We created the gateway image (gatewaysd
) in a Raspberry Pi 2 with just the onboard ethernet adapter, either FDE with dm-crypt/LUKS and LVM2 or unencrypted. However, for setup the gateway Pi needs a USB-to-ethernet adapter, because we will be configuring (and using) both WAN (eth0) and LAN (eth1) adapters.
Save this how-to guide and Setup workspace SD ("workspacesd") with Tor Browser to a USB flash drive, and copy them to the gateway Pi.
$ sudo mkdir /mnt/usb
$ sudo mount /dev/sda1 /mnt/usb
$ cp /mnt/usb/*.html /home/pi/
$ sudo umount /mnt/usb
Now start Epiphany in the gateway Pi, drag this how-to guide to open it, and bookmark it. Then open LXTerminal. Now you can copy text from the guide, and paste it into the terminal, using "Shift-Ctrl-V".
Initial Setup
Configure the network interfaces. These instructions assume that the Pi WAN interface is connected to LAN <192.168.1.0/24>, and that a DHCP server at <192.168.1.1> is pushing valid DNS server(s). If your LAN IP range is different, adjust the LAN IPs in the iptables rules below accordingly. And by the way, if WAN (eth0) and LAN (eth1) are in the same IP range, there will be no routing. We'll make the Pi WAN interface static after configuring OpenVPN, and finally configure a DHCP server on the Pi LAN interface.
$ sudo nano /etc/network/interfaces
........................
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
auto eth1
iface eth1 inet static
address 192.168.2.1
netmask 255.255.255.0
........................
$ sudo ifdown eth0
$ sudo ifup eth0
$ sudo ifup eth1
OpenVPN Setup
Login to your iVPN (or other VPN service) account, download the latest config files (for iVPN, from https://www.ivpn.net/dl.php?type=d&id=80) and extract the archive to /home/pi
. Then reconfigure openvpn, so that it doesn't start all valid VPNs at boot. That's necessary because iVPN requires entering username and password to connect, and the openvpn daemon doesn't have a mechanism to prompt for entering them.
$ sudo nano /etc/default/openvpn
................
...
AUTOSTART="none"
...
................
Create a script that: 1) displays available VPN routes; 2) prompts for username, password and route to be started; 3) creates /tmp/user-pass
; and 4) starts the specified VPN connection.
$ mkdir bin
$ nano /home/pi/bin/Start
.......................................................
#!/bin/bash
echo ""
echo "List available iVPN connections."
ls /etc/openvpn/*.conf | sed -e s#/etc/openvpn/## | sed -e s/.conf//
echo ""
echo "Enter username, password and route for iVPN connection."
read -s -p "username: " username
echo "......."
read -s -p "password: " password
echo "......."
read -p "route: " route
echo ""
echo $username > /tmp/user-pass
echo $password >> /tmp/user-pass
echo "Start specified iVPN connection."
sudo service openvpn start $route
.......................................................
$ chmod 755 /home/pi/bin/Start
Then you start iVPN as follows.
$ ./bin/Start
We will configure iptables to block all non-VPN Internet access, except to three groups of servers: 1) iVPN servers that we want to use; 2) Raspbian wheezy repository servers, for package updates; and 3) NTP timeservers, to insure that the Pi knows the correct time. No DNS servers are reachable via WAN (eth0) and so iVPN servers must be specified by IP addresses, or resolved locally. For iVPN servers, it's most straightforward to specify IP addresses in the config files. Choose the iVPN routes that you'll be using, and edit their config files. Also point to /tmp/user-pass
, and change "verb 3" to "verb 5".
In this example, I'll do "IVPN-Singlehop-Netherlands". In one LXTerminal:
$ mkdir /home/pi/IVPN-config/edited
$ cp /home/pi/IVPN-config/IVPN-Singlehop-Netherlands.conf /home/pi/IVPN-config/edited/
$ cat /home/pi/IVPN-config/edited/IVPN-Singlehop-Netherlands.conf
...........................
...
remote gw1.nl.ivpn.net 2049
auth-user-pass
...
verb 3
...........................
In a second LXTerminal:
$ sudo host gw1.nl.ivpn.net
=> gw1.nl.ivpn.net has address 85.12.8.104
Back in the first LXTerminal, edit the config file, and save.
$ nano /home/pi/IVPN-config/edited/IVPN-Singlehop-Netherlands.conf
.............................
...
remote 85.12.8.104 2049
auth-user-pass /tmp/user-pass
...
verb 5
.............................
Copy VPN credentials and selected route configs to /etc/openvpn
.
