{"id":287,"date":"2016-04-10T18:00:54","date_gmt":"2016-04-10T16:00:54","guid":{"rendered":"http:\/\/neuronetix.de\/?p=287"},"modified":"2019-02-25T19:49:49","modified_gmt":"2019-02-25T17:49:49","slug":"transparentes-tor-gateway-unter-ubuntu","status":"publish","type":"post","link":"https:\/\/neuronetix.de\/?p=287","title":{"rendered":"Transparentes TOR Gateway unter Ubuntu"},"content":{"rendered":"

Um ein transparentes TOR Gateway zu realisieren kann man wie folgt vorgehen:<\/p>\n

Nach der Installation von TOR wird die torrc unter<\/p>\n

\/etc\/tor\/torrc<\/pre>\n
wie folgt erg\u00e4nzt (ich habe das ganz oben gemacht):<\/p>\n
Log notice file \/var\/log\/tor\/tor-notices.log\nVirtualAddrNetwork 10.192.0.0\/10\nAutomapHostsSuffixes .onion,.exit\nAutomapHostsOnResolve 1\nTransPort 9040\nTransListenAddress 192.168.100.254\nDNSPort 53\nDNSListenAddress 192.168.100.254<\/pre>\n
anschlie\u00dfend den TOR Dienst neu starten:<\/p>\n
sudo service tor restart<\/pre>\n
neu starten.<\/p>\n
Mittels iptables kann man dann den gesamten Traffic eines interfaces (im Beispiel eth1) auf den TOR Transport umleiten. Dazu sollte die PREROUTING Chain der nat Table folgende Regeln enthalten:<\/p>\n
Chain PREROUTING (policy ACCEPT)\ntarget\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\nREDIRECT\u00a0\u00a0 udp\u00a0 --\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 udp dpt:domain redir ports 53\nREDIRECT\u00a0\u00a0 tcp\u00a0 --\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 anywhere\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcpflags: FIN,SYN,RST,ACK\/SYN redir ports 9040<\/pre>\n
Die erste Regel sorgt daf\u00fcr, das DNS queries den lokalen Rechner erreichen damit .onion und .exit URLs aufgel\u00f6st werden k\u00f6nnen. Die zweite Regel leitet allen anderen Traffic auf den TOR Transport um.<\/p>\n
Die Regeln k\u00f6nnen wie folgt erstellt werden:<\/p>\n
sudo iptables -t nat -A PREROUTING -i eth1 -p udp --dport 53 -j REDIRECT --to-ports 53\nsudo iptables -t nat -A PREROUTING -i eth1 -p tcp --syn -j REDIRECT --to-ports 9040<\/code><\/pre>\n
Etwas detaillierter ist das ganze noch hier<\/a> beschrieben.<\/p>\n","protected":false},"excerpt":{"rendered":"
Um ein transparentes TOR Gateway zu realisieren kann man wie folgt vorgehen: Nach der Installation von TOR wird die torrc unter \/etc\/tor\/torrc wie folgt erg\u00e4nzt (ich habe das ganz oben gemacht): Log notice file \/var\/log\/tor\/tor-notices.log VirtualAddrNetwork 10.192.0.0\/10 AutomapHostsSuffixes .onion,.exit AutomapHostsOnResolve 1 TransPort 9040 TransListenAddress 192.168.100.254 DNSPort 53 DNSListenAddress 192.168.100.254 anschlie\u00dfend den TOR Dienst neu starten: […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/posts\/287"}],"collection":[{"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/neuronetix.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=287"}],"version-history":[{"count":3,"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions"}],"predecessor-version":[{"id":290,"href":"https:\/\/neuronetix.de\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions\/290"}],"wp:attachment":[{"href":"https:\/\/neuronetix.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/neuronetix.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/neuronetix.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}