From 1c28e2d4a2ecc85b058fcb754469bde3e4c13e59 Mon Sep 17 00:00:00 2001 From: Bob Mottram Date: Sun, 28 Dec 2014 15:14:30 +0000 Subject: [PATCH] Wifi and tor configuration --- install-freedombone.sh | 76 +++++++----------------------------------- 1 file changed, 12 insertions(+), 64 deletions(-) diff --git a/install-freedombone.sh b/install-freedombone.sh index 00b9dd29..77b89bd8 100755 --- a/install-freedombone.sh +++ b/install-freedombone.sh @@ -6993,19 +6993,6 @@ function route_outgoing_traffic_through_tor { fi apt-get -y --force-yes install tor tor-arm - ### set variables - # Destinations you don't want routed through Tor - _non_tor="192.168.0.0/24 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 192.168.10.0/24 192.168.42.0/24" - - # The user that Tor runs as - _tor_uid="debian-tor" - - # Tor's TransPort - _trans_port="9040" - - # Your internal interface - _int_if="br0" - # Ensure that redirects are possible sed -i "s/net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 1/g" /etc/sysctl.conf sed -i "s/net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 1/g" /etc/sysctl.conf @@ -7013,39 +7000,13 @@ function route_outgoing_traffic_through_tor { sed -i "s/net.ipv4.conf.default.rp_filter=1/#net.ipv4.conf.default.rp_filter=1/g" /etc/sysctl.conf sed -i "s/net.ipv4.conf.all.rp_filter=1/#net.ipv4.conf.all.rp_filter=1/g" /etc/sysctl.conf sed -i 's/net.ipv4.icmp_echo_ignore_all = 1/net.ipv4.icmp_echo_ignore_all = 0/g' /etc/sysctl.conf + sed -i "s/net.ipv4.ip_forward=0/net.ipv4.ip_forward=1/g" /etc/sysctl.conf - iptables --flush - iptables --table nat --flush - iptables --delete-chain - iptables --table nat --delete-chain - - ### Set iptables *nat - iptables -t nat -A OUTPUT -o lo -j RETURN - iptables -t nat -A OUTPUT -m owner --uid-owner $_tor_uid -j RETURN - iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 53 - - # Allow clearnet access for hosts in $_non_tor - for _clearnet in $_non_tor; do - iptables -t nat -A OUTPUT -d $_clearnet -j RETURN - iptables -t nat -A PREROUTING -i $_int_if -d $_clearnet -j RETURN - done - - # Redirect all other pre-routing and output to Tor - iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $_trans_port - iptables -t nat -A PREROUTING -i $_int_if -p udp --dport 53 -j REDIRECT --to-ports 53 - iptables -t nat -A PREROUTING -i $_int_if -p tcp --syn -j REDIRECT --to-ports $_trans_port - - ### set iptables *filter - iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - - # Allow clearnet access for hosts in $_non_tor - for _clearnet in $_non_tor 127.0.0.0/8; do - iptables -A OUTPUT -d $_clearnet -j ACCEPT - done - - # Allow only Tor output - iptables -A OUTPUT -m owner --uid-owner $_tor_uid -j ACCEPT - iptables -A OUTPUT -j REJECT + iptables -F + iptables -t nat -F + iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p tcp --dport $SSH_PORT -j REDIRECT --to-ports $SSH_PORT + iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p udp --dport 53 -j REDIRECT --to-ports 53 + iptables -t nat -A PREROUTING -i $WIFI_INTERFACE -p tcp --syn -j REDIRECT --to-ports 9040 save_firewall_settings @@ -7062,6 +7023,10 @@ function route_outgoing_traffic_through_tor { echo 'VirtualAddrNetworkIPv4 10.192.0.0/10' >> /etc/tor/torrc fi + if ! grep -q "AutomapHostsSuffixes .onion,.exit" /etc/tor/torrc; then + echo 'AutomapHostsSuffixes .onion,.exit' >> /etc/tor/torrc + fi + if ! grep -q "AutomapHostsOnResolve" /etc/tor/torrc; then echo 'AutomapHostsOnResolve 1' >> /etc/tor/torrc fi @@ -7215,7 +7180,7 @@ function enable_wifi_hotspot { fi fi - apt-get -y install hostapd isc-dhcp-server bridge-utils + apt-get -y install hostapd isc-dhcp-server if [ ! -f /etc/default/hostapd ]; then echo 'Unable to find /etc/default/hostapd. hostapd may not have installed correctly' @@ -7240,29 +7205,12 @@ function enable_wifi_hotspot { echo 'wpa_pairwise=TKIP' >> /etc/hostapd/hostapd.conf echo 'rsn_pairwise=CCMP' >> /etc/hostapd/hostapd.conf - if ! grep -q "auto lo br0" /etc/network/interfaces; then - sed -i 's/auto lo/auto lo br0/g' /etc/network/interfaces - fi - if ! grep -q "Wifi hotspot" /etc/network/interfaces; then echo '' >> /etc/network/interfaces echo '# Wifi hotspot' >> /etc/network/interfaces - echo "allow-hotplug $WIFI_INTERFACE" >> /etc/network/interfaces - echo "iface $WIFI_INTERFACE inet manual" >> /etc/network/interfaces - fi - - if ! grep -q "Wireless bridge" /etc/network/interfaces; then - echo '' >> /etc/network/interfaces - echo '# Wireless bridge' >> /etc/network/interfaces - echo 'iface br0 inet static' >> /etc/network/interfaces - echo " bridge_ports $WIFI_INTERFACE eth0" >> /etc/network/interfaces + echo "iface $WIFI_INTERFACE inet static" >> /etc/network/interfaces echo " address $WIFI_STATIC_IP_ADDRESS" >> /etc/network/interfaces echo ' netmask 255.255.255.0' >> /etc/network/interfaces - echo " network $WIFI_SUBNET" >> /etc/network/interfaces - echo " gateway $ROUTER_IP_ADDRESS" >> /etc/network/interfaces - echo " dns-nameservers $ROUTER_IP_ADDRESS" >> /etc/network/interfaces - echo " up iptables -t nat -I POSTROUTING -s $WIFI_SUBNET/24 -j MASQUERADE" >> /etc/network/interfaces - echo " down iptables -t nat -D POSTROUTING -s $WIFI_SUBNET/24 -j MASQUERADE" >> /etc/network/interfaces fi if ! grep -q '#option domain-name "example.org";' /etc/network/interfaces; then