How can i nginx reverse proxy to .onion site ? which is on TOR network?

Question

i have installed TOR and nginx on my cent os server.

when i proxy_pass requests to the TOR running on my localhost and supply host headers of .onion website. i am getting

tor is not an http proxy

what i am trying to do is make .onion website available on non TOR network.

How can i do this ?

update: 1

as Alexey Vesnin answer, i have downloaded & installed polipo.

Started tor as Daemon Started polipo as

polipo -c /etc/polipo/config

Started nginx

here is nginx.conf

worker_processes auto;
events {
  worker_connections 1024;
}
http {
  include  mime.types;
  default_type application/octet-stream;
  sendfile on;
  gzip on;
  server {
    listen 80;
    server_name server_ip;

    location / {
    proxy_pass http://127.0.0.1:8123/; 
    proxy_set_header Host "example.onion"; 

    proxy_set_header Accept-Encoding "";
    proxy_set_header Via "$host";

    subs_filter 'example.onion' $host;
    }
  }
}

polipo config

socksParentProxy = "localhost:9050"
socksProxyType = socks5
diskCacheRoot = ""
disableLocalInterface=true

here is what i am getting after accessing ip_address in browser.

Currently flow is :

nginx (port 80) -> 127.0.0.1:8123 (polipo) -> tor (socks proxy on port 9050)

if i stop polipo and use socat as suggested by other answer, i can access example.onion by going to my ip_address.

update 2 :

here are tcpdump output

curl -x http://127.0.0.1:8123 -I example.onion

[root@centos-512mb-blr1-01 sbin]# tcpdump -i any src port 8123 or dst port 8123
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
18:06:19.100755 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [S], seq 2706160723, win 43690, options [mss 65495,sackOK,TS val 180383683 ecr 0,nop,wscale 6], length 0
22:06:59.512088 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34156: Flags [S.], seq 15619937, ack 2706160724, win 43690, options [mss 65495,sackOK,TS val 180383683 ecr 180383683,nop,wscale 6], length 0
18:06:19.100791 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [.], ack 1, win 683, options [nop,nop,TS val 180383683 ecr 180383683], length 0
18:06:19.100892 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [P.], seq 1:147, ack 1, win 683, options [nop,nop,TS val 180383683 ecr 180383683], length 146
18:06:19.100900 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34156: Flags [.], ack 147, win 700, options [nop,nop,TS val 180383683 ecr 180383683], length 0
18:06:20.164200 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34156: Flags [P.], seq 1:496, ack 147, win 700, options [nop,nop,TS val 180384746 ecr 180383683], length 495
18:06:20.164207 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [.], ack 496, win 700, options [nop,nop,TS val 180384746 ecr 180384746], length 0
18:06:20.164667 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [F.], seq 147, ack 496, win 700, options [nop,nop,TS val 180384747 ecr 180384746], length 0
18:06:20.165750 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34156: Flags [F.], seq 496, ack 148, win 700, options [nop,nop,TS val 180384748 ecr 180384747], length 0
18:06:20.165763 IP centos-512mb-blr1-01.34156 > centos-512mb-blr1-01.8123: Flags [.], ack 497, win 700, options [nop,nop,TS val 180384748 ecr 180384748], length 0

curl -x http://127.0.0.1:8123 example.onion

[root@centos-512mb-blr1-01 sbin]# tcpdump -i any src port 8123 or dst port 8123
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
18:08:41.663821 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [S], seq 418350783, win 43690, options [mss 65495,sackOK,TS val 180526246 ecr 0,nop,wscale 6], length 0
00:12:03.077270 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [S.], seq 1228213188, ack 418350784, win 43690, options [mss 65495,sackOK,TS val 180526246 ecr 180526246,nop,wscale 6], length 0
18:08:41.663881 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [.], ack 1, win 683, options [nop,nop,TS val 180526246 ecr 180526246], length 0
18:08:41.664001 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [P.], seq 1:146, ack 1, win 683, options [nop,nop,TS val 180526246 ecr 180526246], length 145
18:08:41.664007 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [.], ack 146, win 700, options [nop,nop,TS val 180526246 ecr 180526246], length 0
18:08:42.569780 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [P.], seq 1:7954, ack 146, win 700, options [nop,nop,TS val 180527152 ecr 180526246], length 7953
18:08:42.569791 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [.], ack 7954, win 2729, options [nop,nop,TS val 180527152 ecr 180527152], length 0
18:08:42.570223 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [P.], seq 7954:11447, ack 146, win 700, options [nop,nop,TS val 180527152 ecr 180527152], length 3493
18:08:42.570229 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [.], ack 11447, win 4776, options [nop,nop,TS val 180527152 ecr 180527152], length 0
18:08:42.761444 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [P.], seq 11447:13454, ack 146, win 700, options [nop,nop,TS val 180527344 ecr 180527152], length 2007
18:08:42.761450 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [.], ack 13454, win 6822, options [nop,nop,TS val 180527344 ecr 180527344], length 0
18:08:42.761708 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [F.], seq 146, ack 13454, win 6822, options [nop,nop,TS val 180527344 ecr 180527344], length 0
18:08:42.762874 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34162: Flags [F.], seq 13454, ack 147, win 700, options [nop,nop,TS val 180527345 ecr 180527344], length 0
18:08:42.762887 IP centos-512mb-blr1-01.34162 > centos-512mb-blr1-01.8123: Flags [.], ack 13455, win 6822, options [nop,nop,TS val 180527345 ecr 180527345], length 0