$ cd /home/pi/IVPN-config
$ sudo cp ca.crt client1.crt client1.key ta.key /etc/openvpn/
$ cd edited
$ sudo cp *.conf /etc/openvpn/
Remove read rights on credentials for group and other.
$ cd /etc/openvpn
$ sudo chmod go-r ca.crt client1.crt client1.key ta.key
Start "IVPN-Singlehop-Netherlands".
$ sudo service openvpn start IVPN-Singlehop-Netherlands
[ ok ] Starting virtual private network daemon: IVPN-Singlehop-Netherlands.
And check status.
$ sudo service openvpn status
[warn] No VPN autostarted ... (warning).
[ ok ] VPN 'IVPN-Singlehop-Netherlands' (non autostarted) is running.
$ sudo ifconfig
..................................................
eth0 ... inet addr:192.168.1.104 ...
eth1 ... inet addr:192.168.2.1 ...
lo ... inet addr:127.0.0.1 ...
tun0 ... inet addr:10.9.0.6 P-t-P:10.9.0.5 ...
..................................................
In Epiphany, browse https://whatismyipaddress.com/ => 85.12.8.104 [Base IP B.V.]
Configure /etc/hosts
The above approach doesn't work for Raspbian wheezy repositories and NTP (time) servers, and so we use /etc/hosts
. Update package lists, get the hostnames being hit, and use host to get the IP addresses.
$ sudo apt-get update
=> hits mirrordirector.raspbian.org, archive.raspberrypi.org and raspberrypi.collabora.com
$ sudo apt-get install ntpdate
=> also hits mirror.nl.leaseweb.net
$ sudo host mirrordirector.raspbian.org
=> 5.153.225.207
$ sudo host mirror.nl.leaseweb.net
=> 94.75.223.121
$ sudo host archive.raspberrypi.org
=> 93.93.128.211, 93.93.128.230, 93.93.130.39 and 93.93.130.214
$ sudo host raspberrypi.collabora.com
=> 93.93.128.223
Now see what NTP servers are being hit, and use host to get the IP addresses.
$ sudo nano /etc/ntp.conf
=> hits 0.debian.pool.ntp.org, 1.debian.pool.ntp.org, 2.debian.pool.ntp.org, and 3.debian.pool.ntp.org
$ sudo host 0.debian.pool.ntp.org
=> 67.198.37.16, 82.141.152.3, 87.195.109.207 and 95.213.132.250
$ sudo host 1.debian.pool.ntp.org
=> 87.230.85.6, 92.63.212.161, 131.234.137.24 and 188.126.88.9
$ sudo host 2.debian.pool.ntp.org
=> 77.245.18.26, 83.137.98.96, 85.214.108.169 and 193.224.65.146
$ sudo host 3.debian.pool.ntp.org
=> 157.7.154.29, 176.74.25.228, 173.230.144.109 and 193.219.61.110
Configure host and populate /etc/hosts
with the above information.
$ sudo nano /etc/host.conf
....................
multi on
order hosts bind nis
....................
$ sudo nano /etc/hosts
............................................
127.0.0.1 localhost
127.0.1.1 vpngateway
5.153.225.207 mirrordirector.raspbian.org
93.93.128.211 archive.raspberrypi.org
93.93.128.230 archive.raspberrypi.org
93.93.130.39 archive.raspberrypi.org
93.93.130.214 archive.raspberrypi.org
93.93.128.223 raspberrypi.collabora.com
94.75.223.121 mirror.nl.leaseweb.net
67.198.37.16 0.debian.pool.ntp.org
82.141.152.3 0.debian.pool.ntp.org
87.195.109.207 0.debian.pool.ntp.org
95.213.132.250 0.debian.pool.ntp.org
87.230.85.6 1.debian.pool.ntp.org
92.63.212.161 1.debian.pool.ntp.org
131.234.137.24 1.debian.pool.ntp.org
188.126.88.9 1.debian.pool.ntp.org
77.245.18.26 2.debian.pool.ntp.org
83.137.98.96 2.debian.pool.ntp.org
85.214.108.169 2.debian.pool.ntp.org
193.224.65.146 2.debian.pool.ntp.org
157.7.154.29 3.debian.pool.ntp.org
176.74.25.228 3.debian.pool.ntp.org
173.230.144.109 3.debian.pool.ntp.org
193.219.61.110 3.debian.pool.ntp.org
............................................
Configure iptables
Now that OpenVPN is working, configure iptables. But first make sure that the default iptables ruleset allows everything. That way, if you manage to lock yourself out, rebooting will restore access.
