Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
I would like to know how I can tunnel a VPN thru TOR. Like so,
ME ---> TOR ---> VPN ---> WEBSITE
This way, my visible IP address is that of my VPN, and not the TOR exit node. And, my VPN's traffic is tunneled thru the TOR network and comes out the other end.
Is there any easy way of doing this on Windows 10?
Considering many websites block traffic from TOR exit relays, I'd be surprised if there wasn't an easy way of configuring this kind of setup.
From: https://privacy.net/what-is-tor/
Tor over VPN:
With Tor over VPN, you connect to the VPN first, then use the Tor browser. It’s simple and effective.
Your traffic will go through the VPN server before it gets to the Tor entry node. This means that the VPN server can only see that you’re connected to Tor and can’t see where your traffic is going. Going back to your ISP, it only sees that you’re connected to a VPN server, and nothing beyond that. This means your ISP can’t see that you’re connected to a Tor entry node.
VPN over Tor:
This setup is a little more complex and doesn’t really offer additional anonymity. In this case, your traffic goes through Tor first. Your ISP can still see you’re connected to the Tor network, the Tor entry node can see your real IP address, and you still need to trust you VPN as it can see where your traffic is going.
One issue VPN over Tor does alleviate is the Tor exit node being able to see which site you’re visiting. Instead, it simply sees that you are connecting to a VPN server. One downside to this is that your VPN login information could be viewed by the Tor exit node operator. Another benefit of this setup is that websites which normally block Tor traffic will be unblocked.
Simply include the option socks-proxy server [port] in your OpenVPN client configuration, and it will use Tor as a socks proxy.
Here is a link how to do it: https://privatevpn.com/blog/guides/80/how-to-connect-to-privatevpn's-openvpn-servers-over-tor
It is what user 2020 said. You need to rout VPN traffic over (local) proxy tor. For this you got to edit the ovpn file. OVPN are configuration files for openvpn. It is an open-source vpn program. Nearly every VPN provider works with it and builds its own program based on openvpn.
So:
socks-proxy 127.0.0.1 9050
route [IP of your entry guard/node] 255.255.255.255 net_gateway
tor has a build in proxy you can use it to connect to from other programs. 127.0.0.1 is the loopback address. That is essentially your own PC. 9050 is the standard proxy port of tor. Route changes the Routing table (for further explanation of the routing table, google that one. It is too much too explain here). Changing the routing table might not be needed in Windows other than in Linux. You could try it first without the last line.
Late answer, but this may help others who wish to achieve the same.
This takes a little circuitous route, but IMHO more safer than other options provided.
Download and install Whonix from here, then follow the steps mentioned here & an example setup here to achieve User > Tor > VPN > Internet
Why Whonix?
DNS leaks are impossible as all connections are forced through Tor or blocked.
Few things to consider:
https://www.ghacks.net/2017/08/14/turn-off-smart-multi-homed-name-resolution-in-windows/
Jan 2022.
Hey folks... WORDS MATTER when describing a process or method to help the average (non-expert) computer user. You are NOT talking to fellow geeks on this web site and you should keep that in mind when you post. Please be PRECISE and COMPLETE in your choice of words so we can ALL understand what you are trying to convey. ASSUMING we start with the same computer shorthand or understanding as you may have, is not "helpful" it's FRUSTRATING in the extreme. Also, please do not just provide a link to highly technical web sites that also DO NOT SOLVE the question asked !
That said, a question that asks how to set up "vpn OVER Tor" is the EXACT OPPOSITE of a question asking how to set up "Tor over VPN". Usually, responders don't even READ the question and instead, try to SELL you a subscription to a VPN service.
This latter set up is discouraged by the genuine TOR Project for good reason. In that scenario, you are trusting your REAL IP address to a VPN provider who may or may not keep logs of it, and may associate it with your REAL payment information. So called "free" VPNs (despite their self-congratulatory hype and bought-and-paid-for "endorsers")may not be located beyond the reach of subpoena power, may not have rigorous encryption, and may be monetizing YOUR information for their profit. Think about it... other than TOR (and to an extent Protonmail) who do you know that keeps NO LOGS, never retrieves your IP address AND provides a truly "free" tool for real anonymity ?? By the way, I don't work for EITHER of those organizations, or for TOR, and have no interest except in trying to find the most truly anonymous way for ordinary, law-abiding, non-abusive users who nevertheless VALUE their anonymity, to connect to those idiotic but necessary web sites like Craigslist who choose to block ALL Tor traffic.
