I'm new to TOR and I'm trying to anonymize Internet connections from an automated malware analysis lab. All my machines are in the same subnetwork, and I just specify my TOR machine as a gateway for infected machines.
Here is my basic torrc configuration :
VirtualAddrNetwork 10.192.0.0/10 AutomapHostsSuffixes .onion,.exit AutomapHostsOnResolve 1 TransPort 9040 DNSPort 53 TransListenAddress 0.0.0.0 DNSListenAddress 0.0.0.0
I only have one network interface and I can't make it work when dealing with iptables. My basic idea was just to redirect any DNS connection from an infected machine to local port 53 (DNSPort), and any TCP connections from these machines to port 9040 (TransPort).
My first idea about iptables rules was something like :
iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p udp --dport 53 -j REDIRECT --to-ports 53 iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p tcp -j REDIRECT --to-ports 9040
Since I have a rather basic knowledge of iptables, it doesn't work and I think this "obvious" way can't work with only one interface. By the way I'm probably missing something obvious.