$ sudo nano /etc/iptables/rules.v4
.....................
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
.....................
You want an iptables ruleset that blocks all non-VPN connections to the Internet. It drops all input, forward and output by default, so all desired traffic must be explicitly allowed. Further, various sorts of malformed packets are dropped early, as in adrelanos' VPN-Firewall.
$ sudo nano /etc/iptables/vpn-rules.v4
...........................................................................................
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A OUTPUT -o lo -j RETURN
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
-A INPUT -i eth1 -s 192.168.2.0/24 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG --log-prefix "vpn-gw blocked input: "
-A INPUT -j DROP
-A FORWARD -i eth1 -o tun0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j LOG --log-prefix "vpn-gw blocked forward: "
-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -j ACCEPT
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 5.153.225.207/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.211/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.223/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.230/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.130.39/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.130.214/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 67.198.37.16 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 77.245.18.26 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 82.141.152.3 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 83.137.98.96 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 85.214.108.169 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 87.195.109.207 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 87.230.85.6 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 92.63.212.161 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 95.213.132.250 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 131.234.137.24 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 157.7.154.29 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 173.230.144.109 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 176.74.25.228 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 188.126.88.9 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 193.219.61.110 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 193.224.65.146 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 85.12.8.104/32 --dport 2049 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j LOG --log-prefix "vpn-gw blocked output: "
-A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
COMMIT
...........................................................................................
In the above ruleset, the rule -A OUTPUT -o eth0 -p udp -m udp -d 85.12.8.104/32 --dport 2049 -j ACCEPT
allows connections to the server for "IVPN-Singlehop-Netherlands". The following rule must be replicated for each VPN server to be used.
$ sudo iptables-restore < /etc/iptables/vpn-rules.v4
Verify that you can still hit repository and NTP servers.
$ sudo apt-get update
=> should see no errors
$ sudo ntpdate
=> should see no DNS errors
Now test "IVPN-Singlehop-Netherlands".
$ sudo service openvpn restart IVPN-Singlehop-Netherlands
[ ok ] Starting virtual private network daemon: IVPN-Singlehop-Netherlands.
$ sudo service openvpn status
[warn] No VPN autostarted ... (warning).
[ ok ] VPN 'IVPN-Singlehop-Netherlands' (non autostarted) is running.
$ sudo ifconfig
eth0 ... inet addr:192.168.1.100 ...
eth1 ... inet addr:192.168.2.1 ...
lo ... inet addr:127.0.0.1 ...
tun0 ... inet addr:10.9.0.230 P-t-P:10.9.0.229 ...
In Epiphany, browse https://whatismyipaddress.com/. => 85.12.8.106 [Base IP B.V.]
Browse https://www.grc.com/dns/dns.htm and run standard test. => 85.12.5.11 is only reachable DNS server
Repeating the above, you will get different "inet addr" and "P-t-P" values, but they will always be in <10.9.0.0/16> for "IVPN-Singlehop-Netherlands". The DNS server for "IVPN-Singlehop-Netherlands" is <10.9.0.1>.
Now it's time to reconfigure eth0 statically, because you no longer need (or want) the DNS server(s) that <192.168.1.1> pushes.
$ sudo nano /etc/network/interfaces
........................
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.1.100
netmask 255.255.255.0
gateway 192.168.1.1
auto eth1
iface eth1 inet static
address 192.168.2.1
netmask 255.255.255.0
........................
$ sudo ifdown eth0
$ sudo ifup eth0
And now you can configure /etc/resolv.conf
, because DHCP won't be changing it.
$ sudo nano /etc/resolv.conf
....................
domain localdomain
search localdomain
nameserver 10.9.0.1
....................
Once you're satisfied that your iptables ruleset is working, you can rename it so that it loads at bootup.
$ sudo mv /etc/iptables/rules.v4 /etc/iptables/open-rules.v4
$ sudo mv /etc/iptables/vpn-rules.v4 /etc/iptables/rules.v4
$ sudo iptables-restore < /etc/iptables/rules.v4
Lock Down SSH Server in Gateway
Here you setup key-authenticated SSH access to the gateway Pi from devices on local LANs (attached to its WAN and LAN interfaces). You could also permit SSH access from the Internet. For general access, that would entail changing -A INPUT -i eth0 -p tcp -m tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
in /etc/iptables/vpn-rules.v4
to -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
. To permit access from a specific device at -A INPUT -i eth0 -p tcp -m tcp -s w.x.y.z/32 --dport 22 -j ACCEPT
. You would also need to open port 22 on your perimeter router, and configure forwarding on any intervening routers.
