1

I'm on the verge of smashing my T61 into pieces.

I've installed tor, and put this in the torrc file, as indicated by the Tor Wiki:

VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

And I've saved this to an .sh file and run it:

#!/bin/sh

_non_tor="192.168.1.0/24 192.168.0.0/24 10.42.0.0/24 10.42.0.1/24"
_tor_uid="$(pidof tor)"
_trans_port="9040"

iptables -F
iptables -t nat -F
iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53

for _clearnet in $_non_tor 127.0.0.0/9 127.128.0.0/10; do
   iptables -t nat -A OUTPUT -d $_clearnet -j RETURN
done

iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

for _clearnet in $_non_tor 127.0.0.0/8; do
   iptables -A OUTPUT -d $_clearnet -j ACCEPT
done

iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
iptables -A OUTPUT -j REJECT

If i try to ping google.com or 8.8.8.8, I get around 8000 errors within milliseconds, because of the last iptables rule.

And all my tcp traffic is dead. If i remove the last rule from iptables, I get TCP/IP capability back, but its not supposed to be like this. The tor check also reports that I'm using Tor.

What I want:

Redirect ALL TCP/UDP traffic to Tor, so that ANY program trying to do ANYTHING gets forced to use the Tor network. How to do with iptables?

I've been sitting here for 9 hours, reading wikis, manuals, older questions and it is STILL not working.

My network looks like this:

[INTERNET] > ADSL > Router 1 (192.168.1.1) > ~~wireless~~ > Laptop (wlan0 192.168.1.199, eth0 10.42.0.1, sharing to Ethernet via Networkmanager) > Rounter 2 (10.42.0.2) > ~~wireless~~ > Laptop (10.42.0.2)

6
  • Are you allowing tor to get out. If not you will end up in a death spiral. Jul 14 '16 at 15:34
  • "Get out" in what sense?
    – Gala
    Jul 14 '16 at 15:35
  • tor packets need to get out of your device, onto the network. Jul 14 '16 at 15:42
  • Can you enlighten me on --uid-owner? Is the process id supposed to go there? iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT is supposed to open tor to the network.
    – Gala
    Jul 14 '16 at 15:44
  • OK that looks like it could do it. I am not the best at reading iptables. Jul 14 '16 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.