[tor-talk] Transparent Proxy with iptables

[Jonathan Marquardt]

Hello!

I made my own iptables bash script for redirection of local traffic through 
Tor. I built upon the examples from 
https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy while 
adding in some extra functionality that I'd like. This being:

- Disable redirection for every user in the system user group "nontor"
- Full IPv6 support

The user account running the Tor service (debian-tor) is in the nontor group. 
So are some other service users which need to communicate directly to the 
internet.

The script is attached to this mail.

To add IPv6 functionality, I mostly just repeated the rules from iptables in 
ip6tables. This worked for the most part, but IPv6 traffic to onion services 
doesn't work if I just allow loopback traffic to "::1". I need to allow 
outgoing traffic to the lo interface (see line 52 in script), which concerns 
me a little bit but is probably just a property of IPv6. When sniffing 
loopback traffic, I can see that the IPv6 traffic to Tor's TransPort has my 
primary network interface's (eth0) global IP address (2a02:...) as it's 
desination address.

In torrc I added:

	VirtualAddrNetworkIPv4 10.192.0.0/10
	VirtualAddrNetworkIPv6 1337::/16
	AutomapHostsonResolve 1
	TransPort 9040
	TransPort [::1]:9040
	DNSPort 53
	DNSPort [::1]:53

Can someone please take a look at the script and look for weaknesses or come 
up with possible improvements? I am wondering if there are any risks with 
allowing output to the lo interface and if "1337::/16" is a bad idea for  
VirtualAddrNetworkIPv6.

Thank you!