4

I've got some problems with a simple TOR project I'm actually working on.

My goal is to have TOR running on my Pi, so I can browse the web anonymously from another computer (on the same ethernet LAN) configured with the Pi as a proxy. Basically, that's an "Onion Pi" without the wireless part.

I'm running Raspbian on a 512 MB model B, with eth0 configured with '192.168.1.115'. Here is a step-by-step guide to what I've done...

First, I installed TOR:

  sudo apt-get install tor

Then I edited the TOR config file "/etc/tor/torrc" with the following lines:

 Log notice file /var/log/tor/notices.log
 VirtualAddrNetwork 10.192.0.0/10
 AutomapHostsOnResolve 1
 TransPort 9040
 TransListenAddress 192.168.1.115
 DNSPort 53
 DNSListenAddress 192.168.1.115

I flushed my NAT table:

 sudo iptables -F
 sudo iptables -t nat -F

Redirected the incoming DNS traffic:

 sudo iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j REDIRECT --to-ports 53

And incoming TCP traffic:

 sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --syn -j REDIRECT --to-ports 9040

Finally, I restarted the TOR service:

 sudo service tor restart

And checked that everything is alright in the logs:

 /var/log/tor/notices.log

Last thing I did was to configure a FireFox browser on another computer with my Pi as proxy:

Manual proxy configuration: HTTP proxy: 192.168.1.115 Port: 9040 SSL proxy: 192.168.1.115 Port: 9040 FTP proxy: 192.168.1.115 Port: 9040 SOCKS proxy: 192.168.1.115 Port: 9040

When I try to access the Web from this browser, I get a "proxy server is refusing connections" error...

Is anyone here has tried something similar? Could you please help me with this problem?

It's just a test, I do it for fun. I know there are many more precautions to be anonymous on the Web...

  • 1
    Welcome the Pi Q&A. You need not thank in the question. When somebody answers you can upvote the answer and accept it. Please read the FAQ to understand the format of this website better. I hope you find your answer soon. – Piotr Kula Sep 5 '13 at 13:46
  • Does your router have any restrictions in how devices are allowed to talk to each other? Not all networks allow for open device to device communication. – Jacobm001 Sep 5 '13 at 15:37
  • No, no restrictions at all. I can access the Raspberry without problem through other protocols (FTP, VNC, XDMCP, ...). – Cedryc Sep 9 '13 at 10:32
1

Can I ask why you don't connect directly to the SOCKS proxy port provided by Tor? I'm not clear on all the other options, but I have a very happy Raspberry Pi relay to which I connect across my LAN with all sorts of different clients (caveat - haven't checked about DNS leakage):

SocksPort 9050 
SocksListenAddress 127.0.0.1 
SocksListenAddress 192.168.1.17

SocksPolicy accept 192.168.1.1/24
SocksPolicy reject *

So, I can just connect to 192.168.1.17:9050 on my LAN with any SOCKS-capable application.

Also, some Raspberry Pi specific-ish bits:

DisableAllSwap 1        # not on flash storage, thanks
AvoidDiskWrites 1       # same deal, disable if running on a real drive.. maybe
NumCPUs 1               # might as well avoid unlikely misdetections...

KeepalivePeriod 85      # in my experience a lot of consumer routers are crap

# Try to reduce memory use by circuits?
CircuitIdleTimeout 900
CloseHSClientCircuitsImmediatelyOnTimeout 1   # tor-relays suggested 'circuit
                                              # creation storms' happen when you
                                              # become introducer for popular HS
CloseHSServiceRendCircuitsImmediatelyOnTimeout 1
MaxClientCircuitsPending 16
MaxMemInCellQueues 500MB       # should be lower. http://v.gd/P3o4sU

Edit: there's also a beta Tor StackExchange up now - not sure if it's open beta or what, but you might try it out. https://tor.stackexchange.com/

  • PS, I know this potentially allows an attacker on my LAN to reveal my identity as that SOCKS port is wide open on my LAN. This is okay for me, but it's maybe less okay for people with stronger security needs, for coffee shops that want to offer Tor, etc. Here's a nice link: tor.stackexchange.com/questions/95/… – Gordon Morehouse Sep 29 '13 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.