How do I setup Tor on Debian for secure use as a SOCKS5 proxy?

Question

This is a fairly common question. I've found good guidance from the Tor Project, this and other StackExchange communities, and so on. But I haven't found a coherent set of instructions, covering both setup and leak testing.

How about we create one here?

I'm going to post my answer. Although my iptables skills are iffy, perhaps it can serve as the basis for a good answer.

Answer 1

I've just tested this in a CrunchBang 11 x64 VM. It should work in Ubuntu and the rest of the Debian family. First install Wireshark, by opening a terminal and running these commands:

sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get install wireshark

To configure wireshark to allow a non-root user to sniff packets, run these commands:

sudo dpkg-reconfigure wireshark-common
sudo adduser $USER wireshark

Then install Tor:

sudo apt-get install tor

Now edit torrc:

sudo nano /etc/tor/torrc

After line 19, which begins "#SocksPort 192.168.0.1:9100 # Bind ..." add these four lines:

VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
SocksPort 9050
DnsPort 53

Save (Ctrl-o) and exit (Ctrl-x). The first two lines enable resolving hidden services (*.onion).

Then restart Tor:

sudo service tor restart

Now specify "127.0.0.1" as the system DNS server. If using Network Manager, right click the connection icon, select "Edit Connections", and edit the active wired or wireless connection. In the IPv4 tab, select "Automatic (DHCP) addresses only" as "Method", type "127.0.0.1" in the "DNS servers" box, and save. In the IPv6 tab, select "Ignore" as "Method", and save. Then close the "Network Connections" window.

Now install the iptables-persistent package, which will automatically load iptables rules at boot:

sudo apt-get install iptables-persistent

During installation, you will be asked to confirm saving the existing rules:

/etc/iptables/rules.v4
/etc/iptables/rules.v6

To see what they are, run these:

sudo iptables -L
sudo ip6tables -L

Then edit the IPv6 rules to drop everything:

sudo nano /etc/iptables/rules.v6

The file should contain this:

*filter

:INPUT DROP
:FORWARD DROP
:OUTPUT DROP

COMMIT

You can paste into the terminal window using Shift|Ctrl-v. To copy from the terminal window, select with the mouse, and use Shift|Ctrl-c.

Save (Ctrl-o) and exit (Ctrl-x).

Now get the user id (uid) for the user created in the Tor installation (debian-tor):

sudo id -u debian-tor

In my CrunchBang VM, it's uid 109.

Then edit the IPv4 rules to lock down Tor:

sudo nano /etc/iptables/rules.v4

The file should contain this:

*nat

:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53

-A OUTPUT -o lo -j RETURN
-A OUTPUT -m owner --uid-owner 109 -j RETURN
-A OUTPUT -p udp -m udp --dport 123 -j REDIRECT --to-ports 123
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050

COMMIT

*filter

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -s 127.0.0.1/32 -j ACCEPT

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m owner --uid-owner 109 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9050 -j ACCEPT

COMMIT

Save (Ctrl-o) and exit (Ctrl-x).

Now load the new IPv4 and IPv6 rules:

sudo iptables-restore < /etc/iptables/rules.v4
sudo ip6tables-restore < /etc/iptables/rules.v6

And check that they loaded:

sudo iptables -L
sudo ip6tables -L

If they didn't, go back and check for errors.

Now reboot:

sudo reboot

And check iptables again:

sudo iptables -L
sudo ip6tables -L

Now check Tor status:

sudo su
tail /var/log/tor/log

It should say "Bootstrapped 100%: Done".

Now start Wireshark, and start capturing on eth0.

Open Firefox, and set 127.0.0.1:9050 as the SOCKS5 proxy.

Browse a few key sites:

https://check.torproject.org/
https://atlas.torproject.org/
http://duskgytldkxiuqc6.onion/
https://duckduckgo.com/

And search for a few random things, and hit some sites, to generate more traffic.

Then stop Wireshark capture (4th icon from the left), and select "Statistics/Conversations" from the main menu.

You should see one local Ethernet conversation, and 1-3 TCP conversations, but nothing else. There might also be a UDP conversation on port 123 with an NTP timeserver.

In https://atlas.torproject.org/, look up the remote IP addresses ("Address B") that you see in the TCP conversations. They should all be Tor relays. They are your entry guards.

Generally, you can use torsocks for other command line apps. By default, it points to Tor SocksPort 9050. But always test for leaks. However, there may well be more secure options (such as socat). Also, you can add more SocksPorts in torrc, and use a different one for each app. That better isolates the streams. Each additional SocksPort needs its own set of iptables rules.

For example, start a Wireshark capture on eth0, and run:

sudo torsocks apt-get update

After it finishes, stop the Wireshark capture (4th icon from the left) and run "Statistics/Conversations". You should see only TCP conversations with your entry guards.

Enjoy.