From 0bfd341c658ffebc65b43fc0a430e76193b832d8 Mon Sep 17 00:00:00 2001 From: Rasool Safari Date: Thu, 7 May 2020 18:33:34 +0430 Subject: [PATCH 01/11] Add support for Fedora. Co-authored-by: Rasool Safari --- files/tor-router | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/files/tor-router b/files/tor-router index 166a83e..1e0df71 100755 --- a/files/tor-router +++ b/files/tor-router @@ -2,11 +2,13 @@ # Executable file to create rules for transparent proxy # Destinations you do not want routed through Tor NON_TOR="192.168.1.0/24 192.168.0.0/24" -# the UID Tor runs as, actually only support for Debian and ArchLinux as been added. +# the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. if command -v pacman > /dev/null; then TOR_UID=$(id -u tor) elif command -v apt > /dev/null; then TOR_UID=$(id -u debian-tor) +elif command -v dnf > /dev/null; then + TOR_UID=$(id -u toranon) else echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" exit @@ -21,6 +23,9 @@ if ! command -v tor > /dev/null; then elif ! systemctl is-active tor.service > /dev/null; then echo "The tor service is not active, please start the tor service before running the script." exit +if ! command -v iptables > /dev/null; then + echo "You need to install the iptables package." + exit else iptables -F iptables -t nat -F From 7658db7e1cd401f01bad9be3bd74a816e0c8309f Mon Sep 17 00:00:00 2001 From: FaultierSP <65611002+FaultierSP@users.noreply.github.com> Date: Sun, 7 Jun 2020 21:20:56 +0200 Subject: [PATCH 02/11] Update tor-router (#7) In line 26 switched "if" to "elif" --- files/tor-router | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/tor-router b/files/tor-router index 1e0df71..04b9688 100755 --- a/files/tor-router +++ b/files/tor-router @@ -23,7 +23,7 @@ if ! command -v tor > /dev/null; then elif ! systemctl is-active tor.service > /dev/null; then echo "The tor service is not active, please start the tor service before running the script." exit -if ! command -v iptables > /dev/null; then +elif ! command -v iptables > /dev/null; then echo "You need to install the iptables package." exit else From 34738887a05807a468452a34ac4896ca6e49b48a Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Mon, 26 Jul 2021 09:11:12 +0000 Subject: [PATCH 03/11] Create FUNDING.yml --- .github/FUNDING.yml | 1 + 1 file changed, 1 insertion(+) create mode 100644 .github/FUNDING.yml diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..ff19fdb --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1 @@ +github: [edu4rdshl] From d0734de5c0fbec5d14d13e611232783aaecec8ff Mon Sep 17 00:00:00 2001 From: mullerhx Date: Mon, 20 Mar 2023 21:45:15 +0200 Subject: [PATCH 04/11] Service improvements * Created start/stop methods to make service management easier * Added start/stop functions. Added iptables-save/restore functionality. --------- Co-authored-by: strepsil --- files/tor-router | 108 +++++++++++++++++++++++++-------------- files/tor-router.service | 4 +- 2 files changed, 71 insertions(+), 41 deletions(-) diff --git a/files/tor-router b/files/tor-router index 04b9688..7dff104 100755 --- a/files/tor-router +++ b/files/tor-router @@ -1,48 +1,78 @@ #!/bin/bash -# Executable file to create rules for transparent proxy -# Destinations you do not want routed through Tor -NON_TOR="192.168.1.0/24 192.168.0.0/24" -# the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. -if command -v pacman > /dev/null; then - TOR_UID=$(id -u tor) -elif command -v apt > /dev/null; then - TOR_UID=$(id -u debian-tor) -elif command -v dnf > /dev/null; then - TOR_UID=$(id -u toranon) -else - echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" - exit -fi + +RULES="/var/tmp/tor-router.save" # Tor's TransPort TRANS_PORT="9040" -if ! command -v tor > /dev/null; then - echo "You need to install the tor package." - exit -elif ! systemctl is-active tor.service > /dev/null; then - echo "The tor service is not active, please start the tor service before running the script." - exit -elif ! command -v iptables > /dev/null; then - echo "You need to install the iptables package." - exit -else - iptables -F - iptables -t nat -F - iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN - iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 +case "$1" in + start) + if test -f "$RULES"; then + echo "$RULES exists. Either delete it, or stop tor-router first." + exit + else + iptables-save > $RULES + # Executable file to create rules for transparent proxy + # Destinations you do not want routed through Tor + NON_TOR="192.168.1.0/24 192.168.0.0/24" + # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. + if command -v pacman > /dev/null; then + TOR_UID=$(id -u tor) + elif command -v apt > /dev/null; then + TOR_UID=$(id -u debian-tor) + elif command -v dnf > /dev/null; then + TOR_UID=$(id -u