Background: Where I work there is a transparent proxy which restricts us to connect only to ftp, http and https websites.

I am using Tor and to connect to any other destination port I use proxychains on my Ubuntu machine, things work fine.

Problem: Now I created a hotspot on my linux machine and want all incoming wifi traffic to be redirected through Tor. (Basically I have a ssh/telnet client on my Ipad which I want to use.)

How can I do this? Is it possible to setup some proxy server on my laptop so it redirects all(ALL TCP traffic) traffic through Tor?


1 Answer 1


This is not a good idea, in theory at least. (False security as programs may leak data)

Adafruit offers a tutorial on how to do this using a Raspberry Pi running Raspbian (which is based on Debian). This should work fine on most Linux distros.

 sudo apt-get install tor

screenshot of terminal install of Tor Edit the tor config file by running

sudo nano /etc/tor/torrc

and copy and paste the text into the top of the file, right below the the FAQ notice.

Log notice file /var/log/tor/notices.log 
AutomapHostsSuffixes .onion,.exit 
AutomapHostsOnResolve 1 
TransPort 9040 
DNSPort 53

screenshot of terminal editing torrc Let's edit the host access point so it is called something memorable like Onion Pi - don't forget to set a good password, don't use the default here! (Don't forget to do the AP setup step in "Preparation" before this!) screenshot of editing Wifi settings


You can do this by editing /etc/hostapd/hostapd.conf to change the ssid.

sudo nano /etc/hostapd/hostapd.conf

One might change it to:

ssid=Onion Pi


Time to change our ip routing tables so that connections via the wifi interface (wlan0) will be routed through the tor software. Type the following to flush the old rules from the ip NAT table

sudo iptables -F
sudo iptables -t nat -F

If you want to be able to ssh to your Pi after this, you'll need to add an exception for port 22 like this (not shown in the screenshot below)

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 22 -j REDIRECT --to-ports 22

Type the following to route all DNS (UDP port 53) from interface wlan0 to internal port 53 (DNSPort in our torrc)

sudo iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT --to-ports 53

Type the following to route all TCP traffic from interface wlan0 to port 9040 (TransPort in our torrc)

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --syn -j REDIRECT --to-ports 9040

Next you can check that the ip tables are right with

sudo iptables -t nat -L

screenshot of terminal of above command

If all is good, we'll save it to our old NAT save file

sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"

It will automatically get loaded when the networking is set up on reboot (as we did in the last tutorial on making a Pi access point) screenshot of terminal after restart Next we'll create our log file (handy for debugging) with

sudo touch /var/log/tor/notices.log
sudo chown debian-tor /var/log/tor/notices.log
sudo chmod 644 /var/log/tor/notices.log

Check it with

ls -l /var/log/tor

Start the tor service manually

sudo service tor start

Check its really running (you can run this whenever you're not sure, it something is wrong you'll see a big FAIL notice

sudo service tor status

Finally, make it start on boot

sudo update-rc.d tor enable

screenshot of terminal after above command That's it, now you're ready to test in the next step.


Edit: Please look at Tails which does the same thing with much less risk.

  • With a few necessary modifications this worked :) Important issue I found was with hostapd in 14.04. So manually installed from 13.10 repo.
    – Swapniel
    Commented Jun 19, 2014 at 5:11
  • @Swapniel It was a long shot, but it's good that it worked.
    – cubecubed
    Commented Jun 19, 2014 at 5:43
  • 1
    Hi unfortunately the iptables don't work for me. I first used sudo iptables -F sudo iptables -t nat -F sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT where I got a successful AP running. When I change it to your iptables, the AP doesn't have a connection anymore. Any ideas how to debug it to find out what is going wrong? Thanks!
    – Sebastian
    Commented Mar 28, 2016 at 11:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .