I need to route traffic from multiple mobile apps and all sites through tor.

Some apps and websites block tor traffic. For this reason, I decided to use tor and vpn together (vpn through tor). I know this may carry additional problems for anonymity, but I think it's reasonable compromise.

I have:

  1. Gateway: Debian 11 live, installed tor, redsocks, nftables. 2 network interfaces: wifi connected to the internet, ethernet to workstation.
  2. Workstation: Debian 11 live, genymotion android emulator, tor browser, vpn client. 1 network interface: ethernet connected to the gateway

I don't understand networking, security, etc., but the information I found on different sites says that separating the gateway and the workstation avoids some anonymity issues.

I use debian live because I want to use amnesic os, but I have very old motherboards and can't run tails on this one.

The gateway has the following settings:




base {
    log_debug = off;
    log_info = on;
    log = stderr;
    daemon = off;
    redirector = iptables;

redsocks {
    local_ip =;
    local_port = 10080;
    ip =;
    port = 20080;
    type = socks5;


table inet filter { # handle 45
    chain input { # handle 1
        type filter hook input priority filter; policy accept;
        iifname "lo" counter packets 0 bytes 0 accept # handle 4

    chain forward { # handle 2
        type filter hook forward priority filter; policy accept;

    chain output { # handle 3
        type filter hook output priority filter; policy accept;
table ip nat { # handle 46
    chain PREROUTING { # handle 1
        type nat hook prerouting priority filter; policy accept;
        iifname "enp2s0" tcp dport { 1-65500 } counter packets 0 bytes 0 dnat to # handle 3
        iifname "enp2s0" udp dport { 53 } counter packets 0 bytes 0 dnat to # handle 12



To not route tor via tor, but to use the tor browser advantages (noscript, disabled webrtc, automatic cookie cleaning, etc.) I disabled the connection of the tor browser to the tor network by making the following settings in about:config

extensions.torlauncher.start_tor = FALSE
network.dns.disabled = FALSE
network.proxy.socks_remote_dns = FALSE
network.proxy.type, 0

As for vpn, I installed the client for ubuntu 20, not for debian, because it has a configured killswitch, and I could not configure this myself

For me these settings work, all workstation traffic is routed through torus and vpn, but i would like to know

  1. Are DNS leaks possible with such settings?
  2. Is it safe to run js in tor browser?
  3. Any tips and tricks on how can I improve my anonymity, what additional settings need to be made and what vulnerabilities are in the scheme I described?

I will be grateful for any advice.

1 Answer 1


The physical separation of the gateway and it's client(s) is a right thing to do for sure - it eliminates a lot of attack vector families, but your setup is wrong. On the gateway you need just Tor and it should be set up according to your software list - this way:

  • Tor intermediate node - it has open ORPort, utilizes UPNP NAT punch(optionally, but handy)
  • Firewall - it allows no traffic from ethernet interface except SSH and tor SOCKS5, HTTP, DNS and bridge
  • Local bridge - use obfs4 for your locally installed tor instance
  • No routing! No packet forwarding - drop everything else to avoid data and traffic leaks and to gain a full benefit from a physical separation of the gateway

On your client:

  • System-wide DNS config - point it to the gateway's Tor DNS port, no search line in resolv.conf! Just like that: nameserver
  • System-wide environment proxy settings - point them to the gateway Tor's HTTP and SOCKS5s proxies via HTTP_PROXY=... in a system global shell profile variables and reboot the client to make sure it's applied before any usage!
  • Tor browser - add your local bridge by it's static IP as the only one
  • Tor instance - if you have it separately - same as Tor browser, be sure to set ClientOnly 1
  • VPN client - point it to the gateway's Tor proxy that fits your client best, any normal client has either HTTP/HTTPS or SOCKS5 proxy support, pick the one you need
  • Genymotion emulator - you better use a connection properties and set the proxy server manually along with the static IP. Android bug/feature is that it's always using Google's DNS, it can be a problem on some old builds. If it's your case - just forward TCP and UDP ports for and and DNS, sometimes hardcoded into the applications) to your gateway's DNS port on the client side

That's it!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .