we want to configure a TOR router to route public static IP addresses to hidden services.

Currently we have the following setup working:

VirtualAddrNetworkIPv6 [FC00::]/7
AutomapHostsOnResolve 1
TransPort     [::1]:9040
DNSPort       [::1]:5300

iptables  -t nat -A OUTPUT -p tcp -d -j REDIRECT --to-ports 9040
ip6tables -t nat -A OUTPUT -p tcp -d FC00::/7      -j REDIRECT --to-ports 9040

My first idea was to use the public static IP-networks with the PREROUTING chain. Updating the IP-addresses every 60 seconds is a no-go as DNSSEC will be used to validate the DNS A/AAAA-record lookups. We also need additional DNS-records (e.g. MX-RRs) which won't work with the TOR resolver.

I already tried

MapAddress <hidden service>.onion

which results in a correct A-RR when VirtualAddrNetworkIPv4 is uncommented. But TOR doesn't route the packets.

Thanx for any hint,


1 Answer 1


This is a pretty simple task, just to answer the question, here is how you'd do it....

But before you read how, repeat after me:

"I should never actually do this!"

Hypothetically, if this was ever actually useful, which it isn't, and assuming your onion is foo.onion and your public IP is

torrc like this:

TransPort # 
SocksPort 0 # we dont need this
MapAddress foo.onion # connections for our public IP are mapped to the onion

Then we use iptables to set some incoming traffic for whatever our chosen port is, say 80, to redirect to the TransPort, for example:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9040

Port 80 on our public IP would be passed into TransProxy, the destination IP in TransProxy would be mapped to foo.onion and the communications passed on to foo.onion and the response send back to whomever was connecting to


The TransPort can be set once for many ports, the original destination and port are recovered after the -j REDIRECT rule through use of getsockopt() calls (see SO_ORIGINAL_DST), so many destination ports and IPs can map to a single TransPort instantiation.

And my issue is that while the server is protected, the users are not receiving any protection from Tor. It constitutes the "SSL Added And Removed Here :¬)" security anti-pattern, as seen in tor2web and similar projects.

P.S. Yes, I am aware I'm a terrible human being for actually answering this query but sometimes you gotta let them shoot themselves in the foot after failing to heed all warnings.

  • For the sake of being complete, why is this a bad idea? Aug 22, 2016 at 4:06
  • 1
    Because the incoming connection isn't protected at all.
    – cacahuatl
    Aug 22, 2016 at 4:34
  • @canonizing ironize From the view of pure TOR it's bad, of course. We want to create a network of TOR nodes but we still need access for clearnet users. The plan is to use TLS for the clearnet-users and validate the TLS-certificates with DNS-based Authentication of Named Entities. That way at least the content is protected for the clearnet users. We will encourage clearnet-users to run their own TOR node, of course. Currently this approach is definitely better than clearnet only. ;-) Is a "TransPort"-Statement necessar
    – Renne
    Aug 23, 2016 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .