How can I pass all wifi traffic through Tor?

Question

Background: Where I work there is a transparent proxy which restricts us to connect only to ftp, http and https websites.

I am using Tor and to connect to any other destination port I use proxychains on my Ubuntu machine, things work fine.

Problem: Now I created a hotspot on my linux machine and want all incoming wifi traffic to be redirected through Tor. (Basically I have a ssh/telnet client on my Ipad which I want to use.)

How can I do this? Is it possible to setup some proxy server on my laptop so it redirects all(ALL TCP traffic) traffic through Tor?

Answer 1

This is not a good idea, in theory at least. (False security as programs may leak data)

Adafruit offers a tutorial on how to do this using a Raspberry Pi running Raspbian (which is based on Debian). This should work fine on most Linux distros.

 sudo apt-get install tor

Edit the tor config file by running

sudo nano /etc/tor/torrc

and copy and paste the text into the top of the file, right below the the FAQ notice.

Log notice file /var/log/tor/notices.log 
VirtualAddrNetwork 10.192.0.0/10 
AutomapHostsSuffixes .onion,.exit 
AutomapHostsOnResolve 1 
TransPort 9040 
TransListenAddress 192.168.42.1 
DNSPort 53
DNSListenAddress 192.168.42.1

Let's edit the host access point so it is called something memorable like Onion Pi - don't forget to set a good password, don't use the default here! (Don't forget to do the AP setup step in "Preparation" before this!)

[EDIT BY ANSWER AUTHOR]

You can do this by editing /etc/hostapd/hostapd.conf to change the ssid.

sudo nano /etc/hostapd/hostapd.conf

One might change it to:

ssid=Onion Pi

[END EDIT]

Time to change our ip routing tables so that connections via the wifi interface (wlan0) will be routed through the tor software. Type the following to flush the old rules from the ip NAT table

sudo iptables -F
sudo iptables -t nat -F

If you want to be able to ssh to your Pi after this, you'll need to add an exception for port 22 like this (not shown in the screenshot below)

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 22 -j REDIRECT --to-ports 22

Type the following to route all DNS (UDP port 53) from interface wlan0 to internal port 53 (DNSPort in our torrc)

sudo iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT --to-ports 53

Type the following to route all TCP traffic from interface wlan0 to port 9040 (TransPort in our torrc)

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --syn -j REDIRECT --to-ports 9040

Next you can check that the ip tables are right with

sudo iptables -t nat -L

If all is good, we'll save it to our old NAT save file

sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"

It will automatically get loaded when the networking is set up on reboot (as we did in the last tutorial on making a Pi access point) Next we'll create our log file (handy for debugging) with

sudo touch /var/log/tor/notices.log
sudo chown debian-tor /var/log/tor/notices.log
sudo chmod 644 /var/log/tor/notices.log

Check it with

ls -l /var/log/tor

Start the tor service manually

sudo service tor start

Check its really running (you can run this whenever you're not sure, it something is wrong you'll see a big FAIL notice

sudo service tor status

Finally, make it start on boot

sudo update-rc.d tor enable

That's it, now you're ready to test in the next step.

(Adafruit)

Edit: Please look at Tails which does the same thing with much less risk.