TOR relay and transparent routing

I assume you already know about TOR, The Onion Router for anonymity to protect your privacy.

TOR is a network so it can only work if there are nodes (relays). If you have a server, you can run one so consider it. Afraid of legal issues? You do not need to run an exit node, a relay is just fine: everything is encrypted.

This post will show you how easy it is to set up a TOR relay on Debian, how to nicely monitor it and how to use it as a transparent router.

Setup

Simple: a NAT router and behind a LAN with a server and a workstation.

           ________                ________
 internet |        |      LAN     |        |
----------| (NAT)  |--------------| server | 192.168.0.1
 1.2.3.4  | router |---------.    |________|
          |________|         |
                       ______|______
                      |             |
                      | workstation | 192.168.0.2
                      |_____________|
 

Install

If you are not root, use sudo -i or su to get a root shell then:

# echo 'deb http://deb.torproject.org/torproject.org squeeze main' \
  >> /etc/apt/sources.list
# gpg --recv 74A941BA219EC810
# gpg --export --armor 74A941BA219EC810 | apt-key add -
# apt-get update
# apt-get install tor

Prepare a control password

You will need a password to remotely control your TOR server:

$ tor --hash-password test
[...]
16:A908451A24E6A06D604B4D30592A14A177FD276103658D4F10D9C4B12F

Configuration

Open /etc/tor/torrc with your favourite editor and configure a few things:

# TOR SOCKS port
SocksPort 0.0.0.0:9050

# Control port
ControlPort 0.0.0.0:9051
HashedControlPassword 16:A908451(...the hash above...)10D9C4B12F

# TOR relay port
ORPort 9001

# Throttle traffic to 100KB/s (800Kbps) but allow bursts up to 200KB/s (1600Kbps)
RelayBandwidthRate 100 KB
RelayBandwidthBurst 200 KB

# No exits allowed, just be a relay node
ExitPolicy reject *:*

# Transparent router
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 0.0.0.0:9040
DNSPort 0.0.0.0:53

Apply:

# invoke-rc.d tor reload

Firewall

I like iptables with ferm, for easy rule making. Edit /etc/ferm/ferm.conf:

domain ip {
  table filter {
    chain INPUT {
      proto tcp dport 9001 ACCEPT; # ORPort
      saddr 192.168.0.0/24 {
        proto udp dport 53 ACCEPT;   # DNSPort
        proto tcp dport 9040 ACCEPT; # TransPort
        proto tcp dport 9050 ACCEPT; # SocksPort
        proto tcp dport 9051 ACCEPT; # ControlPort
      }
    }
  }
  table nat {
    chain PREROUTING {
      interface eth0 saddr 192.168.0.0/24 {
        # Do not redirect RFC1918, except VirtualAddrNetwork (10.192.0.0/10)
        daddr (10.0.0.0/9 10.128.0.0/10 172.16.0.0/12 192.168.0.0/16) ACCEPT;
        proto tcp syn REDIRECT to-ports 9040; # TransPort
      }
    }
  }
  # Make sure NOT to forward traffic (e.g. udp which does not go via TOR)
  table FORWARD policy DROP;
}

Apply:

# invoke-rc.d ferm reload

Port forwarding

The only port you need to forward from your router to your TOR server is 9001.
If your router is also a Linux server, you can do this with ferm again. Edit /etc/ferm/ferm.conf:

domain ip {
  table nat {
    chain PREROUTING {
      daddr 1.2.3.4 {
        proto tcp dport 9001 DNAT to 192.168.0.1; # ORPort
      }
    }
  }
}

Apply:

# invoke-rc.d ferm reload

Monitoring

I like ARM, the Anonymizing Relay Monitor in console:

Install:

# apt-get install tor-arm

And start it:

# arm

You can also run arm remotely, by connecting on the ControlPort (9051) and using the control password.

Use TOR on the workstation

Instead of using TOR for the whole system, let's add a tor user that will pass through TOR, while other users still use the normal connection:

# adduser tor

And now it is policy routing on user.

Edit /etc/ferm/ferm.conf to apply specific rules to tor user:

1. mark packets for later specific routing
2. redirect DNS requests to TOR resolver instead of your DNS resolver to avoid DNS leak

@def $RESOLVERS = `awk '$1=="nameserver"{print $2}' /etc/resolv.conf`;

domain ip {
  table mangle {
    chain OUTPUT {
      mod owner uid-owner tor MARK set-mark 0x1;
    }
  }
  table nat {
    chain OUTPUT {
      mod owner uid-owner tor daddr $RESOLVERS
        proto (tcp udp) dport 53 DNAT to 192.168.0.1;
    }
  }
}

Apply:

# invoke-rc.d ferm reload

And route packets differently based on the mark:

# ip rule add fwmark 0x1 table 100
# ip route add default via 192.168.0.1 table 100
# ip route flush cache

To persist after reboot, edit /etc/network/interfaces and add 3 post-up to your network interface:

auto eth0
iface eth0 inet static
  address 192.168.0.2
  netmask 255.255.255.0
  gateway 192.168.0.254

  post-up ip rule add fwmark 0x1 table 100
  post-up ip route add default via 192.168.0.1 table 100
  post-up ip route flush cache

Now try:

tor$ curl ifconfig.me
[not your IP but a TOR exit node]