diff --git a/README.md b/README.md index ea53eeb..1c16097 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,59 @@ # TOR Router -Tor Router allow you to use TOR as a transparent proxy and send all your trafic under TOR, the only that you need is: +Tor Router allow you to use TOR as a transparent proxy and send all your trafic under TOR **INCLUDING DNS REQUESTS**, the only that you need is: a system using systemd (if you want to use the service) and tor. -# Installing +# Script to install on distros using SystemD only -~$ git clone https://github.com/Edu4rdSHL/tor-router && cd ./tor-router && sudo bash install.sh +If you are using BlackArch Linux (https://blackarch.org) you can install the script from the repos using the following command: `# pacman -S tor-router` + +To install from source: + +``` +~$ git clone https://gitlab.com/edu4rdshl/tor-router.git && cd ./tor-router && sudo bash install.sh +``` + +# Usage + +In distros using systemd, you should consideer using the install.sh script, anyways the process to install/configure tor-router is described here. + +**It script require root privileges** + +1. Open a terminal and clone the script using the following command: +``` +~$ git clone https://gitlab.com/edu4rdshl/tor-router.git && cd tor-router/files +``` +2. Put the following lines at the end of /etc/tor/torrc +``` +# Seting up TOR transparent proxy for tor-router +VirtualAddrNetwork 10.192.0.0/10 +AutomapHostsOnResolve 1 +TransPort 9040 +DNSPort 5353 +``` +3. Restart the tor service +4. Execute the tor-router script as root +``` +# sudo ./tor-router +``` +5. Now all your traffic is under TOR, you can check that in the following pages: https://check.torproject.org and for DNS tests: https://dnsleaktest.com +6. In order to automate the process of the script, you should add it to the SYSTEM autostart scripts according that the init that you are using, for systemd we have a .service file in the *files* folder. # Uninstalling/Stoping -Move your /etc/tor/torrc.backup file to /etc/tor/torrc, disable the tor-router.service using systemctl, remove /usr/bin/tor-router and /etc/systemd/system/tor-router.service and restart your computer. +Delete the tor-router configuration lines in /etc/tor/torrc, disable the tor-router.service using systemctl (if you used the install.sh script), remove /usr/bin/tor-router, /etc/systemd/system/tor-router.service and restart your computer. + +# Proof of concept + +After of run the script, follow the next steps to ensure that all is working as expected: + +- **Ip hidden and TOR network configured**: Visit https://check.torproject.org, you should see a message like it: + +![Alt text](https://i.imgur.com/FboGoCr.png "Ip check") + +- **Checking DNS Leaks**: Visit https://dnsleaktest.com and make a extended test to see what are your DNS. You shloud get some like it: + +![Alt text](https://i.imgur.com/IEdfVHj.png "DNS check") + +# Distros using the script + +BlackArch Linux: https://github.com/BlackArch/blackarch/blob/master/packages/tor-router \ No newline at end of file diff --git a/files/tor-router b/files/tor-router index 7fc6a11..c9b7bf7 100755 --- a/files/tor-router +++ b/files/tor-router @@ -2,21 +2,42 @@ # Executable file to create rules for transparent proxy # Destinations you do not want routed through Tor NON_TOR="192.168.1.0/24 192.168.0.0/24" -# the UID Tor runs as, change this accordingly for your OS -TOR_UID="43" +# the UID Tor runs as, actually only support for Debian and ArchLinux as been added. +if command -v pacman > /dev/null; then + TOR_UID=$(id -u tor) +elif command -v apt > /dev/null; then + TOR_UID=$(id -u debian-tor) +else + echo "Unknown distro, please create report the issue to https://gitlab.com/edu4rdshl/tor-router/issues" + exit +fi + # Tor's TransPort TRANS_PORT="9040" -iptables -F -iptables -t nat -F -iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN -iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 -for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do - iptables -t nat -A OUTPUT -d $NET -j RETURN -done -iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT -iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -for NET in $NON_TOR 127.0.0.0/8; do - iptables -A OUTPUT -d $NET -j ACCEPT -done -iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT -iptables -A OUTPUT -j REJECT + +if ! command -v tor > /dev/null; then + echo "You need to install the tor package." + exit +elif ! systemctl is-active tor.service > /dev/null; then + echo "The tor service is not active, please start the tor service before running the script." + exit +else + iptables -F + iptables -t nat -F + iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN + iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 + + for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do + iptables -t nat -A OUTPUT -d $NET -j RETURN + done + + iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT + iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT + + for NET in $NON_TOR 127.0.0.0/8; do + iptables -A OUTPUT -d $NET -j ACCEPT + done + + iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT + iptables -A OUTPUT -j ACCEPT +fi diff --git a/files/tor-router.service b/files/tor-router.service index 8491889..d9b4a06 100644 --- a/files/tor-router.service +++ b/files/tor-router.service @@ -1,10 +1,12 @@ [Unit] Description=Start rules for transparent tor proxy - After=network-online.target + After=network-online.target tor.service [Service] Type=simple ExecStart=/usr/bin/tor-router + RemainAfterExit=yes + ExecStop=/usr/bin/iptables -F OUTPUT TimeoutStopSec=180 KillMode=process KillSignal=SIGINT diff --git a/install.sh b/install.sh index 3b1aa1a..c572daf 100755 --- a/install.sh +++ b/install.sh @@ -1,52 +1,52 @@ -#!