From d0734de5c0fbec5d14d13e611232783aaecec8ff Mon Sep 17 00:00:00 2001 From: mullerhx Date: Mon, 20 Mar 2023 21:45:15 +0200 Subject: [PATCH] Service improvements * Created start/stop methods to make service management easier * Added start/stop functions. Added iptables-save/restore functionality. --------- Co-authored-by: strepsil --- files/tor-router | 108 +++++++++++++++++++++++++-------------- files/tor-router.service | 4 +- 2 files changed, 71 insertions(+), 41 deletions(-) diff --git a/files/tor-router b/files/tor-router index 04b9688..7dff104 100755 --- a/files/tor-router +++ b/files/tor-router @@ -1,48 +1,78 @@ #!/bin/bash -# Executable file to create rules for transparent proxy -# Destinations you do not want routed through Tor -NON_TOR="192.168.1.0/24 192.168.0.0/24" -# the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. -if command -v pacman > /dev/null; then - TOR_UID=$(id -u tor) -elif command -v apt > /dev/null; then - TOR_UID=$(id -u debian-tor) -elif command -v dnf > /dev/null; then - TOR_UID=$(id -u toranon) -else - echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" - exit -fi + +RULES="/var/tmp/tor-router.save" # Tor's TransPort TRANS_PORT="9040" -if ! command -v tor > /dev/null; then - echo "You need to install the tor package." - exit -elif ! systemctl is-active tor.service > /dev/null; then - echo "The tor service is not active, please start the tor service before running the script." - exit -elif ! command -v iptables > /dev/null; then - echo "You need to install the iptables package." - exit -else - iptables -F - iptables -t nat -F - iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN - iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 +case "$1" in + start) + if test -f "$RULES"; then + echo "$RULES exists. Either delete it, or stop tor-router first." + exit + else + iptables-save > $RULES + # Executable file to create rules for transparent proxy + # Destinations you do not want routed through Tor + NON_TOR="192.168.1.0/24 192.168.0.0/24" + # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. + if command -v pacman > /dev/null; then + TOR_UID=$(id -u tor) + elif command -v apt > /dev/null; then + TOR_UID=$(id -u debian-tor) + elif command -v dnf > /dev/null; then + TOR_UID=$(id -u toranon) + else + echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" + exit + fi + + if ! command -v tor > /dev/null; then + echo "You need to install the tor package." + exit + elif ! systemctl is-active tor.service > /dev/null; then + echo "The tor service is not active, please start the tor service before running the script." + exit + elif ! command -v iptables > /dev/null; then + echo "You need to install the iptables package." + exit + else + iptables -F + iptables -t nat -F + iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN + iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 - for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do - iptables -t nat -A OUTPUT -d $NET -j RETURN - done + for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do + iptables -t nat -A OUTPUT -d $NET -j RETURN + done - iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT - iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT + iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT + iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - for NET in $NON_TOR 127.0.0.0/8; do - iptables -A OUTPUT -d $NET -j ACCEPT - done + for NET in $NON_TOR 127.0.0.0/8; do + iptables -A OUTPUT -d $NET -j ACCEPT + done - iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT - iptables -A OUTPUT -j ACCEPT -fi + iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT + iptables -A OUTPUT -j ACCEPT + fi + fi + ;; + stop) + if ! -f "$RULES"; then + echo "$RULES does not exist. Not doing anything." + exit + else + iptables -t nat -F + iptables-restore < $RULES + rm $RULES + fi + ;; + restart) + stop + sleep 2 + start + ;; + *) + echo "Usage: $0 {start|stop|restart}" +esac diff --git a/files/tor-router.service b/files/tor-router.service index d9b4a06..5d5448b 100644 --- a/files/tor-router.service +++ b/files/tor-router.service @@ -4,9 +4,9 @@ [Service] Type=simple - ExecStart=/usr/bin/tor-router + ExecStart=/usr/bin/tor-router start RemainAfterExit=yes - ExecStop=/usr/bin/iptables -F OUTPUT + ExecStop=/usr/bin/tor-router stop TimeoutStopSec=180 KillMode=process KillSignal=SIGINT