2

How to make Raspberry Pi a Tor router with all kind of network setup using systemd-networkd

I have looked for a way to connect to the Tor network transparently using systemd-networkd. I want just to connect to a Raspberry Pi by wifi or wired and get into the internet through the Tor network. I have found several questions but all without an answer except to Use Rapsberry Pi as Tor relay with desktop computer. But it seems a bit outdated and referenced only to a specific network setup.

Is there a way to use systemd-networkd to make a transparent proxy (Tor router) to the Tor network independent from the underlaying network setup?

2

The setup of a Tor proxy does not depend on the underlying network configuration. The proxy only needs an interface that can be used to send data to the Tor network, and an internet connection. So you can use any tutorial to setup the network, as long as that results in stable and error-free network connections. For systemd-networkd you should be able to use one of the following setups:

Following one of the above, setup your network, and ensure it's stable. For this example I will use the wlan repeater with on-board wifi as shown in the first link above as I think it is the most frequently used. In this example, the access point will be assigned a static ip address: 192.168.4.1.

Once you have a stable network, then install the Tor daemon. It comes with complete systemd services.

rpi ~$ sudo -Es
rpi ~# apt install tor
rpi ~# systemctl stop tor.service

Setup configuration: set TransPort and DNSPort to the ip address of the interface that Tor should serve as proxy. Don't touch the port after :.

rpi ~# [[ -f /etc/tor/torrc.orig ]] || mv /etc/tor/torrc /etc/tor/torrc.orig
rpi ~# cat > /etc/tor/torrc <<EOF
VirtualAddrNetworkIPv4 10.192.0.0/10
VirtualAddrNetworkIPv6 [FC00::]/7
AutomapHostsOnResolve 1
TransPort 192.168.4.1:9040
DNSPort 192.168.4.1:53

## endpoint selection
## uncomment and edit next lines if you want your exit nodes only in
## specific countries
#StrictNodes 1
#ExitNodes {de},{uk},{us}
EOF

Now configure the transparent proxy with iptables rules. We add this so that the Tor service will be started and stopped with iptables. Edit the service with:

rpi ~# systemctl edit tor@default.service

Into the empty editor insert these statements, save them and quit the editor. Have attention to the - sign after the equal sign on some statements :

[Service]
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i ap0 -p tcp --dport 22 -j REDIRECT --to-ports 22
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i ap0 -p udp --dport 53 -j REDIRECT --to-ports 53
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i ap0 -p tcp --syn -j REDIRECT --to-ports 9040

ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i ap0 -p tcp --dport 22 -j REDIRECT --to-ports 22
ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i ap0 -p udp --dport 53 -j REDIRECT --to-ports 53
ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i ap0 -p tcp --syn -j REDIRECT --to-ports 9040

Finish the setup and start the tor proxy with:

rpi ~# systemctl daemon-reload
rpi ~# exit
rpi ~$ sudo systemctl start tor.service

For testing your tor proxy you can connect with a mobile phone to your access point. Use an internet browser to connect to this site:

https://check.torproject.org


References:
[1] Change Your Raspberry Pi Into A TOR Router

  • Pls review my edits to ensure I've not inadvertently changed your meaning. – Seamus Dec 28 '18 at 7:18
  • @Seamus Thank you for review. Everything is ok (I wanted to distinguish between tor daemon and Tor network but that really doesn't matter). – Ingo Dec 28 '18 at 12:51
  • Tor vs tor... yeah - I agree, but I may have gotten that wrong. Any questions, let's chat about it. Great post BTW! – Seamus Dec 28 '18 at 13:52
1

I am working on a script linux-router that supports creating transparent Tor network.

First run Tor on your Pi with TransPort and DNSPort set in torrc. Then run

# lnxrouter --ap wlan0 <SSID> --password <password> --tp 9040 --dns 9053

(as described here)

That command creates Wifi AP and redirects clients' Internet traffic to Tor.

  • It doesn't really answer the question which asked for using systemd-networkd. – Ingo Jan 14 at 21:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.