/usr/bin/bash +#!/bin/sh # Script that automate the procces for setting up TOR as a tranparent proxy # Autor: Edu4rdSHL @edu4rdshl #Defining variables -istor="/usr/bin/tor" torconfig="/etc/tor/torrc" torconfigbackup="/etc/tor/torrc.backup" -issystemd="/usr/bin/systemctl" -executablerules="./files/tor-router" -servicefile="./files/tor-router.service" -iscurl="/usr/bin/curl" +executablerules="$PWD/files/tor-router" +servicefile="$PWD/files/tor-router.service" #Check if the current user have root privileges if [ "$UID" -ne "0" ] ; then - echo -e "\nYou need root permisions to run it script." - exit + echo -e "\nYou need root permisions to run it script." + exit fi echo -e "Checking if TOR and Systemd are installed..." -if [ -f "$istor" ] && [ -f "$torconfig" ] && [ -f "$issystemd" ] ; then - echo -e "\nAll fundamentals tools are installed, proceding..." - echo -e "\nPLEASE, RUN IT SCRIPT ONLY A TIME, IF YOU RUN IT TWO OR MORE TIMES WILL CAUSE ISSUES WITH YOUR $torconfig FILE!" - echo -e "\nMaking a backup of your torrc file, if you have problems with the new configuration, delete $torconfig and move $torconfigbackup to $torconfig" - cp "$torconfig" "$torconfigbackup" - echo -e "\nConfiguring the torrc file to use TOR as a transparent proxy..." - echo -e "\n# Seting up TOR for transparent proxy\nVirtualAddrNetwork 10.192.0.0/10\nAutomapHostsOnResolve 1\nTransPort 9040\nDNSPort 5353" >> "$torconfig" - echo -e "\nCreating, enabling and starting the service file tor transparent proxy..." - cp "$executablerules" "/usr/bin/" - chmod +x "/usr/bin/tor-router" - cp "$servicefile" "/etc/systemd/system/" - systemctl enable tor-router.service && systemctl start tor-router.service - echo -e "\nEnabling and restarting the TOR daemon using systemctl..." - systemctl enable tor && systemctl restart tor - if [ "$?" == 0 ] ; then - echo -e "Checking if all are working..." - if [ -f "$iscurl" ] ; then - curl https://check.torproject.org/ | grep "Congratulations." - if [ "$?" == 0 ] ; then - echo -e "\nAll is OK, from now on all your network traffic is under the TOR Network, look for your IP addres in your browser." - exit - fi - else - echo -e "\nYou haven't curl installed, try opening https://check.torproject.org/ in your browser and look for 'Congratulations.'" - fi - else - echo -e "\nAn error as ocurrer, please open a issue in https://github.com/Edu4rdSHL/tor-router/issues including log info and your Linux distribution." - fi +if command -v tor >/dev/null && command -v systemctl > /dev/null ; then + if grep -iq "# Seting up TOR transparent proxy for tor-router" "$torconfig" ; then + echo -e "\ntor-router is already configured in $torconfig" + else + echo -e "\nAll fundamentals tools are installed, proceding..." + echo -e "\nMaking a backup of your torrc file, if you have problems with the new configuration, delete $torconfig and move $torconfigbackup to $torconfig" + cp "$torconfig" "$torconfigbackup" + echo -e "\nConfiguring the torrc file to use TOR as a transparent proxy..." + echo -e "\n# Seting up TOR transparent proxy for tor-router\nVirtualAddrNetwork 10.192.0.0/10\nAutomapHostsOnResolve 1\nTransPort 9040\nDNSPort 5353" >> "$torconfig" + echo -e "\nCreating, enabling and starting the service file tor transparent proxy..." + cp "$executablerules" "/usr/bin/" + chmod +x "/usr/bin/tor-router" + cp "$servicefile" "/etc/systemd/system/" + systemctl enable tor-router.service && systemctl start tor-router.service + echo -e "\nEnabling and restarting the TOR daemon using systemctl..." + systemctl enable tor && systemctl restart tor + if [ "$?" == 0 ] ; then + echo -e "Checking if all are working..." + if command -v curl >/dev/null ; then + curl https://check.torproject.org/ | grep "Congratulations." + if [ "$?" == 0 ] ; then + echo -e "\nAll is OK, from now on all your network traffic is under the TOR Network, look for your IP addres in your browser." + exit + fi + else + echo -e "\nYou haven't curl installed, try opening https://check.torproject.org/ in your browser and look for 'Congratulations.'" + fi + else + echo -e "\nAn error as ocurrer, please open a issue in https://gitlab.com/Edu4rdSHL/tor-router/issues including log info and your Linux distribution." + fi + fi else - echo -e "Systemd or TOR are not installed, the script dont work." - exit + echo -e "Systemd or TOR are not installed, the script dont work." + exit fi