6

I am configuring a tor hardware router as an anonymizing transparent proxy using the info here and the good news is everything is working as it should; I can connect and browse sites, dns is forwarded to port 9053 and everything else tcp is forwarded over tor on the router port 9040. I go to https://check.torproject.org to test and it says tor is running and configured properly.

The only thing is I would also like to browse hidden services (.onion) and so far have not been able to get it to work. When I am connected to the tor hardware router and I troubleshoot from the command line .onion domains resolve to the false ip addresses as they should:

 sh-4.1$ host 3g2upl4pq6kufc4m.onion
3g2upl4pq6kufc4m.onion has address 10.213.7.118
3g2upl4pq6kufc4m.onion has address 10.213.7.118
Host 3g2upl4pq6kufc4m.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrzrnw6insl.onion
xmh57jrzrnw6insl.onion has address 10.245.42.50
xmh57jrzrnw6insl.onion has address 10.245.42.50
Host xmh57jrzrnw6insl.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrdrnw6insl.onion
xmh57jrdrnw6insl.onion has address 10.221.223.52
xmh57jrdrnw6insl.onion has address 10.221.223.52
Host xmh57jrdrnw6insl.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrdrnw6ins0.onion
xmh57jrdrnw6ins0.onion has address 10.194.64.30
xmh57jrdrnw6ins0.onion has address 10.194.64.30
Host xmh57jrdrnw6ins0.onion.lan not found: 4(NOTIMP)
sh-4.1$

Those are all addresses with the VirtualNetwork as configured in my torrc which looks like this:

VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
TransListenAddress 127.0.0.1
TransListenAddress 10.192.0.1
DNSPort 9053
DNSListenAddress 127.0.0.1
DNSListenAddress 10.192.0.1

And I have added a firewall rule (this may be where I done goofed) like so:

# allow ssh access over port 99 from LAN
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 99 -j REDIRECT --to-ports 22
# everything else goes over tor
iptables -t nat -A PREROUTING -i br-lan -p tcp --syn -j REDIRECT --to-ports 9040
# udp traffic for DNS (port 53) is sent to tor 9053
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 9053
# everything else udp is dropped.. not working yet
#iptables -t nat -A PREROUTING -i br-lan -p udp --syn -j DROP
# resolve onion domains (this is the rule in question)
iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040

I know .onion domains do not have ip addresses to resolve to, but when my browser queries the router 10.192.0.1:9053 for an onion domain it comes back with a seemingly random ip within the 10.192.0.0/10 range, and then when my browser requests that ip (say 10.192.254.7:80) it should be redirected via iptables back to the router 10.192.0.1:9040 right? Or am I doing it wrong?

Everything is working fine except .onion domains...

Improve this question

1 Answer 1

Reset to default
4

I found the issue after some reading. The VirtualAddrNetwork setting was the same as the dhcp pool in my network configuration so when .onion domains were returned the browser was attempting to forward traffic to an address on my local area network, which was not the correct configuration. If anyone is interested I can post the config files, but a much better and in depth explanation can be found here:

https://grepular.com/Transparent_Access_to_Tor_Hidden_Services

this ticket should be closed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .