Arch Linux

walterjwhite

Member

Registered: 2011-05-01

Posts: 207

iptables + tor + polipo / How to configure iptables?

Hi all,

I have iptables configured properly to only allow access remotely to SSH while blocking all other access on a desktop computer.

My question is, how can I automatically rewrite requests to the web to go through my proxy locally first?

#!/bin/bash

SSH_PORT=22

iptables -F -t filter
iptables -F -t nat
iptables -F -t mangle

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport $SSH_PORT -j ACCEPT

#    This is for CUPS
#-A INPUT -p tcp -m tcp --dport631 -j ACCEPT

#    allow me to talk to myself
iptables -A INPUT -p all -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# automatically forward traffic from port 80 to polipo and then finally tor
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner polipo -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8123

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

exit 0

When I try this, it appears the packets are getting dropped by the input filter.

Any ideas?  I am running the proxy locally.  When I go through the proxy directly (via configuring a proxy through the browser or as a command-line option, it works fine with the firewall turned off).

Thanks,

Walter

semeion

Member

From: Brazil

Registered: 2008-10-20

Posts: 75

Re: iptables + tor + polipo / How to configure iptables?

Check this config:
http://www.torservers.net/wiki/setup/allowonlytor

walterjwhite

Member

Registered: 2011-05-01

Posts: 207

Re: iptables + tor + polipo / How to configure iptables?

Thanks, that was a good reference.  I modified it to use my tor and polipo ports (8123 and 9050), but other than that it looks good.

Thanks,

Walter