from web browser trying to access ip_address

[root@centos-512mb-blr1-01 sbin]# tcpdump -i any src port 8123 or dst port 8123
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
18:06:55.843802 IP centos-512mb-blr1-01.34160 > centos-512mb-blr1-01.8123: Flags [S], seq 910534644, win 43690, options [mss 65495,sackOK,TS val 180420426 ecr 0,nop,wscale 6], length 0
17:57:09.532188 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34160: Flags [S.], seq 1766895439, ack 910534645, win 43690, options [mss 65495,sackOK,TS val 180420426 ecr 180420426,nop,wscale 6], length 0
18:06:55.843842 IP centos-512mb-blr1-01.34160 > centos-512mb-blr1-01.8123: Flags [.], ack 1, win 683, options [nop,nop,TS val 180420426 ecr 180420426], length 0
18:06:55.843918 IP centos-512mb-blr1-01.34160 > centos-512mb-blr1-01.8123: Flags [P.], seq 1:447, ack 1, win 683, options [nop,nop,TS val 180420426 ecr 180420426], length 446
18:06:55.843925 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34160: Flags [.], ack 447, win 700, options [nop,nop,TS val 180420426 ecr 180420426], length 0
18:06:55.844164 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34160: Flags [P.], seq 1:607, ack 447, win 700, options [nop,nop,TS val 180420426 ecr 180420426], length 606
18:06:55.844171 IP centos-512mb-blr1-01.34160 > centos-512mb-blr1-01.8123: Flags [.], ack 607, win 702, options [nop,nop,TS val 180420426 ecr 180420426], length 0
18:06:55.844199 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34160: Flags [F.], seq 607, ack 447, win 700, options [nop,nop,TS val 180420426 ecr 180420426], length 0
18:06:55.844949 IP centos-512mb-blr1-01.34160 > centos-512mb-blr1-01.8123: Flags [F.], seq 447, ack 608, win 702, options [nop,nop,TS val 180420427 ecr 180420426], length 0
18:06:55.844961 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34160: Flags [.], ack 448, win 700, options [nop,nop,TS val 180420427 ecr 180420427], length 0

from web browser trying to access ip_address with proxy_redirect off;

[root@centos-512mb-blr1-01 sbin]# tcpdump -i any src port 8123 or dst port 8123
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
18:11:29.776426 IP centos-512mb-blr1-01.34166 > centos-512mb-blr1-01.8123: Flags [S], seq 1166517450, win 43690, options [mss 65495,sackOK,TS val 180694358 ecr 0,nop,wscale 6], length 0
08:46:03.082415 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34166: Flags [S.], seq 2412138764, ack 1166517451, win 43690, options [mss 65495,sackOK,TS val 180694359 ecr 180694358,nop,wscale 6], length 0
18:11:29.776471 IP centos-512mb-blr1-01.34166 > centos-512mb-blr1-01.8123: Flags [.], ack 1, win 683, options [nop,nop,TS val 180694359 ecr 180694359], length 0
18:11:29.776554 IP centos-512mb-blr1-01.34166 > centos-512mb-blr1-01.8123: Flags [P.], seq 1:447, ack 1, win 683, options [nop,nop,TS val 180694359 ecr 180694359], length 446
18:11:29.776560 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34166: Flags [.], ack 447, win 700, options [nop,nop,TS val 180694359 ecr 180694359], length 0
18:11:29.777002 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34166: Flags [P.], seq 1:607, ack 447, win 700, options [nop,nop,TS val 180694359 ecr 180694359], length 606
18:11:29.777012 IP centos-512mb-blr1-01.34166 > centos-512mb-blr1-01.8123: Flags [.], ack 607, win 702, options [nop,nop,TS val 180694359 ecr 180694359], length 0
18:11:29.777030 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34166: Flags [F.], seq 607, ack 447, win 700, options [nop,nop,TS val 180694359 ecr 180694359], length 0
18:11:29.777159 IP centos-512mb-blr1-01.34166 > centos-512mb-blr1-01.8123: Flags [F.], seq 447, ack 608, win 702, options [nop,nop,TS val 180694359 ecr 180694359], length 0
18:11:29.777178 IP centos-512mb-blr1-01.8123 > centos-512mb-blr1-01.34166: Flags [.], ack 448, win 700, options [nop,nop,TS val 180694359 ecr 180694359], length 0

