111 lines
3.0 KiB
Bash
Executable File
111 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
cd
|
|
|
|
mkdir -p $DESTDIR/etc/systemd/system
|
|
cat > $DESTDIR/etc/systemd/system/tor.service <<EOF
|
|
[Unit]
|
|
Description=Anonymizing overlay network for TCP
|
|
After=syslog.target network.target nss-lookup.target
|
|
PartOf=tor-master.service
|
|
ReloadPropagatedFrom=tor-master.service
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=all
|
|
ExecStartPre=/usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc.ours --verify-config
|
|
ExecStart=/usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc.ours
|
|
ExecReload=/bin/kill -HUP \${MAINPID}
|
|
KillSignal=SIGINT
|
|
TimeoutSec=30
|
|
Restart=on-failure
|
|
RestartSec=1
|
|
WatchdogSec=1m
|
|
LimitNOFILE=32768
|
|
|
|
[Install]
|
|
WantedBy = multi-user.target
|
|
EOF
|
|
|
|
mkdir -p $DESTDIR/etc/tor
|
|
cat > $DESTDIR/etc/tor/torrc.ours <<EOF
|
|
|
|
DataDirectory /var/lib/tor
|
|
DataDirectoryGroupReadable 1
|
|
User debian-tor
|
|
Log notice syslog
|
|
#Log debug stderr
|
|
AutomapHostsOnResolve 1
|
|
DNSPort 5353
|
|
Log debug stderr
|
|
TransPort 9040
|
|
VirtualAddrNetworkIPv4 10.192.0.0/10
|
|
|
|
EOF
|
|
|
|
cat > $DESTDIR/etc/systemd/system/iptables-restore.service <<EOF
|
|
[Unit]
|
|
Description=apply iptables rules
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/bin/sh /etc/rc.firewall
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
cat > $DESTDIR/etc/rc.firewall <<EOF
|
|
### set variables
|
|
#destinations you don't want routed through Tor
|
|
_non_tor="192.168.1.0/24 192.168.0.0/24"
|
|
|
|
#the UID that Tor runs as (varies from system to system)
|
|
_tor_uid="\$(id -u toranon)"
|
|
|
|
#Tor's TransPort
|
|
_trans_port="9040"
|
|
_dns_port="5353"
|
|
|
|
### flush iptables
|
|
iptables -F
|
|
iptables -t nat -F
|
|
|
|
### set iptables *nat
|
|
iptables -t nat -A OUTPUT -m owner --uid-owner \$_tor_uid -j RETURN
|
|
iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports \$_dns_port
|
|
|
|
#allow clearnet access for hosts in \$_non_tor
|
|
for _clearnet in \$_non_tor 127.0.0.0/9 127.128.0.0/10; do
|
|
iptables -t nat -A OUTPUT -d \$_clearnet -j RETURN
|
|
done
|
|
|
|
#redirect all other output to Tor's TransPort
|
|
iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports \$_trans_port
|
|
|
|
### set iptables *filter
|
|
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
#allow clearnet access for hosts in \$_non_tor
|
|
for _clearnet in \$_non_tor 127.0.0.0/8; do
|
|
iptables -A OUTPUT -d \$_clearnet -j ACCEPT
|
|
done
|
|
|
|
#allow only Tor output
|
|
iptables -A OUTPUT -m owner --uid-owner \$_tor_uid -j ACCEPT
|
|
iptables -A OUTPUT -j REJECT
|
|
EOF
|
|
|
|
|
|
mkdir -p $DESTDIR/etc/systemd/system/multi-user.target.wants
|
|
ln -sf /etc/systemd/system/tor.service $DESTDIR/etc/systemd/system/multi-user.target.wants/tor.service
|
|
ln -sf /usr/lib/systemd/system/systemd-networkd.service $DESTDIR/etc/systemd/system/multi-user.target.wants/systemd-networkd.service
|
|
mkdir -p $DESTDIR/etc/systemd/system/sockets.target.wants
|
|
ln -sf /usr/lib/systemd/system/systemd-networkd.socket $DESTDIR/etc/systemd/system/sockets.target.wants/systemd-networkd.socket
|
|
ln -sf /etc/systemd/system/iptables-restore.service $DESTDIR/etc/systemd/system/multi-user.target.wants/iptables-restore.service
|
|
|
|
# disable failing services
|
|
ln -sf /dev/null $DESTDIR/etc/systemd/system/systemd-update-utmp.service
|
|
ln -sf /dev/null $DESTDIR/etc/systemd/system/systemd-tmpfiles-setup.service
|