I was just trying to figure out how to combine Tor with a VPN for the times when I may need to.

I know most of you are going to avoid answering my question by trying to talk me out of doing it, but I just want to know HOW to do it for the times I might need to do so.

I know how to do Me -> OpenVPN -> Tor. This is really easy. But I want to learn how to do

Me -> Tor -> OpenVPN.

I have searched, searched and searched but was unable to find a clear answer to how to do this.

Can anybody help me figure this out? Bonus points if you can tell me how to do Tor -> Tails

  • 1
    Tails already runs all traffic over Tor. How would "Tor -> Tails" be something new? – Andrew Lott Jan 8 '14 at 7:56
  • 1
    ConcealmEnt - I am sorry, but I am what they call a newbie. And while I appreciate your answer, its a bit too complex for me. Can you please go into further detail for me? @Andrew Lott - I want to do Tor -> Tails -> VPN -> Internet There are cases when using Tor to do things online are not possible, for example posting on Stack Exchange, sometimes I get messages that my IP is being flagged as spam. So being able to connect to a VPN using TOR, thus staying anonymous to the VPN would benefit me. – user915 Jan 8 '14 at 17:31
  • Did you sign up for the VPN provider anonymously? If not, then they already know who you are! – Michael Hampton Jan 10 '14 at 0:51
  • Might be relevant: tor.stackexchange.com/questions/4245/… – unhammer Oct 9 '14 at 10:23

Hint:

$ openvpn --help
--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at

/etc/tor/torrc:

SocksPort 9050 # what port to open for local application connections
SocksListenAddress 127.0.0.1 # accept connections only from localhost

Edit:

As a newbie, you are probably meet troubles with wrapping a connection.

While you'll start openvpn directly from host where Tor works, you'll lost connection. Simple, routing will be looped, somethings like:

Host -> Vpn -> Tor -> Host -> Vpn -> Tor ->...

You need to get middle box. Thereafter, connect to your VPN provider with

# openvpn config.ovpn --socks-proxy 192.168.1.1 9050 --verb 6

Your can get any Virtual Machine. Launch Tor on the Host, configure middle box, open socks5 proxy for Virtual Machine. Launch openvpn inside Guest with previous flags.

You might be safe from leakage in this case, if you deny Guest to connect to external network, only internal ( virtual ) NAT.


Or, you can take 2 Stations:

1 Station with 2 ethernet cards is a middle box: one eth look to internet, second into internal network.

2 Station - is your work station.

You might, again, open only Socks5 port on the first Station for internal network, to prevent leakage.

1 Station(openvpn --socks-proxy) ---> 2 Station ( Tor middle box ) --> Internet


You might read this my answer: https://tor.stackexchange.com/questions/1229/how-to-chain-proxy-after-tor/1234#1234

This can be done using VirtualBox VMs. It's easy with Whonix. Just set up a VPN client in the workstation VM in /etc/openvpn/, and add socks-proxy 192.168.0.10 9150 up and socks-proxy-retry to the configuration file. The requirement for an up proxy-authentication file is an OpenVPN bug. The up file must exist, but it's not parsed, so its content doesn't matter. You'll need to reconfigure apps that are set up to use the Whonix gateway as proxy.

A lighter solution uses a pfSense VM that provides a Tor SocksPort. In the simplest case, you would use this with a Linux VM running a VPN client and Tor Browser. More generally, you could use the pfSense Tor-gateway VM with various pfSense VPN-client VMs to construct nested chains of VPNs and Tor.

In order to use the latest Tor release, you need to build a Tor package in FreeBSD 8.3 from the latest port:

fetch ftp://ftp.freebsd.org/pub/FreeBSD/ISO-IMAGES-i386/8.3/FreeBSD-8.3-RELEASE-i386-disc1.iso
[create local FreeBSD VM with 1024 MB RAM and 200 GB thin VDI]
portsnap fetch extract
mkdir /usr/ports/packages
cd /usr/ports/security/tor/
make package-recursive
cd /usr/ports/devel/google-perftools/
make package-recursive
cd /usr/ports/packages/All/

Now you can install Tor in pfSense 2.1.4 as described here. But don't do the proxy server part, just Tor install. You can get your new packages into pfSense using Diagnostics: Execute command: Upload in the webGUI. Before installing, move the package files from /tmp/ to /root/ by running mv /tmp/[package].tbz /root/. Then work in the pfSense console, hitting 8 and enter for a command line. You will need to fix the libevent 2.0 screwup by adding two links:

ln -s /usr/local/lib/event2/libevent-2.0.so.6 /usr/lib/libevent-2.0.so.6
ln -s /usr/local/lib/event2/libevent_openssl-2.0.so.6 /usr/lib/libevent_openssl-2.0.so.6

Edit torrc using vi /usr/local/etc/tor/torrc:

...
SocksPort 192.168.1.1:9050
...
RunAsDaemon 1
...

Now reboot the pfSense VM. Tor should be running. Using the webGUI, lock down pfSense. First delete all outbound NAT routes in Firewall: NAT: Outbound:

select "Manual Outbound NAT rule generation", save and apply changes
check all outbound NAT routes, and delete using [x] at lower right
save and apply changes

In Firewall: Rules: LAN, allow access from LAN only to the Tor SocksPort:

edit default allow rule
allow TCP from LAN subnet to 192.168.1.1 port 9050
save and apply changes

The pfSense Tor-gateway VM only needs to access your entry guards, and NTP servers so that Tor has the correct time. For additional security, you can create rules on WAN that allow that, and block all other outbound traffic. Working at the command line in the pfSense console, view your entry guards:

cat /var/db/tor/state | less

Browse Atlas and get the corresponding IP addresses. Browse Firewall: Aliases: IP, and create an alias for those IPs. You will need to update the alias periodically as your entry guards change. Also create an alias for the pfSense NTP server <0.pfsense.pool.ntp.org>. Then use those two aliases to create outbound pass rules in Firewall: Rules: WAN. At the bottom, add a block rule for everything else.

Finally, in System: Advanced: Miscellaneous: Gateway Monitoring, check Skip Rules When Gateway is Down and hit Save. Now your pfSense VM provides a Tor SocksPort, and blocks all other traffic.

Please see my answer to this question for advice about paying anonymously for VPN services.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.