2

I have configured a router to route all traffic from an internal interface through the TOR network. Therefore, every client that uses this router as its Gateway will access the internet through TOR, regardless which application is running. This is my setup on the router:

- eth2 is the internal device (192.168.1.1)
- TOR listens on eth2 for connections from LAN clients
- eth0 is the device that connects to the internet

My torrc setup:

...
TransPort 192.168.1.1:9040
DNSPort 192.168.1.1:9053
...

My iptables on the Gateway (192.168.1.3 is the client that may connect):

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth2 -p udp -m udp --dport 53 -j REDIRECT --to-ports 9053
-A PREROUTING -i eth2 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -s 192.168.1.3/32 -i eth2 -p udp -m udp --dport 9053 -j ACCEPT
-A INPUT -s 192.168.1.3/32 -i eth2 -p tcp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -d 192.168.1.3/32 -o eth2 -j ACCEPT
-A OUTPUT -o eth0 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT

To test that no DNS requests are leaked I used the method described here. However, it does not give an example of what the expected results should be. So I issued the following commands and got the following output:

$ tcpdump -pni eth2 'port domain'
18:59:33.158511 IP 192.168.1.3.53413 > 8.8.8.8.53: 20625+ AAAA? check.torproject.org. (38)
18:59:33.212772 IP 192.168.1.3.53494 > 8.8.8.8.53: 15545+ A? check.torproject.org. (38)
18:59:33.448883 IP 8.8.8.8.53 > 192.168.1.3.53413: 20625 NXDomain 0/0/0 (38)
18:59:33.451545 IP 192.168.1.3.39311 > 8.8.8.8.53: 58625+ AAAA? check.torproject.org. (38)
18:59:33.539581 IP 8.8.8.8.53 > 192.168.1.3.53494: 15545 1/0/0 A 138.201.14.212 (54)
18:59:33.808832 IP 8.8.8.8.53 > 192.168.1.3.39311: 58625 NXDomain 0/0/0 (38)
18:59:33.810768 IP 192.168.1.3.60437 > 8.8.8.8.53: 61942+ A? check.torproject.org. (38)
18:59:34.072359 IP 8.8.8.8.53 > 192.168.1.3.60437: 61942 1/0/0 A 138.201.14.212 (54)

I ran also ran the commands on the outgoing device eth0

tcpdump -pni eth0

which yielded no output at all.

I have two questions:

  1. Does the output of tcpdump proof that no DNS requests from the client were leaked?
  2. Are the iptables rules reasonable for my purpose?
Improve this question
4
  • You probably want to remove RELATED from ACCEPTed the conntrack states.
    – cacahuatl
    Commented Oct 5, 2017 at 21:07
  • Regarding the observed traffic, you have to consider where IPTables is picking this up. For the best indication of any leaks, you want to sniff upstream of the Tor Router (I.E. between it and the internet). (note that Tor Routers are in general a bad idea unless you've made extensive changes to your operating systems default behaviour). You are likely seeing these packets before they hit the REDIRECT rule.
    – cacahuatl
    Commented Oct 6, 2017 at 1:39
  • @canonizingironize Why are TOR routers a bad idea? Can you point me to a source where the caveats are described in detail?
    – user7071120
    Commented Oct 6, 2017 at 10:03
  • Using ethernet, you can skip the stuff about wireless cryptography but I've written some of the points up here: github.com/epidemics-scepticism/writing/blob/master/…
    – cacahuatl
    Commented Oct 6, 2017 at 16:06

1 Answer 1

Reset to default
1

Android devices do ignore DHCP DNS server, remember. So - it looks like this? I've met this problem too. The only really working workaround is to forcibly route all dns requests to 8.8.8.8 and 8.8.4.4 to the port 9053 in yor case - and block the IP addresses of 8.8.8.8 and 8.8.4.4 to be routed through Tor, I've found no other way

Improve this answer
2
  • -A PREROUTING -i eth2 -p udp -m udp --dport 53 -j REDIRECT --to-ports 9053 that's literally already happening...
    – cacahuatl
    Commented Oct 5, 2017 at 22:52
  • yes, but just to be 100% sure I do recommend to block the addresses on by-ip basis, so no other possibilities will be there. Also it fixes Android client problem, when you can not resolve dot-onion names just by joining the network.
    – Alexey Vesnin ♦
    Commented Oct 5, 2017 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .