I am trying to create a Tor Router with a Raspberry Pi 4, the newest raspbian version, the inbuild Wlan0-Card for the Access-Point and a external Edimax Usb Wlan1-Card to get a internet connection.

I am successfull in creating the Access-Point i can connect to it with my "Galaxy S9" and i can surf in the Internet with my real ip Address.

But i can not get the tor part to work because, as soon as i start tor and add the iptables for tor i have no internet connection anymore on my "Galaxy S9".

Here are my steps which i did:


separated wpa_supplicant configurations by interface

$ cd /etc/wpa_supplicant $ sudo cp wpa_supplicant.conf wpa_supplicant-wlan0.conf $ sudo cp wpa_supplicant.conf wpa_supplicant-wlan1.conf

added my wifi ssid and pass


network={ ssid="MYSSID" psk="MYPlainTextPassword" }

installed hostapd and dnsmasq

$ sudo apt-get install hostapd dnsmasq

edited "/etc/dhcpcd.conf"

interface wlan0 static ip_address=

edited "/etc/dnsmasq.conf"

interface=wlan0 no-dhcp-interface=wlan1 dhcp-range=,,24h dhcp-option=option:dns-server,

edited "/etc/hostapd/hostapd.conf"

interface=wlan0 ssid=TorWifi channel=9 auth_algs=1 wpa=2 wpa_passphrase=TorWifi123 wpa_key_mgmt=WPA-PSK wpa_pairwise=TKIP CCMP wpa_group_rekey=86400

edited "/etc/default/hostapd"


edited "/etc/sysctl.conf"


added iptables to test the Access-Point

$ sudo iptables -t nat -A POSTROUTING -o wlan1 -j MASQUERADE $ sudo iptables -A FORWARD -i wlan1 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A FORWARD -i wlan0 -o wlan1 -j ACCEPT

Access-Point Successfully created and working

$ sudo systemctl start dnsmasq $ sudo systemctl start hostapd



installed tor

$ sudo apt-get install tor

edited "/etc/tor/torrc"

# Transparent proxy port
TransPort 9040
# Explicit SOCKS port for applications.
SocksPort 9050
# Have Tor run in the background
RunAsDaemon 1
# Only ever run as a client. Do not run as a relay or an exit.
# Ensure resolution of .onion and .exit domains happen through Tor.
AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
# Serve DNS responses
DNSPort 53

added iptables

$ sudo iptables -F $ sudo iptables -t nat -F $ sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 22 -j REDIRECT --to-ports 22 $ sudo iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT --to-ports 53 $ sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --syn -j REDIRECT --to-ports 9040