toranon) + else + echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" + exit + fi + + if ! command -v tor > /dev/null; then + echo "You need to install the tor package." + exit + elif ! systemctl is-active tor.service > /dev/null; then + echo "The tor service is not active, please start the tor service before running the script." + exit + elif ! command -v iptables > /dev/null; then + echo "You need to install the iptables package." + exit + else + iptables -F + iptables -t nat -F + iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN + iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 - for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do - iptables -t nat -A OUTPUT -d $NET -j RETURN - done + for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do + iptables -t nat -A OUTPUT -d $NET -j RETURN + done - iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT - iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT + iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT + iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - for NET in $NON_TOR 127.0.0.0/8; do - iptables -A OUTPUT -d $NET -j ACCEPT - done + for NET in $NON_TOR 127.0.0.0/8; do + iptables -A OUTPUT -d $NET -j ACCEPT + done - iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT - iptables -A OUTPUT -j ACCEPT -fi + iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT + iptables -A OUTPUT -j ACCEPT + fi + fi + ;; + stop) + if ! -f "$RULES"; then + echo "$RULES does not exist. Not doing anything." + exit + else + iptables -t nat -F + iptables-restore < $RULES + rm $RULES + fi + ;; + restart) + stop + sleep 2 + start + ;; + *) + echo "Usage: $0 {start|stop|restart}" +esac diff --git a/files/tor-router.service b/files/tor-router.service index d9b4a06..5d5448b 100644 --- a/files/tor-router.service +++ b/files/tor-router.service @@ -4,9 +4,9 @@ [Service] Type=simple - ExecStart=/usr/bin/tor-router + ExecStart=/usr/bin/tor-router start RemainAfterExit=yes - ExecStop=/usr/bin/iptables -F OUTPUT + ExecStop=/usr/bin/tor-router stop TimeoutStopSec=180 KillMode=process KillSignal=SIGINT From f53ced300477562d030f3624e17ad6c436582107 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Sun, 16 Apr 2023 00:15:59 +0000 Subject: [PATCH 05/11] Add informative message. --- files/tor-router | 1 + 1 file changed, 1 insertion(+) diff --git a/files/tor-router b/files/tor-router index 7dff104..f327a49 100755 --- a/files/tor-router +++ b/files/tor-router @@ -63,6 +63,7 @@ case "$1" in echo "$RULES does not exist. Not doing anything." exit else + echo "Restoring previous rules from $RULES..." iptables -t nat -F iptables-restore < $RULES rm $RULES From 3a81a3b48a7a91c6114ea516daab0d82e29478a9 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Sun, 16 Apr 2023 00:16:44 +0000 Subject: [PATCH 06/11] Style --- files/tor-router | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/tor-router b/files/tor-router index f327a49..0d5590f 100755 --- a/files/tor-router +++ b/files/tor-router @@ -63,7 +63,7 @@ case "$1" in echo "$RULES does not exist. Not doing anything." exit else - echo "Restoring previous rules from $RULES..." + echo "Restoring previous rules from $RULES" iptables -t nat -F iptables-restore < $RULES rm $RULES From 144767ebb29eecf7358509cbcafb05426fec93d9 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Sun, 16 Apr 2023 00:35:20 +0000 Subject: [PATCH 07/11] Fix issue detecting the rules file. --- files/tor-router | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/files/tor-router b/files/tor-router index 0d5590f..a0c7d0c 100755 --- a/files/tor-router +++ b/files/tor-router @@ -59,14 +59,14 @@ case "$1" in fi ;; stop) - if ! -f "$RULES"; then - echo "$RULES does not exist. Not doing anything." - exit - else + if test -f "$RULES"; then echo "Restoring previous rules from $RULES" iptables -t nat -F - iptables-restore < $RULES - rm $RULES + iptables-restore < "$RULES" + rm "$RULES" + else + echo "$RULES does not exist. Not doing anything." + exit fi ;; restart) From 2fdae488f9dd1fb00ba092fa24429e21613edf21 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Sat, 29 Apr 2023 18:25:19 -0500 Subject: [PATCH 08/11] Use appropiate exit code when failing Currently, we use the 0 status code, doesn't matter if it's a failure or not, so lets fix it. --- files/tor-router | 119 ++++++++++++++++++++++++----------------------- 1 file changed, 60 insertions(+), 59 deletions(-) diff --git a/files/tor-router b/files/tor-router index a0c7d0c..8b62ef0 100755 --- a/files/tor-router +++ b/files/tor-router @@ -6,74 +6,75 @@ RULES="/var/tmp/tor-router.save" TRANS_PORT="9040" case "$1" in - start) +start) if test -f "$RULES"; then - echo "$RULES exists. Either delete it, or stop tor-router first." - exit + echo "$RULES exists. Either delete it, or stop tor-router