0

My problem is what if I do sniffing and later I want to extract urls/analyze with suricata, Im getitng them prepended :9040 to all urls, but I see what it really uses tor exit node, so I want to get rid on that :9040

  • example - http://ipinfo.io:9040/

I have read https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, and it was working till a bit ago, I have the identical setup on another pc and it works there

This sound like some dnat/masquerade problem, but I have next rules:

  • iptables -t nat -A POSTROUTING -o virbr0 -j MASQUERADE # I have tried add also rule as this but for input traffic, to have both
  • iptables -t nat -A PREROUTING -i virbr0 --source 192.168.1.X -p tcp --syn ! --dport X -j REDIRECT --to-ports 9040 # I have triedd change redirect to dnat --to-destination 192.168.1.1:9040, and no change, the same result

  • Software

    • tor 0.3.2.9-1~xenial+1
    • ubuntu 16.04
    • iptables 1.6.0-2ubuntu3
    • ii libpcap-dev 1.7.4-2
    • un libpcap0.7-dev
    • ii libpcap0.8:amd64 1.7.4-2
    • ii libpcap0.8-dev 1.7.4-2
  • torrc:

    • TransPort 192.168.1.1:9040
    • DNSPort 192.168.1.1:5353
  • tcpdump sniffing i see connection as:

    • 192.168.1.x.49210 > 192.168.1.1.9040

Any idea what can be wrong?

Thanks in advance

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • If the transparent proxy is working as intended, this seems like a question about iptables and libpcap and how they interact with each other and not directly about Tor? – cacahuatl Feb 19 '18 at 12:22
  • kinda is what I was thinking, but i remember on some of my tests when I set ``` TransPort 0.0.0.0:9040 DNSPort 0.0.0.0:5353 ``` i had the same problem, but then i restored it and worked just fine till few days ago – DoomedRaven Feb 19 '18 at 12:23
0

ok i have solved the problem.

it's related to docker update and change of the kernel network filter, more details here https://forums.fedoraforum.org/showthread.php?312824-Bridge-broken-after-docker-install&p=1785664#post1785664

setting them to 0 looks like solve my problem

net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0 net.bridge.bridge-nf-call-arptables=0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.