0

we want to configure a TOR router to route public static IP addresses to hidden services.

Currently we have the following setup working:

VirtualAddrNetworkIPv4 10.192.0.0/10
VirtualAddrNetworkIPv6 [FC00::]/7
AutomapHostsOnResolve 1
TransPort 127.0.0.1:9040
TransPort     [::1]:9040
DNSPort   127.0.0.1:5300
DNSPort       [::1]:5300

iptables  -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040
ip6tables -t nat -A OUTPUT -p tcp -d FC00::/7      -j REDIRECT --to-ports 9040

My first idea was to use the public static IP-networks with the PREROUTING chain. Updating the IP-addresses every 60 seconds is a no-go as DNSSEC will be used to validate the DNS A/AAAA-record lookups. We also need additional DNS-records (e.g. MX-RRs) which won't work with the TOR resolver.

I already tried

MapAddress <hidden service>.onion 10.192.0.4

which results in a correct A-RR when VirtualAddrNetworkIPv4 is uncommented. But TOR doesn't route the packets.

Thanx for any hint,

Renne

1

This is a pretty simple task, just to answer the question, here is how you'd do it....

But before you read how, repeat after me:

"I should never actually do this!"

Hypothetically, if this was ever actually useful, which it isn't, and assuming your onion is foo.onion and your public IP is 1.2.3.4

torrc like this:

TransPort 1.2.3.4:9040 # 
SocksPort 0 # we dont need this
MapAddress 1.2.3.4 foo.onion # connections for our public IP are mapped to the onion

Then we use iptables to set some incoming traffic for whatever our chosen port is, say 80, to redirect to the TransPort, for example:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9040

Port 80 on our public IP would be passed into TransProxy, the destination IP 1.2.3.4 in TransProxy would be mapped to foo.onion and the communications passed on to foo.onion and the response send back to whomever was connecting to 1.2.3.4.

Update:

The TransPort can be set once for many ports, the original destination and port are recovered after the -j REDIRECT rule through use of getsockopt() calls (see SO_ORIGINAL_DST), so many destination ports and IPs can map to a single TransPort instantiation.

And my issue is that while the server is protected, the users are not receiving any protection from Tor. It constitutes the "SSL Added And Removed Here :¬)" security anti-pattern, as seen in tor2web and similar projects.


P.S. Yes, I am aware I'm a terrible human being for actually answering this query but sometimes you gotta let them shoot themselves in the foot after failing to heed all warnings.

  • For the sake of being complete, why is this a bad idea? – SuperSluether Aug 22 '16 at 4:06
  • 1
    Because the incoming connection isn't protected at all. – cacahuatl Aug 22 '16 at 4:34
  • @canonizing ironize From the view of pure TOR it's bad, of course. We want to create a network of TOR nodes but we still need access for clearnet users. The plan is to use TLS for the clearnet-users and validate the TLS-certificates with DNS-based Authentication of Named Entities. That way at least the content is protected for the clearnet users. We will encourage clearnet-users to run their own TOR node, of course. Currently this approach is definitely better than clearnet only. ;-) Is a "TransPort"-Statement necessar – Renne Aug 23 '16 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.