1

I have configured my router to route some of connections to my raspberry pi. Raspberry pi runs an openvpn client and has ip_forward and masquerade enabled in IP Tables so any incoming TCP/IP connection on ethernet port will be forwarded to tun0 which belongs to openvpn.

Here's the commands I use to setup raspberry pi to route incoming connections to tun0:

iptables -A FORWARD -o tun0 -i eth0 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
echo "1" | sudo tee /proc/sys/net/ipv4/ip_forward

Now what I want to do is to use Tor instead of openvpn, I mean forwarding traffic to the Tor network not openvpn connection. How can I do this?

Edit 1: Access to some domains and IP address are blocked by my ISP, so I have to use VPN to access them. As using VPN with every domain and IP is not my desire, I decided to create a list of these domains and IPs in my router (RouterOS) and then route their traffic to my raspberry pi device (This link provides actual commands used in routerOS to make it work: https://forum.mikrotik.com/viewtopic.php?f=13&t=171665&p=839646#p839550) and then run an OpenVPN on RaspberryPi and forward these traffics through OpenVPN connection.

But now I don't want to use OpenVPN to unblock access to the specified domains anymore, instead I want to use Tor, but tor does not create a network interface like tun0 which is created by openvpn when established so I don't know how to configure iptables on raspberry pi to forward and masquerade the traffic the way I was doing it with openvpn running.

P.S. I don't care about leaks as my goal is only to access blocked websites and services.

Improve this question

1 Answer 1

Reset to default
0

It depends on the task you're solving, but - basically - here it is in an official manual at https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy but - keep in mind that connection leaks are very possible if you're using just a common recipe! Perhaps if you will provide more details about your task workflow I'll be able to help you better.

Update on edit: You're right, Tor Transparent Proxy is not rising an interface, but you just need to follow the guide I linked to you - it's your case. Pay careful attention at the warning block in the guide about incorporating the leak-protecting rules in another cases, but in your particular case just enable the outer world connection for the system user used to run Tor - it will seal the breaches in your case. In other cases like a single node routing and drop-in on-machine rule set - it's a must have to incorporate the additional rules referenced.

Improve this answer
3
  • I have edited original question to explain more. and thanks for your answer
    – Nixmd
    Commented Jun 7, 2021 at 5:32
  • Thanks for your answer. I read the wiki and I think I have to use "anonymizing middlebox" but there are two problems here. 1. Wiki assumes that there are 2 separate network interfaces, one of them is connected to LAN and another one is internet side, but I want to use only 1 iface (eth0). I could achieve it when using ovpn by not setting default routes in vpn connection. 2. This configuration is blocking access to any other ports opened on raspberrypi, e.g. HTTP server while I prefer to run these services on RPi beside Tor Transparent Proxy. How should I deal with these two problems?
    – Nixmd
    Commented Jun 11, 2021 at 7:41
  • Well, use VLAN's - they do spawn a different interfaces, so you can utilize it by plugging your SBC to your router directly so the network flow will be in full control by the router. This will help you to deal with both of your questions securely and without any complications.
    – Alexey Vesnin ♦
    Commented Jun 18, 2021 at 2:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .