Wifi and tor configuration
This commit is contained in:
Bob Mottram
parent
14b7965f96
commit
1c28e2d4a2
|
|
@ -6993,19 +6993,6 @@ function route_outgoing_traffic_through_tor {
|
|||
fi
|
||||
apt-get -y --force-yes install tor tor-arm
|
||||
|
||||
### set variables
|
||||
# Destinations you don't want routed through Tor
|
||||
_non_tor="192.168.0.0/24 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 192.168.10.0/24 192.168.42.0/24"
|
||||
|
||||
# The user that Tor runs as
|
||||
_tor_uid="debian-tor"
|
||||
|
||||
# Tor's TransPort
|
||||
_trans_port="9040"
|
||||
|
||||
# Your internal interface
|
||||
_int_if="br0"
|
||||
|
||||
# Ensure that redirects are possible
|
||||
sed -i "s/net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 1/g" /etc/sysctl.conf
|
||||
sed -i "s/net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 1/g" /etc/sysctl.conf
|
||||
|
|
@ -7013,39 +7000,13 @@ function route_outgoing_traffic_through_tor {
|
|||
sed -i "s/net.ipv4.conf.default.rp_filter=1/#net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf
|
||||
sed -i "s/net.ipv4.conf.all.rp_filter=1/#net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf
|
||||
sed -i 's/net.ipv4.icmp_echo_ignore_all = 1/net.ipv4.icmp_echo_ignore_all = 0/g' /etc/sysctl.conf
|
||||
sed -i "s/net.ipv4.ip_forward=0/net.ipv4.ip_forward=1/g" /etc/sysctl.conf
|
||||
|
||||
iptables --flush
|
||||
iptables --table nat --flush
|
||||
iptables --delete-chain
|
||||
iptables --table nat --delete-chain
|
||||
|
||||
### Set iptables *nat
|
||||
iptables -t nat -A OUTPUT -o lo -j RETURN
|
||||
iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN
|
||||
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53
|
||||
|
||||
# Allow clearnet access for hosts in $_non_tor
|
||||
for _clearnet in $_non_tor; do
|
||||
iptables -t nat -A OUTPUT -d $_clearnet -j RETURN
|
||||
iptables -t nat -A PREROUTING -i $_int_if -d $_clearnet -j RETURN
|
||||
done
|
||||
|
||||
# Redirect all other pre-routing and output to Tor
|
||||
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port
|
||||
iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53
|
||||
iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port
|
||||
|
||||
### set iptables *filter
|
||||
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Allow clearnet access for hosts in $_non_tor
|
||||
for _clearnet in $_non_tor 127.0.0.0/8; do
|
||||
iptables -A OUTPUT -d $_clearnet -j ACCEPT
|
||||
done
|
||||
|
||||
# Allow only Tor output
|
||||
iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT
|
||||
iptables -A OUTPUT -j REJECT
|
||||
iptables -F
|
||||
iptables -t nat -F
|
||||
iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p tcp --dport $SSH_PORT -j REDIRECT --to-ports $SSH_PORT
|
||||
iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p udp --dport 53 -j REDIRECT --to-ports 53
|
||||
iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p tcp --syn -j REDIRECT --to-ports 9040
|
||||
|
||||
save_firewall_settings
|
||||
|
||||
|
|
@ -7062,6 +7023,10 @@ function route_outgoing_traffic_through_tor {
|
|||
echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc
|
||||
fi
|
||||
|
||||
if ! grep -q "AutomapHostsSuffixes .onion,.exit" /etc/tor/torrc; then
|
||||
echo 'AutomapHostsSuffixes .onion,.exit' >> /etc/tor/torrc
|
||||
fi
|
||||
|
||||
if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then
|
||||
echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc
|
||||
fi
|
||||
|
|
@ -7215,7 +7180,7 @@ function enable_wifi_hotspot {
|
|||
fi
|
||||
fi
|
||||
|
||||
apt-get -y install hostapd isc-dhcp-server bridge-utils
|
||||
apt-get -y install hostapd isc-dhcp-server
|
||||
|
||||
if [ ! -f /etc/default/hostapd ]; then
|
||||
echo 'Unable to find /etc/default/hostapd. hostapd may not have installed correctly'
|
||||
|
|
@ -7240,29 +7205,12 @@ function enable_wifi_hotspot {
|
|||
echo 'wpa_pairwise=TKIP' >> /etc/hostapd/hostapd.conf
|
||||
echo 'rsn_pairwise=CCMP' >> /etc/hostapd/hostapd.conf
|
||||
|
||||
if ! grep -q "auto lo br0" /etc/network/interfaces; then
|
||||
sed -i 's/auto lo/auto lo br0/g' /etc/network/interfaces
|
||||
fi
|
||||
|
||||
if ! grep -q "Wifi hotspot" /etc/network/interfaces; then
|
||||
echo '' >> /etc/network/interfaces
|
||||
echo '# Wifi hotspot' >> /etc/network/interfaces
|
||||
echo "allow-hotplug $WIFI_INTERFACE" >> /etc/network/interfaces
|
||||
echo "iface $WIFI_INTERFACE inet manual" >> /etc/network/interfaces
|
||||
fi
|
||||
|
||||
if ! grep -q "Wireless bridge" /etc/network/interfaces; then
|
||||
echo '' >> /etc/network/interfaces
|
||||
echo '# Wireless bridge' >> /etc/network/interfaces
|
||||
echo 'iface br0 inet static' >> /etc/network/interfaces
|
||||
echo " bridge_ports $WIFI_INTERFACE eth0" >> /etc/network/interfaces
|
||||
echo "iface $WIFI_INTERFACE inet static" >> /etc/network/interfaces
|
||||
echo " address $WIFI_STATIC_IP_ADDRESS" >> /etc/network/interfaces
|
||||
echo ' netmask 255.255.255.0' >> /etc/network/interfaces
|
||||
echo " network $WIFI_SUBNET" >> /etc/network/interfaces
|
||||
echo " gateway $ROUTER_IP_ADDRESS" >> /etc/network/interfaces
|
||||
echo " dns-nameservers $ROUTER_IP_ADDRESS" >> /etc/network/interfaces
|
||||
echo " up iptables -t nat -I POSTROUTING -s $WIFI_SUBNET/24 -j MASQUERADE" >> /etc/network/interfaces
|
||||
echo " down iptables -t nat -D POSTROUTING -s $WIFI_SUBNET/24 -j MASQUERADE" >> /etc/network/interfaces
|
||||
fi
|
||||
|
||||
if ! grep -q '#option domain-name "example.org";' /etc/network/interfaces; then
|
||||
|
|
|
|||
Loading…
Reference in New Issue