First, generate RSA key pair in your workspace client, or other device.
$ ssh-keygen
SCP the public key to iVPN gateway Pi.
$ scp /home/pi/.ssh/id_rsa.pub pi@192.168.2.1:/home/pi/
Then SSH to the iVPN gateway Pi.
$ ssh pi@192.168.2.1
Working now via SSH in the iVPN gateway Pi.
$ mkdir .ssh
$ nano /home/pi/.ssh/authorized_keys
Hit Ctrl-R and read in /home/pi/id_rsa.pub, and save and exit.
Now lock down "sshd_config".
$ sudo nano /etc/ssh/sshd_config
....................................................
...
PermitRootLogin no
...
AuthorizedKeysFile /home/pi/.ssh/authorized_keys
...
PasswordAuthentication no
...
....................................................
$ sudo service ssh restart
Open another LXTerminal in the workspace client to test SSH. It doesn't matter here, because the gateway Pi is accessible, but getting locked out of a remote server can be a hassle.
$ ssh pi@192.168.2.1
Enter passphrase for key '/home/pi/.ssh/id_rsa': xxxxxxxxxxxxxx
You can repeat the process for other devices that you want to use for managing the iVPN Pi gateway. You can start, stop and restart VPN connections, add new ones, tweak the iptables ruleset and so on.
$ sudo service openvpn status
[warn] No VPN autostarted ... (warning).
[ ok ] VPN 'IVPN-Singlehop-Netherlands' (non autostarted) is running.
$ sudo service openvpn stop
[ ok ] Stopping virtual private network daemon: IVPN-Singlehop-Netherlands.
$ sudo service openvpn start IVPN-Singlehop-Netherlands
[ ok ] Starting virtual private network daemon: IVPN-Singlehop-Netherlands.
$ sudo service openvpn status
[warn] No VPN autostarted ... (warning).
[ ok ] VPN 'IVPN-Singlehop-Netherlands' (non autostarted) is running.
When more VPN routes are configured, you'll see a [FAIL] VPN 'IVPN-Route-Name' (non autostarted) is not running ... failed!
line for all of them that aren't running. So sudo service openvpn status
effectively provides a menu of available VPN routes.
Install and Configure Tor, and Tweak iptables
$ sudo apt-get install tor
$ sudo service tor status
[ ok ] tor is running.
Now edit /etc/tor/torrc
. You can create as many SocksPorts as you like, and then implement stream isolation, by configing each app in the workspace Pi (natively or with uwt to use a different one.
$ sudo nano /etc/tor/torrc
........................................
SocksPort 127.0.0.1:9050
SocksPort 192.168.2.1:9050
SocksPort 192.168.2.1:9100
SocksPort 192.168.2.1:9150
SocksPolicy accept 127.0.0.1
SocksPolicy accept 192.168.2.0/16
SocksPolicy reject *
DnsPort 127.0.0.1:53 IsolateDestPort
DnsPort 192.168.2.1:53 IsolateDestPort
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
ControlPort 9151
CookieAuthentication 1
Log notice file /var/log/tor/notices.log
RunAsDaemon 1
DataDirectory /var/lib/tor
........................................
$ sudo service tor restart
$ sudo service tor status
[ ok ] tor is running.
Get ID for debian-tor, the special user that runs the tor daemon. The debian-tor UID in your install may be different.
$ id -u debian-tor
=> 107
Then edit the iptables ruleset. With this ruleset, apps on the workspace Pi can only reach the Internet through the Tor daemon on the gateway Pi. There is no forwarding from the workspace Pi to the gateway Pi. Only the Tor daemon can reach the Internet through the iVPN tunnel. And only the iVPN tunnel can reach the Internet through the WAN adapter of the gateway Pi (plus connections to Raspbian wheezy repositories and NTP servers, but no DNS servers).
$ sudo cp /etc/iptables/rules.v4 /etc/iptables/vpn-tor-rules.v4
$ sudo nano /etc/iptables/vpn-tor-rules.v4
..........................................................................................
