1

I am using raspbian configured as an AP with a Wifi dongle and an ethernet out.

AP works fine, I can connect and get an IP on the WIFI part.

Forwarding seems to work as I can also get a website from a wireless device and a Traceroute also shows me routing from wifi to ethernet, but TOR doesn't seem to be operating.

Status is showing as working fine but if I go to ipchicken it shows my real IP address.

For configuration, I followed these instructions but changed the IP addresses for translisten and DNS listen to the ethernet address of the Pi. From a flow perspective, my device connects to the Pi AP, this then forwards to the Pi Ethernet port, which then uses my ADSL router gateway to enter the internet. That works fine but it shows my public IP address still. Am I missing a piece?

Update: it is currently working. The IPTables commands for ports 53 and 9040 seem to reset on reboot. I have to re-enter them. I did the save as listed. Any ideas how to make them load?

  • You've probably configured it wrong. What steps did you take? What configuration options did you use? – cacahuatl Feb 1 '17 at 1:47
  • HiI followed these instructions. learn.adafruit.com/onion-pi/install-tor but changed the IP addresses for translisten and DNS listen to the ethernet address of the Pi – UKTor Feb 1 '17 at 14:03
  • From a flow perspective, my device connects to the Pi AP, this then forwards to the Pi Ethernet port, which then uses my ADSL router gateway to enter the internet. That works fine but it shows my public IP address still. Am I missing a piece? – UKTor Feb 1 '17 at 14:14
  • 1
    Update.....So it is currently working. The IPTables commands for ports 53 and 9040 seem to reset on reboot. I have to re - enter them. I did the save as listed. Any ideas how to make them load? Thanks – UKTor Feb 1 '17 at 14:37
1

The issue is the iptables-save step, there's nothing in that tutorial that makes that reload on boot.

You'll notice the tutorial states:

It will automatically get loaded when the networking is set up on reboot (as we did in the last tutorial on making a Pi access point)

It's clearly expecting an extra step, specifically you should install iptables-persistent and issue the command sudo sh -c "iptables-save > /etc/iptables/rules.v4", otherwise you'd need to manually issue an iptables-restore command to re-establish the iptables rules.

0

For IPTables in wifi AP case on ARM SBC there's a trick, and let me explain how it's done properly:

  • First of all - make your firewall rules in a single shell script. These rules are not for forwarding - just your ones, i.e. allow SSH and block other stuff
  • Then make a ruleset for adding TransPort forwarding and for deleting it, i.e. after the execution of deletion script the only rules remaining are the ones you're added in step 1
  • In /etc/rc.local add execution of the add-rules scripts, both of them. It will bring it up on reboot
  • Step four - the most tricky one: wifi dongles are used to overheat or replug, and in some cases after interface diappearing it's the odd condition: rules for it are missing. So add your step 3 rules to ifup/ifdown scripts for a wifi interface. So if it will replug by whatever reason - the rules will be just fine. To avoid double adding on boot-up I'm using a file-as-a-flag mechanism: on forwarding-add script it's created and on forward-delete script it's removed, so no double-adding occuring. Or you can make a list of rules and check if there's ones.

Without step four even a PCI wifi cards are the source of "replugging bug", a shiny example of this is a D-Link PCI adapters, they do overheat under a load and don't have a factory-attached heatsink. Usb ones are causing it more frequent - under the load. So to check it try to transmit and receive a lot of data like from /dev/random on one host to /dev/null on another - just make a constant load. Some USB sticks can hangover even in 5-7 minutes.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.