I am configuring a tor hardware router as an anonymizing transparent proxy using the info here and the good news is everything is working as it should; I can connect and browse sites, dns is forwarded to port 9053 and everything else tcp is forwarded over tor on the router port 9040. I go to https://check.torproject.org to test and it says tor is running and configured properly.
The only thing is I would also like to browse hidden services (.onion) and so far have not been able to get it to work. When I am connected to the tor hardware router and I troubleshoot from the command line .onion domains resolve to the false ip addresses as they should:
sh-4.1$ host 3g2upl4pq6kufc4m.onion 3g2upl4pq6kufc4m.onion has address 10.213.7.118 3g2upl4pq6kufc4m.onion has address 10.213.7.118 Host 3g2upl4pq6kufc4m.onion.lan not found: 4(NOTIMP) sh-4.1$ host xmh57jrzrnw6insl.onion xmh57jrzrnw6insl.onion has address 10.245.42.50 xmh57jrzrnw6insl.onion has address 10.245.42.50 Host xmh57jrzrnw6insl.onion.lan not found: 4(NOTIMP) sh-4.1$ host xmh57jrdrnw6insl.onion xmh57jrdrnw6insl.onion has address 10.221.223.52 xmh57jrdrnw6insl.onion has address 10.221.223.52 Host xmh57jrdrnw6insl.onion.lan not found: 4(NOTIMP) sh-4.1$ host xmh57jrdrnw6ins0.onion xmh57jrdrnw6ins0.onion has address 10.194.64.30 xmh57jrdrnw6ins0.onion has address 10.194.64.30 Host xmh57jrdrnw6ins0.onion.lan not found: 4(NOTIMP) sh-4.1$
Those are all addresses with the VirtualNetwork as configured in my torrc which looks like this:
VirtualAddrNetwork 10.192.0.0/10 AutomapHostsOnResolve 1 TransPort 9040 TransListenAddress 127.0.0.1 TransListenAddress 10.192.0.1 DNSPort 9053 DNSListenAddress 127.0.0.1 DNSListenAddress 10.192.0.1
And I have added a firewall rule (this may be where I done goofed) like so:
# allow ssh access over port 99 from LAN iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 99 -j REDIRECT --to-ports 22 # everything else goes over tor iptables -t nat -A PREROUTING -i br-lan -p tcp --syn -j REDIRECT --to-ports 9040 # udp traffic for DNS (port 53) is sent to tor 9053 iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 9053 # everything else udp is dropped.. not working yet #iptables -t nat -A PREROUTING -i br-lan -p udp --syn -j DROP # resolve onion domains (this is the rule in question) iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040
I know .onion domains do not have ip addresses to resolve to, but when my browser queries the router 10.192.0.1:9053 for an onion domain it comes back with a seemingly random ip within the 10.192.0.0/10 range, and then when my browser requests that ip (say 10.192.254.7:80) it should be redirected via iptables back to the router 10.192.0.1:9040 right? Or am I doing it wrong?
Everything is working fine except .onion domains...