If you are being blocked from accessing any particular website, you use Tor as your main browser on a Windows 10 system, you should know certain basics. First, most websites are "hosted" on a "secure" platform that provides the website's owner with a bundle of services such as a payment portal, analytics to help the website owner know what is working or not working and who the website's actual v. expected audience is, 24/7 maintenance and guaranteed accessibility of the website in question, "security" from malicious attacks that might overload and shut down the website, identification of those "malicious actors" so the web site can take legal action against them, and storage for information the website would like to collect from its users.
Depending on the platform a website creator chooses to host their site, the methods of providing protection from those malicious attacks of abusive uses of their site varies. So too, does the platform's method of identifying the alleged offender. For a basic understanding of how different hosting platforms choose to provide security protections to THEIR website creator customers, see this excellent post edited by Alexander Færøy http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/legacy/trac/-/wikis/org/doc/ListOfServicesBlockingTor. To gain an understanding of a platform provider's thinking on the use of Tor... checkout this posting from CloudFlare https://blog.cloudflare.com/the-trouble-with-tor/ .
In some cases, a particular website has its OWN blocking algorithm or threshold page that any request for access to its website must pass through before a typical user can view or use their site.
THIS IS THE CASE WITH CRAIGSLIST.
Typically when a website chooses to do its own "policing" rather than have their site independently "hosted" by a platform... they use the "meat cleaver" rather than the "surgical" approach to "keeping the bad guys off their site". Often the criteria they use (beyond specific incidents of abuse or non-compliance with their posting policies, is to just ban ALL internet traffic coming from certain "exit nodes" (ie the last computer IP address to connect directly to their site)and sometimes ALL IP addresses associated with those "suspect" exit nodes.
Since the TOR network has a limited number of
exit nodes (though they are constantly trying to get more), and since TOR makes the IP addresses of all THEIR registered exit nodes PUBLIC (in order to protect the identity of YOUR real IP address), It is not difficult for a website such as Craigslist to simply block all traffic coming from, and IP addresses associated with, those exit nodes. In effect, they block Tor, they block YOU.
It is important to understand that most such site specific blocks are NOT based on YOUR personal computer's IP address, nor on its specific and unique device ID, but rather on the IP address and (maybe) the unique device id of the Tor network server (computer)which is the last computer in the chain that directly connects to the web site you want to view. Tor is a relay system and all you, the user, put into that relay is a request (search)and a temporary delivery address.
The first Tor network computer only knows that your IP made a request (which is encrypted) for something on the internet(it doesn't know what the request was)and it sends that message to only the next randomly selected computer in the daisy chain. The second Tor network computer only knows that it got a message from the first Tor computer with instructions to pass it on. The last Tor network computer (exit node) only knows that it got a message from the second or third Tor network computer to request info from a certain website. The destination website only knows that the last Tor network computer requested permission to view or get information from it. Whatever the website provides to the last Tor network computer is encrypted, wrapped in a message and sent back through the network only to be unencrypted and read AFTER it is safely back on your computer. Tor does not log the original request or where it came from so it can't turn over that information to anyone.
Accordingly, it won't help you get access to these kinds of Tor blocking sites to change your personal device ID, or your personal IP address. These are two different things, by the way. In Widows 10, your actual PC has a unique ID, but also each separate PART of that PC (like your card reader,motherboard, storage, video/graphics card, sound card, monitor, USB readers, etc.) EACH have their own unique "hardware device ID". Too many folks providing advice out there use all three terms as if they are interchangeable, they are NOT !!
This is why IF you have to circumvent TOR blocking sites... the safest configuration is You ==> TOR ==> Free Protonmail VPN. The advantage of this setup is that you never give to ANYONE your personal details. You can use a disposable e-mail to get the Free Protonmail VPN. Tor doesn't require ANYTHING to download its browser bundle. Both organizations have a LONG and extensively reviewed track record on NOT keeping logs, or collecting your IP address.
Ideally, you would set up one FREE Protonmail VPN as the proxy INSIDE the Tor browser which would keep even your ISP (Internet Service Provider) from knowing you use Tor as a browser (connect to the internet via proxy option) AND also be able to use a second FREE Protonmail VPN as the exit node at the END of the Tor relay daisy chain. It seems possible to set up 2 different FREE VPNs through Protonmail by just using 2 different disposable e-mails to get two different VPNs. Since Protonmail is committed to user privacy as its reason for being, there should not be any objection.
The difficulty is that I'm not exactly sure how to properly configure TOR (and/or Windows 10) for each part of the protection (VPN set as proxy in Tor Browser) and then (separate VPN as set as the preferred exit node in Tor relay).
If someone could lay out that process in a CLEAR, UNDERSTANDABLE, step-by-step process you would be doing all of us a HUGE favor. If I can figure it out, I'll update this post and fill you in... but I am NOT a real computer guru so it could take a long while.
Hope this helps !
