VPN through Tor. Are there any errors in my settings and can anonymity be improved?

Question

I need to route traffic from multiple mobile apps and all sites through tor.

Some apps and websites block tor traffic. For this reason, I decided to use tor and vpn together (vpn through tor). I know this may carry additional problems for anonymity, but I think it's reasonable compromise.

I have:

1. Gateway: Debian 11 live, installed tor, redsocks, nftables. 2 network interfaces: wifi connected to the internet, ethernet to workstation.
2. Workstation: Debian 11 live, genymotion android emulator, tor browser, vpn client. 1 network interface: ethernet connected to the gateway

I don't understand networking, security, etc., but the information I found on different sites says that separating the gateway and the workstation avoids some anonymity issues.

I use debian live because I want to use amnesic os, but I have very old motherboards and can't run tails on this one.

The gateway has the following settings:

torrc

SocksPort 192.168.42.1:20080
DNSPort 192.168.42.1:10053

redsocks.conf

base {
    log_debug = off;
    log_info = on;
    log = stderr;
    daemon = off;
    redirector = iptables;
}

redsocks {
    local_ip = 192.168.42.1;
    local_port = 10080;
    ip = 192.168.42.1;
    port = 20080;
    type = socks5;
}

nftables

table inet filter { # handle 45
    chain input { # handle 1
        type filter hook input priority filter; policy accept;
        iifname "lo" counter packets 0 bytes 0 accept # handle 4
    }

    chain forward { # handle 2
        type filter hook forward priority filter; policy accept;
    }

    chain output { # handle 3
        type filter hook output priority filter; policy accept;
    }
}
table ip nat { # handle 46
    chain PREROUTING { # handle 1
        type nat hook prerouting priority filter; policy accept;
        iifname "enp2s0" tcp dport { 1-65500 } counter packets 0 bytes 0 dnat to 192.168.42.1:10080 # handle 3
        iifname "enp2s0" udp dport { 53 } counter packets 0 bytes 0 dnat to 192.168.42.1:10053 # handle 12
    }
}

/etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

To not route tor via tor, but to use the tor browser advantages (noscript, disabled webrtc, automatic cookie cleaning, etc.) I disabled the connection of the tor browser to the tor network by making the following settings in about:config

extensions.torlauncher.start_tor = FALSE
network.dns.disabled = FALSE
network.proxy.socks_remote_dns = FALSE
network.proxy.type, 0

As for vpn, I installed the client for ubuntu 20, not for debian, because it has a configured killswitch, and I could not configure this myself

For me these settings work, all workstation traffic is routed through torus and vpn, but i would like to know

1. Are DNS leaks possible with such settings?
2. Is it safe to run js in tor browser?
3. Any tips and tricks on how can I improve my anonymity, what additional settings need to be made and what vulnerabilities are in the scheme I described?

I will be grateful for any advice.

Answer 1

The physical separation of the gateway and it's client(s) is a right thing to do for sure - it eliminates a lot of attack vector families, but your setup is wrong. On the gateway you need just Tor and it should be set up according to your software list - this way:

• Tor intermediate node - it has open ORPort, utilizes UPNP NAT punch(optionally, but handy)
• Firewall - it allows no traffic from ethernet interface except SSH and tor SOCKS5, HTTP, DNS and bridge
• Local bridge - use obfs4 for your locally installed tor instance
• No routing! No packet forwarding - drop everything else to avoid data and traffic leaks and to gain a full benefit from a physical separation of the gateway

On your client:

• System-wide DNS config - point it to the gateway's Tor DNS port, no search line in resolv.conf! Just like that: nameserver 10.0.0.1
• System-wide environment proxy settings - point them to the gateway Tor's HTTP and SOCKS5s proxies via HTTP_PROXY=... in a system global shell profile variables and reboot the client to make sure it's applied before any usage!
• Tor browser - add your local bridge by it's static IP as the only one
• Tor instance - if you have it separately - same as Tor browser, be sure to set ClientOnly 1
• VPN client - point it to the gateway's Tor proxy that fits your client best, any normal client has either HTTP/HTTPS or SOCKS5 proxy support, pick the one you need
• Genymotion emulator - you better use a connection properties and set the proxy server manually along with the static IP. Android bug/feature is that it's always using Google's DNS, it can be a problem on some old builds. If it's your case - just forward TCP and UDP ports for 8.8.8.8 and 8.8.4.4 and 1.1.1.1(Amazon DNS, sometimes hardcoded into the applications) to your gateway's DNS port on the client side

That's it!