This can be done using VirtualBox VMs. It's easy with Whonix. Just set up a VPN client in the workstation VM in
/etc/openvpn/, and add
socks-proxy 192.168.0.10 9150 up and
socks-proxy-retry to the configuration file. The requirement for an
up proxy-authentication file is an OpenVPN bug. The
up file must exist, but it's not parsed, so its content doesn't matter. You'll need to reconfigure apps that are set up to use the Whonix gateway as proxy.
A lighter solution uses a pfSense VM that provides a Tor SocksPort. In the simplest case, you would use this with a Linux VM running a VPN client and Tor Browser. More generally, you could use the pfSense Tor-gateway VM with various pfSense VPN-client VMs to construct nested chains of VPNs and Tor.
In order to use the latest Tor release, you need to build a Tor package in FreeBSD 8.3 from the latest port:
[create local FreeBSD VM with 1024 MB RAM and 200 GB thin VDI]
portsnap fetch extract
Now you can install Tor in pfSense 2.1.4 as described here. But don't do the proxy server part, just Tor install. You can get your new packages into pfSense using
Diagnostics: Execute command: Upload in the webGUI. Before installing, move the package files from
/root/ by running
mv /tmp/[package].tbz /root/. Then work in the pfSense console, hitting
enter for a command line. You will need to fix the libevent 2.0 screwup by adding two links:
ln -s /usr/local/lib/event2/libevent-2.0.so.6 /usr/lib/libevent-2.0.so.6
ln -s /usr/local/lib/event2/libevent_openssl-2.0.so.6 /usr/lib/libevent_openssl-2.0.so.6
Edit torrc using
Now reboot the pfSense VM. Tor should be running. Using the webGUI, lock down pfSense. First delete all outbound NAT routes in
Firewall: NAT: Outbound:
select "Manual Outbound NAT rule generation", save and apply changes
check all outbound NAT routes, and delete using [x] at lower right
save and apply changes
Firewall: Rules: LAN, allow access from LAN only to the Tor SocksPort:
edit default allow rule
allow TCP from LAN subnet to 192.168.1.1 port 9050
save and apply changes
The pfSense Tor-gateway VM only needs to access your entry guards, and NTP servers so that Tor has the correct time. For additional security, you can create rules on WAN that allow that, and block all other outbound traffic. Working at the command line in the pfSense console, view your entry guards:
cat /var/db/tor/state | less
Browse Atlas and get the corresponding IP addresses. Browse
Firewall: Aliases: IP, and create an alias for those IPs. You will need to update the alias periodically as your entry guards change. Also create an alias for the pfSense NTP server <0.pfsense.pool.ntp.org>. Then use those two aliases to create outbound pass rules in
Firewall: Rules: WAN. At the bottom, add a block rule for everything else.
System: Advanced: Miscellaneous: Gateway Monitoring, check
Skip Rules When Gateway is Down and hit
Save. Now your pfSense VM provides a Tor SocksPort, and blocks all other traffic.
Please see my answer to this question for advice about paying anonymously for VPN services.