[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-talk] Transparent Proxy with iptables
I made my own iptables bash script for redirection of local traffic through
Tor. I built upon the examples from
adding in some extra functionality that I'd like. This being:
- Disable redirection for every user in the system user group "nontor"
- Full IPv6 support
The user account running the Tor service (debian-tor) is in the nontor group.
So are some other service users which need to communicate directly to the
The script is attached to this mail.
To add IPv6 functionality, I mostly just repeated the rules from iptables in
ip6tables. This worked for the most part, but IPv6 traffic to onion services
doesn't work if I just allow loopback traffic to "::1". I need to allow
outgoing traffic to the lo interface (see line 52 in script), which concerns
me a little bit but is probably just a property of IPv6. When sniffing
loopback traffic, I can see that the IPv6 traffic to Tor's TransPort has my
primary network interface's (eth0) global IP address (2a02:...) as it's
In torrc I added:
Can someone please take a look at the script and look for weaknesses or come
up with possible improvements? I am wondering if there are any risks with
allowing output to the lo interface and if "1337::/16" is a bad idea for
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to