Tor daemon config on Advanced Tomato custom firmware. Is it private and secure?

Question

I enabled Tor on Advanced Tomato web interface.

this is what I got:

# cat /etc/tor.conf
SocksPort 9050
SocksBindAddress 127.0.0.1
AllowUnverifiedNodes middle,rendezvous
RunAsDaemon 1
Log notice syslog
DataDirectory /tmp/tor
TransPort 9040
TransListenAddress 192.168.100.1
DNSPort 9053
DNSListenAddress 192.168.100.1
User nobody

ps output

23200 nobody   15372 S    tor -f /etc/tor.conf

I can confirm that the connection works.

$ curl ifconfig.co
46.166.148.176

To enable tor I really made only a few clicks. Now the question is my setup good for privacy and secure? Any thing you would recommend for Tomato Firmware users? Other comments?

Answer 1

There are a few problems or improvements, at the very least:

SocksBindAddress 127.0.0.1

This should probably be 192.168.100.1. I think it's a good idea to expose the Socks port. Where possible you should prefer Socks. If you're going to use Tor Browser, for example, then you will want to take advantage of things like the Socks auth based circuit isolation.

Redirect TCP Ports...

This is very dangerous, is it forwarding only port 80 and 443 through Tor. You're going to leak like a sieve and it would be trivial to deanonymize you. For example, a website that contains <img src="http://evil.com:81/image.jpg"> in it, will cause you to fetch the image outside of Tor, linking your Tor session to your real IP address. Even if you're not doing web browsing, there are similar attacks for a lot of other protocols (and even file formats).

My recommendation is not to use this firmware to Torify your connection at all, at best you might be able to specify the range 1-65535 for the custom ports, but you'll still be liable to leak non TCP packets. It looks like you'll also need to apply some further configuration to use Tor's DNSPort, there seems to be a distinct dns_intcpt option that it set to redirect those too.

I also suspect that .onion services will not work, because the torrc does not set AutomapHostsOnResolve and an appropriate VirtualAddrNetworkIPv4 to allow the resolve then transproxy required to utilise onion services without direct access to the Socks port.

Some further reading on why I don't like (most) "Tor Routers" is available here.

Answer 2

Since Tomatos TOR settings are not really obvious and poorly documented, here is config trick I've done to make this future work as socks proxy.

Setting redirect IP to something local and unused allows to trick redirection rules. Custom configuration makes it accessible only from internal network.

Socks Port: 9050
Trans Port: 9040
DNS Port: 9053
Data Directory: /tmp/tor
Redirect all users from: Selected IP`s: 127.0.0.254
Redirect TCP Ports: Selected Ports: 1:65535

Custom Configuration:
SOCKSPort 192.168.1.1:9050
SOCKSPolicy accept 192.168.1.0/24
SOCKSPolicy reject *
ExitPolicy reject *:* 

Then you can configure your browser to use socks proxy 192.168.1.1:9050

This information can be very helpful for those who are googling Tomato TOR Settings documetation.

As for security and privacy, it completely depends on the firmware version and the version of the TOR installed there. If you need real privacy, then you will not find anything safer than a manual build of the latest version of TOR from the source code.

However this feature is quite enough for website blocking bypass.