Loïc · Accepted Answer · 2018-07-26 22:29:09Z

You need a polipo proxy - because Tor is not a http proxy, it's a Socks one. You can get it on polipo's official website and don't be upset that it's no longer maintained: this is the case when "the task is done", there's nothing more to add.

You will use Polipo as an adapter for TOR's Socks proxy into HTTP proxy. If your onion website uses HTTPS - then you need to handle https separately and NGinx must be set not as a webserver, but as a proxy due to the HTTPS nature: it can be using CONNECT method, and it's "unmirrorable" - it can be only proxified.

But HTTPS is rarely used in onions because it's already encrypted by Tor, the only reason in using https in onion is to use either a client certificates on per-client basis, or to "sign" the data to confirm it's integrity explicitly (HTTPS encryption function is useless in onions due to Tor's encryption)

UPDATE:

Due to lack of time, I'm posting a privoxy-based solution. seems to be working. Actually, privoxy has made a big leap ahead since I've seen it last time.

NGinx conf for proxy - in standard Debian install it resides in /etc/nginx/conf.d folder:

upstream onion {
    server 127.0.0.1:8118;
}
server {
    listen <nginx ip>:443 ssl;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    location / {
        proxy_pass http://onion;
        proxy_set_header Host desired.onion;
    }
}

/etc/privoxy/config:

 user-manual /usr/share/doc/privoxy/user-manual
 confdir /etc/privoxy
 logdir /var/log/privoxy
 actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on.
 actionsfile default.action   # Main actions file
 actionsfile user.action      # User customizations
 filterfile default.filter
 filterfile user.filter      # User customizations
 logfile logfile
 listen-address  localhost:8118
 toggle  1
 enable-remote-toggle  0
 enable-remote-http-toggle  0
 enable-edit-actions 0
 enforce-blocks 0
 buffer-limit 4096
 enable-proxy-authentication-forwarding 0
 forward-socks5   /               <tor-ip>:9050 .
 forwarded-connect-retries  0
 accept-intercepted-requests 1
 allow-cgi-request-crunching 0
 split-large-forms 0
 keep-alive-timeout 5
 tolerate-pipelining 1
 socket-timeout 300

yes, exactly. As an addition I do recommend to put polipo in non-caching mode and Nginx's proxy cache dir into the tmpfs, i.e. in RAM — Alexey Vesnin, Commented Jan 25, 2017 at 17:36
Is polipo best as performance wise ? or there are better alternatives too ? thanks — user14856, Commented Mar 23, 2017 at 15:37
polipo is quite good in perf-things as to my measurements. But when I needed an extreme performance - I've made some code tweaks according to my task. But it's very good for most of the tasks just out-of-the-box — Alexey Vesnin, Commented Mar 23, 2017 at 15:39
any example would be great, i have installed polipo and started it and tor is running too, i have set nginx to go through polipo , but its not opening my desired .onion website. i am kinda stuck in middle., thanks — user14856, Commented Mar 23, 2017 at 17:43

Mike Wazowsky · Accepted Answer · 2017-01-31 07:49:53Z

You can use socat.

Nginx config:

location / {
    proxy_pass http://127.0.0.1:81/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
}

Socat command:

socat tcp4-LISTEN:81,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:yourtordomain.onion:80,socksport=9050

Update:

If you want run socat as daemon. Create file socat.sh and set permission to 744:

#!/bin/bash
socat tcp4-LISTEN:81,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:yourtordomain.onion:80,socksport=9050

And run it over screen:

screen -A -m -d -S SOCAT_DAEMON ./socat.sh

Stack Exchange Network

How can i nginx reverse proxy to .onion site ? which is on TOR network?

2 Answers 2

You must log in to answer this question.

Hot Network Questions

How can i nginx reverse proxy to .onion site ? which is on TOR network?

2 Answers 2

You must log in to answer this question.

Related

Hot Network Questions