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A OUTPUT -o lo -j RETURN
-A OUTPUT -m owner --uid-owner 107 -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -p udp -m udp --dport 123 -j REDIRECT --to-ports 123
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp -s 192.168.1.0/24 --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp -s 192.168.2.2 --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp -s 192.168.2.2 --dport 9050 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp -s 192.168.2.2 --dport 9100 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp -s 192.168.2.2 --dport 9150 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp -s 192.168.2.2 --dport 9151 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p udp -m udp -s 192.168.2.2 --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p udp -m udp -s 192.168.2.2 --dport 123 -m state --state NEW -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG --log-prefix "vpn-tor-gw blocked input: "
-A INPUT -j DROP
-A FORWARD -j LOG --log-prefix "vpn-tor-gw blocked forward: "
-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -j ACCEPT
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 5.153.225.207/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.211/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.223/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.128.230/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.130.39/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp -d 93.93.130.214/32 --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 67.198.37.16 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 77.245.18.26 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 82.141.152.3 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 83.137.98.96 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 85.214.108.169 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 87.195.109.207 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 87.230.85.6 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 92.63.212.161 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 95.213.132.250 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 131.234.137.24 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 157.7.154.29 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 173.230.144.109 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 176.74.25.228 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 188.126.88.9 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 193.219.61.110 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 193.224.65.146 --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp -d 85.12.8.104/32 --dport 2049 -j ACCEPT
-A OUTPUT -o tun0 -s 10.9.0.0/16 -j ACCEPT
-A OUTPUT -o tun0 -m owner --uid-owner 107 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j LOG --log-prefix "vpn-tor-gw blocked output: "
-A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
COMMIT
..........................................................................................
$ sudo iptables-restore < /etc/iptables/vpn-tor-rules.v4
Verify that torsocks apt-get works:
$ sudo torsocks apt-get update
Tweak start script to restart the Tor service after starting the OpenVPN service.
$ nano /home/pi/bin/Start
.......................................................
#!/bin/bash
echo ""
echo "List available iVPN connections."
ls /etc/openvpn/*.conf
echo ""
echo "Enter username, password and route for iVPN connection."
read -s -p "username: " username
echo "......."
read -s -p "password: " password
echo "......."
read -p "route: " route
echo ""
echo $username > /tmp/user-pass
echo $password >> /tmp/user-pass
echo "Start specified iVPN connection."
sudo service openvpn start $route
sleep 30
sudo service tor restart
.......................................................
Now that you know that the rules work:
$ sudo mv /etc/iptables/rules.v4 /etc/iptables/vpn-rules.v4
$ sudo mv /etc/iptables/vpn-tor-rules.v4 /etc/iptables/rules.v4
Whenever you're done, you can shutdown the gateway.
$ sudo shutdown -hP now
For FDE Gateway SD, Configure Dropbear for Opening LUKS via SSH
You must first setup the workspace Pi. Connect eth0 of the gateway Pi to LAN <192.168.1.0/24> with Internet connectivity (perhaps via a nested VPN chain). Connect eth1 of the gateway Pi to eth0 of the workspace Pi. Powerup the gateway Pi with display and keyboard attached, unlock the LUKS volume, and login. Then switch the display and keyboard to the workspace Pi, and do the same for it. Now SSH to the gateway Pi.
pi@workspacesd:~$ ssh pi@192.168.2.1
pi@gatewaysd ~ $ sudo apt-get install dropbear busybox
pi@gatewaysd ~ $ sudo cp /etc/initramfs-tools/initramfs.conf /etc/initramfs-tools/initramfs.conf.default
pi@gatewaysd ~ $ sudo nano /etc/initramfs-tools/initramfs.conf
...................................................
MODULES=most
BUSYBOX=y
KEYMAP=n
COMPRESS=gzip
DEVICE=eth1
IP=192.168.2.1::192.168.2.1:255.255.255.0::eth1:off
NFSROOT=auto
...................................................
pi@gatewaysd ~ $ sudo update-initramfs -u
pi@gatewaysd ~ $ sudo scp /etc/initramfs-tools/root/.ssh/id_rsa user@192.168.2.2:~/.ssh/id_rsa_dropbear
pi@gatewaysd ~ $ sudo dropbearkey -y -f /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key |grep -i fingerprint
Now reboot the gateway Pi. Login via dropbear, and unlock the LUKS volume using your passphrase (LUKS_passphrase).
pi@gatewaysd ~ $ sudo reboot
pi@workspacesd:~$ ssh -o "UserKnownHostsFile=~/.ssh/known_hosts.initramfs" -i ~/.ssh/id_rsa_dropbear root@192.168.2.1
pi@workspacesd:~$ echo -ne LUKS_passphrase >/lib/cryptsetup/passfifo
Now SSH to the gateway Pi.
pi@workspacesd:~$ ssh pi@192.168.2.1
Now, after powering up the gateway Pi and workspace Pi, you can unlock the gateway Pi's LUKS volume via dropbear from the workspace Pi.