first." + exit 1 else - iptables-save > $RULES - # Executable file to create rules for transparent proxy - # Destinations you do not want routed through Tor - NON_TOR="192.168.1.0/24 192.168.0.0/24" - # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. - if command -v pacman > /dev/null; then - TOR_UID=$(id -u tor) - elif command -v apt > /dev/null; then - TOR_UID=$(id -u debian-tor) - elif command -v dnf > /dev/null; then - TOR_UID=$(id -u toranon) - else - echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" - exit - fi - - if ! command -v tor > /dev/null; then - echo "You need to install the tor package." - exit - elif ! systemctl is-active tor.service > /dev/null; then - echo "The tor service is not active, please start the tor service before running the script." - exit - elif ! command -v iptables > /dev/null; then - echo "You need to install the iptables package." - exit - else - iptables -F + iptables-save >$RULES + # Executable file to create rules for transparent proxy + # Destinations you do not want routed through Tor + NON_TOR="192.168.1.0/24 192.168.0.0/24" + # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. + if command -v pacman >/dev/null; then + TOR_UID=$(id -u tor) + elif command -v apt >/dev/null; then + TOR_UID=$(id -u debian-tor) + elif command -v dnf >/dev/null; then + TOR_UID=$(id -u toranon) + else + echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues" + exit 1 + fi + + if ! command -v tor >/dev/null; then + echo "You need to install the tor package." + exit 1 + elif ! systemctl is-active tor.service >/dev/null; then + echo "The tor service is not active, please start the tor service before running the script." + exit 1 + elif ! command -v iptables >/dev/null; then + echo "You need to install the iptables package." + exit 1 + else + iptables -F + iptables -t nat -F + iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN + iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 + + for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do + iptables -t nat -A OUTPUT -d $NET -j RETURN + done + + iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT + iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT + + for NET in $NON_TOR 127.0.0.0/8; do + iptables -A OUTPUT -d $NET -j ACCEPT + done + + iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT + iptables -A OUTPUT -j ACCEPT + fi + fi + ;; +stop) + if test -f "$RULES"; then + echo "Restoring previous rules from $RULES" iptables -t nat -F - iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN - iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 - - for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do - iptables -t nat -A OUTPUT -d $NET -j RETURN - done - - iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT - iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - - for NET in $NON_TOR 127.0.0.0/8; do - iptables -A OUTPUT -d $NET -j ACCEPT - done - - iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT - iptables -A OUTPUT -j ACCEPT - fi - fi - ;; - stop) - if test -f "$RULES"; then - echo "Restoring previous rules from $RULES" - iptables -t nat -F - iptables-restore < "$RULES" - rm "$RULES" + iptables-restore <"$RULES" + rm "$RULES" else - echo "$RULES does not exist. Not doing anything." - exit + echo "$RULES does not exist. Not doing anything." + exit fi ;; - restart) +restart) stop sleep 2 start ;; - *) +*) echo "Usage: $0 {start|stop|restart}" + ;; esac From ab272cb25ff834e4a6fb66b1d2f0acad6c0918fb Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Sat, 29 Apr 2023 18:26:01 -0500 Subject: [PATCH 09/11] Add Requires to the unit. --- files/tor-router.service | 1 + 1 file changed, 1 insertion(+) diff --git a/files/tor-router.service b/files/tor-router.service index 5d5448b..6c6d0b1 100644 --- a/files/tor-router.service +++ b/files/tor-router.service @@ -1,6 +1,7 @@ [Unit] Description=Start rules for transparent tor proxy After=network-online.target tor.service + Requires=tor.service [Service] Type=simple From 290d0b1e29a13a4e1d4f109a6a31bdd1da523dc9 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Thu, 4 May 2023 01:40:09 -0500 Subject: [PATCH 10/11] Apply shellcheck fixes. --- files/tor-router | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/files/tor-router b/files/tor-router index 8b62ef0..0985ec0 100755 --- a/files/tor-router +++ b/files/tor-router @@ -39,21 +39,21 @@ start) else iptables -F iptables -t nat -F - iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN + iptables -t nat -A OUTPUT -m owner --uid-owner "$TOR_UID" -j RETURN iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do - iptables -t nat -A OUTPUT -d $NET -j RETURN + iptables -t nat -A OUTPUT -d "$NET" -j RETURN done iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT for NET in $NON_TOR 127.0.0.0/8; do - iptables -A OUTPUT -d $NET -j ACCEPT + iptables -A OUTPUT -d "$NET" -j ACCEPT done - iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT + iptables -A OUTPUT -m owner --uid-owner "$TOR_UID" -j ACCEPT iptables -A OUTPUT -j ACCEPT fi fi From 5b79c1ce4944a0baf7361d841493db8c7148351c Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Wed, 17 Jan 2024 19:03:07 -0500 Subject: [PATCH 11/11] Update script. Fix #11 --- files/tor-router | 17 ++++++++++------- install.sh | 22 ++++++++++------------ 2 files changed, 20 insertions(+), 19 deletions(-) diff --git a/files/tor-router b/files/tor-router index 0985ec0..5fb5d41 100755 --- a/files/tor-router +++ b/files/tor-router @@ -11,10 +11,9 @@ start) echo "$RULES exists. Either delete it, or stop tor-router first." exit 1 else - iptables-save >$RULES # Executable file to create rules for transparent proxy # Destinations you do not want routed through Tor - NON_TOR="192.168.1.0/24 192.168.0.0/24" + NON_TOR="192.168.1.0/24 192.168.0.0/24 10.0.0.0/8" # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added. if command -v pacman >/dev/null; then TOR_UID=$(id -u tor) @@ -37,16 +36,19 @@ start) echo "You need to install the iptables package." exit 1 else + # Only save the rules when we are sure that everything is working + iptables-save >$RULES + iptables -F - iptables -t nat -F iptables -t nat -A OUTPUT -m owner --uid-owner "$TOR_UID" -j RETURN - iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353 + iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 6669 for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do iptables -t nat -A OUTPUT -d "$NET" -j RETURN done iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT + iptables -t nat -A OUTPUT -p udp -j REDIRECT --to-ports $TRANS_PORT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT for NET in $NON_TOR 127.0.0.0/8; do @@ -54,14 +56,14 @@ start) done iptables -A OUTPUT -m owner --uid-owner "$TOR_UID" -j ACCEPT - iptables -A OUTPUT -j ACCEPT fi fi ;; + stop) if test -f "$RULES"; then echo "Restoring previous rules from $RULES" - iptables -t nat -F + iptables -F iptables-restore <"$RULES" rm "$RULES" else @@ -69,9 +71,10 @@ stop) exit fi ;; + restart) stop - sleep 2 + sleep 1 start ;; *) diff --git a/install.sh b/install.sh index 910d10f..a307739 100755 --- a/install.sh +++ b/install.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # Script that automate the procces for setting up TOR as a tranparent proxy # Autor: Edu4rdSHL @edu4rdshl @@ -9,33 +9,31 @@ executablerules="$PWD/files/tor-router" servicefile="$PWD/files/tor-router.service" #Check if the current user have root privileges -if [ "$UID" -ne "0" ] ; then - echo -e "\nYou need root permisions to run it script." - exit +if [ "$UID" -ne "0" ]; then + echo -e "\nYou need root permisions to run it script." + exit fi echo -e "Checking if TOR and Systemd are installed..." -if command -v tor >/dev/null && command -v systemctl > /dev/null ; then - if grep -iq "# Seting up TOR transparent proxy for tor-router" "$torconfig" ; then +if command -v tor >/dev/null && command -v systemctl >/dev/null; then + if grep -iq "# Seting up TOR transparent proxy for tor-router" "$torconfig"; then echo -e "\ntor-router is already configured in $torconfig" else echo -e "\nAll fundamentals tools are installed, proceding..." echo -e "\nMaking a backup of your torrc file, if you have problems with the new configuration, delete $torconfig and move $torconfigbackup to $torconfig" cp "$torconfig" "$torconfigbackup" echo -e "\nConfiguring the torrc file to use TOR as a transparent proxy..." - echo -e "\n# Seting up TOR transparent proxy for tor-router\nVirtualAddrNetwork 10.192.0.0/10\nAutomapHostsOnResolve 1\nTransPort 9040\nDNSPort 5353" >> "$torconfig" + echo -e "\n# Seting up TOR transparent proxy for tor-router\nVirtualAddrNetwork 10.192.0.0/10\nAutomapHostsOnResolve 1\nTransPort 9040\nDNSPort 6669" >>"$torconfig" echo -e "\nCreating, enabling and starting the service file tor transparent proxy..." cp "$executablerules" "/usr/bin/" chmod +x "/usr/bin/tor-router" cp "$servicefile" "/etc/systemd/system/" systemctl enable tor-router.service && systemctl start tor-router.service echo -e "\nEnabling and restarting the TOR daemon using systemctl..." - systemctl enable tor && systemctl restart tor - if [ "$?" == 0 ] ; then + if systemctl enable tor && systemctl restart tor; then echo -e "Checking if all are working..." - if command -v curl >/dev/null ; then - curl https://check.torproject.org/ | grep "Congratulations." - if [ "$?" == 0 ] ; then + if command -v curl >/dev/null; then + if curl https://check.torproject.org/ | grep "Congratulations."; then echo -e "\nAll is OK, from now on all your network traffic is under the TOR Network, look for your IP addres in your browser." exit fi