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.