You are not logged in.
I'm attempting to route all TCP traffic that does not go through polipo through port 9040, tor's default TransPort. My web browser uses polipo to cache stuff, so I'd like to keep it in place if possible. However, all non-http traffic needs to be sent through the transPort. My current config, which does not take into account rerouting, is below:
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
#*nat
#:PREROUTING ACCEPT [12:3420]
#:INPUT ACCEPT [1:261]
#:OUTPUT ACCEPT [0:0]
#:POSTROUTING ACCEPT [0:0]
#-A OUTPUT ! -p tcp -m owner --owner-uid tor -j REDIRECT --to-ports 9040
#-A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 9053
#COMMIT
# Completed on Fri Oct 12 16:33:33 2012
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*filter
:INPUT DROP [9:1175]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [8:488]
# allow loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# allow NTPD time syncs
-A OUTPUT -p udp --dport 123 -j ACCEPT
# allow tor
-A OUTPUT -j ACCEPT -m owner --uid-owner tor
-A OUTPUT -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
# allow BitTorrent
-A OUTPUT -p tcp --dport 6969 -j ACCEPT
-A OUTPUT -p tcp --dport 51413 -j ACCEPT
-A OUTPUT -p udp --dport 51413 -j ACCEPT
# allow pings (still not working. fix?)
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
# allow traffic on established connections
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
COMMIT
# Completed on Fri Oct 12 16:33:33 2012as you can see, I've already tried to redirect traffic using the --uid-owner polipo rule. So far, it's just caused iptables to spit out errors. I'm stumped, so I thought I'd come to you wonderful people at the Archlinux forums for help.
Offline
As far as I know, that is not possible. You need to route traffic using SOCKS5 or torify. What I have seen is people using iptables to block all non-tor traffic. Now that is very possible, yes.
"open source is about choice"
No.
Open source is about opening the source code complying with this conditions, period. The ability to choose among several packages is just a nice side effect.
Offline
I used to have a setup that forced all TCP traffic through 9040 using iptables as per the tor website's instructions. I know how to set that part up. What I'm wondering is how to exempt polipo-generated traffic from being redirected, as it already goes through the tor network by way of port 9050.
I've been fiddling with the iptables rules, and I now have this:
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*nat
:PREROUTING ACCEPT [12:3420]
:INPUT ACCEPT [1:261]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner polipo -j REDIRECT --to-ports 9040
#-A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 9053
COMMIT
# Completed on Fri Oct 12 16:33:33 2012
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*filter
:INPUT DROP [9:1175]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [8:488]
# allow loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# allow NTPD time syncs
-A OUTPUT -p udp --dport 123 -j ACCEPT
# allow tor
-A OUTPUT -j ACCEPT -m owner --uid-owner tor
-A OUTPUT -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -p tcp --dport 9050 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
# allow BitTorrent
-A OUTPUT -p tcp --dport 6969 -j ACCEPT
-A OUTPUT -p tcp --dport 51413 -j ACCEPT
-A OUTPUT -p udp --dport 51413 -j ACCEPT
# allow pings (still not working. fix?)
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
# allow traffic on established connections
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
COMMIT
# Completed on Fri Oct 12 16:33:33 2012Now any traffic going through polipo isn't going anywhere, my browser reports 'connection reset'.
Last edited by ParanoidAndroid (2013-02-28 20:10:33)
Offline
ohh, I apologize, I didn't knew that.
Ok, let me see if I understood your configuration.
Your redirection is done with:
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner polipo -j REDIRECT --to-ports 9040However, is working too good, so to speak, because is redirecting all traffic, including traffic originated from user polipo.
Am I right?
If thats right, then I would do some tests. I would try something simple like this to check
sudo -u polipo ping 8.8.8.8Does that fail?
"open source is about choice"
No.
Open source is about opening the source code complying with this conditions, period. The ability to choose among several packages is just a nice side effect.
Offline
No, that command works fine. Frankly I'm flummoxed.
I could do without use of polipo, provided I could find some alternate way to cache http/https traffic, to compensate for tor's slowness. I already implement DNS caching with dnsmasq, but it would be nice to be able to cache web traffic, for speed reasons.
Last edited by ParanoidAndroid (2013-03-01 02:53:10)
Offline
No, that command works fine. Frankly I'm flummoxed.
If that command works fine, then, well, it seems the services you think are executed by polipo user, are not really being executed by polipo.
Execute the process which should belong to polipo and then do
ps -ae -O fuser,fgroupto check what user and group actually owns them.
"open source is about choice"
No.
Open source is about opening the source code complying with this conditions, period. The ability to choose among several packages is just a nice side effect.
Offline
Using the command you gave me, I found that the polipo user is indeed executing /usr/bin/polipo. Other than that, polipo is executing no processes.
I tried adding the following to my iptables rules nat section:
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner polipo -j ACCEPT
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner polipo -j REDIRECT --to-ports 9040polipo now works, but the rest of my traffic that should go to the TransPort gets blocked.
[EDIT]
I'm now trying the same thing, except that I've chained privoxy with polipo like so:
browser > privoxy > polipo > tor > internet
my iptables rules look like this:
# Generated by iptables-save v2.4.15 on Fri Oct 12 16:33:33 2012
*nat
:PREROUTING ACCEPT [12:3420]
:INPUT ACCEPT [1:261]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
#-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner tor -j REDIRECT --to-ports 9040
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner tor -m owner ! --uid-owner polipo -m owner ! --uid-owner privoxy -j REDIRECT --to-ports 9040
COMMIT
# Completed on Fri Oct 12 16:33:33 2012
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*filter
:INPUT DROP [9:1175]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [8:488]
# general
-A OUTPUT -p tcp -m owner --uid-owner tor -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# allow loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -p all -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
# allow NTPD time syncs
-A OUTPUT -p udp --dport 123 -j ACCEPT
# allow tor
-A OUTPUT -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp --dport 8123 -j ACCEPT
-A OUTPUT -p tcp --dport 8118 -j ACCEPT
# allow pings
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
COMMIT
# Completed on Fri Oct 12 16:33:33 2012and it STILL won't route traffic right. iptables redirects to the TransPort, but any traffic passed through polipo or privoxy reveals "connection reset" error message. Help?
Last edited by ParanoidAndroid (2013-03-12 01:50:51)
Offline