0

I want to install Tor in my router but I don't want to use its SOCK5 port but its TransPort directly in the machine side and forward the traffic to bridges (to use with virtual machines).

The router has the address 192.168.1.1 and my machine 192.168.1.33

I didn't do this yet, but I made a test with network namespaces (it would be the same as if it was done with router address, 192.168.1.1):

ip netns add nsx
ip netns add nsy
ip link add vethx type veth peer name peerx netns nsx
ip link set vethx up
ip address add 10.0.0.1/24 dev vethx
ip netns exec nsx ip link set peerx up
ip netns exec nsx ip address add 10.0.0.2/24 dev peerx
ip netns exec nsx ip link add vethy type veth peer name peery netns nsy
ip netns exec nsx ip link set vethy up
ip netns exec nsx ip address add 10.0.1.1/24 dev vethy
ip netns exec nsx sysctl -w net.ipv4.conf.peerx.forwarding=1
ip netns exec nsx sysctl -w net.ipv4.conf.vethy.forwarding=1
ip netns exec nsy ip link set peery up
ip netns exec nsy ip address add 10.0.1.2/24 dev peery
ip netns exec nsy ip route add default via 10.0.1.1 dev peery
ip netns exec nsx iptables -t nat -A PREROUTING -i vethy -p tcp --syn -j DNAT --to-destination 10.0.0.1:19040
ip netns exec nsx iptables -t nat -A POSTROUTING -p tcp -s 10.0.1.2 -d 10.0.0.1 --dport 19040 -j SNAT --to-source 10.0.0.2
ip netns exec nsx iptables -I FORWARD -o peerx -i vethy -p tcp -s 10.0.1.2 -d 10.0.0.1 --dport 19040 -j ACCEPT
ip netns exec nsx iptables -I FORWARD -i peerx -o vethy -m state --state ESTABLISHED,RELATED,NEW -d 10.0.1.2 -s 10.0.0.1 -j ACCEPT
iptables -t nat -A PREROUTING -i vethx -p tcp -j DNAT --sport 19040 -s 10.0.0.0/24 -d 10.0.1.0/24 --to-destination 10.0.1.1

When I try to curl an external IP address I get an error:

ip netns exec nsy curl 1.1.1.1
curl: (56) Recv failure: Connection reset by peer

Tor is listening on 10.0.0.1:19040:

Jul 24 09:41:08.000 [debug] connection_handle_listener_read(): Connection accepted on socket 10 (child of fd 6).
Jul 24 09:41:08.000 [info] connection_handle_listener_read(): New SOCKS connection opened from 10.0.0.2.
Jul 24 09:41:08.000 [debug] connection_add_impl(): new conn type Socks, socket 10, address 10.0.0.2, n_conns 4.
Jul 24 09:41:08.000 [debug] connection_ap_process_transparent(): entered.
Jul 24 09:41:08.000 [debug] connection_ap_handshake_rewrite(): Client asked for 10.0.0.1:19040
Jul 24 09:41:08.000 [warn] Rejecting request for anonymous connection to private address 10.0.0.1 on a TransPort or NATDPort.  Possible loop in your NAT rules?
Jul 24 09:41:08.000 [debug] conn_close_if_marked(): Cleaning up connection (fd 10).
Jul 24 09:41:08.000 [debug] connection_remove(): removing socket 10 (type Socks), n_conns now 4
Jul 24 09:41:08.000 [debug] connection_free_minimal(): closing fd 10.

/\ I curled 1.1.1.1:80 but the address received by the Tor transparent proxy is 10.0.0.1:19040 (the same address of the transparent port).

How can I make the address received by the transparent port be the address I connect to? Is there something lacking in my Iptables rules?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.