I would like to configure my wireless router as an "anonymizing middlebox" for guests. I have read the directions here.
The tutorial, as I understand:
- Creates a wireless network and assigns it to a firewall zone named 'transtor'.
- It then adds rules to REJECT all incoming and forwarding traffic.
- ACCEPTs incoming traffic to UDP port 67 for DHCP.
- ACCEPTs incoming TCP traffic to Tor's transparent proxying port and DNS proxy port.
- Then configures PREROUTING redirections (using firewall.user) to REDIRECT all DNS requests to Tor and all TCP traffic to Tor's transparent proxying port.
The thing I don't understand is in the last bullet. As far as I understand:
- The client wants to connect, say, to google.com:80, therefore it looks the address up. The DNS request gets redirected to Tor's DNS port, which then returns Google's IP.
- The client then tries to connect (IP of Google):80, which the firewall REDIRECTs to (IP of Google):9040. The SYN packet then gets rejected by the router, because it would be forwarding traffic.
- If (by some miracle or DNS trickery) Tor would actually get the packet, how would it know to what port the packet was originally destined to? Or to what host, for that matter; the packet now has (router's IP):9040 as its destination.
I don't ask for a solution to a problem, I just want an explanation on how this particular setup is supposed to work and what I am missing. In the 3rd point I considered the case in which Tor's DNS always returns its own IP, but then how does it know what host:port the new incoming SYN is for?
Thanks in advance for answers. Also, I have already asked this question on Network engineering, where it was closed as off-topic. If this is also not the right place to ask this question, please kindly tell me so before closing and offer an alternate place if possible.