Me -> Tor -> Vpn [How?]

Question

I was just trying to figure out how to combine Tor with a VPN for the times when I may need to.

I know most of you are going to avoid answering my question by trying to talk me out of doing it, but I just want to know HOW to do it for the times I might need to do so.

I know how to do Me -> OpenVPN -> Tor. This is really easy. But I want to learn how to do

Me -> Tor -> OpenVPN.

I have searched, searched and searched but was unable to find a clear answer to how to do this.

Can anybody help me figure this out? Bonus points if you can tell me how to do Tor -> Tails

Answer 1

Hint:

$ openvpn --help
--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at

/etc/tor/torrc:

SocksPort 9050 # what port to open for local application connections
SocksListenAddress 127.0.0.1 # accept connections only from localhost

---

Edit:

As a newbie, you are probably meet troubles with wrapping a connection.

While you'll start openvpn directly from host where Tor works, you'll lost connection. Simple, routing will be looped, somethings like:

Host -> Vpn -> Tor -> Host -> Vpn -> Tor ->...

You need to get middle box. Thereafter, connect to your VPN provider with

# openvpn config.ovpn --socks-proxy 192.168.1.1 9050 --verb 6

Your can get any Virtual Machine. Launch Tor on the Host, configure middle box, open socks5 proxy for Virtual Machine. Launch openvpn inside Guest with previous flags.

You might be safe from leakage in this case, if you deny Guest to connect to external network, only internal ( virtual ) NAT.

---

Or, you can take 2 Stations:

1 Station with 2 ethernet cards is a middle box: one eth look to internet, second into internal network.

2 Station - is your work station.

You might, again, open only Socks5 port on the first Station for internal network, to prevent leakage.

1 Station(openvpn --socks-proxy) ---> 2 Station ( Tor middle box ) --> Internet

---

You might read this my answer: https://tor.stackexchange.com/questions/1229/how-to-chain-proxy-after-tor/1234#1234

Answer 2

This can be done using VirtualBox VMs. It's easy with Whonix. Just set up a VPN client in the workstation VM in /etc/openvpn/, and add socks-proxy 192.168.0.10 9150 up and socks-proxy-retry to the configuration file. The requirement for an up proxy-authentication file is an OpenVPN bug. The up file must exist, but it's not parsed, so its content doesn't matter. You'll need to reconfigure apps that are set up to use the Whonix gateway as proxy.

A lighter solution uses a pfSense VM that provides a Tor SocksPort. In the simplest case, you would use this with a Linux VM running a VPN client and Tor Browser. More generally, you could use the pfSense Tor-gateway VM with various pfSense VPN-client VMs to construct nested chains of VPNs and Tor.

In order to use the latest Tor release, you need to build a Tor package in FreeBSD 8.3 from the latest port:

fetch ftp://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-i386/8.3/FreeBSD-8.3-RELEASE-i386-disc1.iso
[create local FreeBSD VM with 1024 MB RAM and 200 GB thin VDI]
portsnap fetch extract
mkdir /usr/ports/packages
cd /usr/ports/security/tor/
make package-recursive
cd /usr/ports/devel/google-perftools/
make package-recursive
cd /usr/ports/packages/All/

Now you can install Tor in pfSense 2.1.4 as described here. But don't do the proxy server part, just Tor install. You can get your new packages into pfSense using Diagnostics: Execute command: Upload in the webGUI. Before installing, move the package files from /tmp/ to /root/ by running mv /tmp/[package].tbz /root/. Then work in the pfSense console, hitting 8 and enter for a command line. You will need to fix the libevent 2.0 screwup by adding two links:

ln -s /usr/local/lib/event2/libevent-2.0.so.6 /usr/lib/libevent-2.0.so.6
ln -s /usr/local/lib/event2/libevent_openssl-2.0.so.6 /usr/lib/libevent_openssl-2.0.so.6

Edit torrc using vi /usr/local/etc/tor/torrc:

...
SocksPort 192.168.1.1:9050
...
RunAsDaemon 1
...

Now reboot the pfSense VM. Tor should be running. Using the webGUI, lock down pfSense. First delete all outbound NAT routes in Firewall: NAT: Outbound:

select "Manual Outbound NAT rule generation", save and apply changes
check all outbound NAT routes, and delete using [x] at lower right
save and apply changes

In Firewall: Rules: LAN, allow access from LAN only to the Tor SocksPort:

edit default allow rule
allow TCP from LAN subnet to 192.168.1.1 port 9050
save and apply changes

The pfSense Tor-gateway VM only needs to access your entry guards, and NTP servers so that Tor has the correct time. For additional security, you can create rules on WAN that allow that, and block all other outbound traffic. Working at the command line in the pfSense console, view your entry guards:

cat /var/db/tor/state | less

Browse Atlas and get the corresponding IP addresses. Browse Firewall: Aliases: IP, and create an alias for those IPs. You will need to update the alias periodically as your entry guards change. Also create an alias for the pfSense NTP server <0.pfsense.pool.ntp.org>. Then use those two aliases to create outbound pass rules in Firewall: Rules: WAN. At the bottom, add a block rule for everything else.

Finally, in System: Advanced: Miscellaneous: Gateway Monitoring, check Skip Rules When Gateway is Down and hit Save. Now your pfSense VM provides a Tor SocksPort, and blocks all other traffic.

Please see my answer to this question for advice about paying anonymously for VPN services.

Answer 3

What are you guys thinking about that solution: VPN over Tor - is this an easy way to do it?

Essenitally what you are doing is changing the .ovpn VPN config file and the kernel routing table to:

proto tcp
#rest of the file
socks-proxy 127.0.0.1 9050
route 95.216.33.58 255.255.255.255 192.168.3.1
# using tor as proxy and using the non-VPN standard gateway 
to connect to the Entry/Guard node

The routing table should look like this:

destination       gateway          Genmask         Flags Metric Ref    Use   Iface
0.0.0.0         172.18.10.249   0.0.0.0         UG    0      0        0   tun0
116.202.238.106 192.168.3.1     255.255.255.255 UGH   0      0        0   wlan0
127.0.0.1       192.168.3.1     255.255.255.255 UGH   0      0        0   wlan0
172.18.10.1     172.18.10.249   255.255.255.255 UGH   0      0        0   tun0
172.18.10.249   0.0.0.0         255.255.255.255 UH    0      0        0   tun0
192.168.3.0     0.0.0.0         255.255.255.0   U     600    0        0   wlan0

The downside of this solution is obviusly that you need to change the ovpn cfg file each time your entry node changes. You could also change the entry node to a fixed one but that is not recommended. You would have to change it back after a while.