Arch Linux

ParanoidAndroid

Member

Registered: 2012-10-14

Posts: 114

iptables, privoxy, polipo & tor.. major headache.

Hello all

I've made another post about this, but it got me nowhere. So I thought I'd repost with a better description of my problem.

I'm trying to set up a method whereby I can connect to privoxy from firefox, which is in turn connected to polipo, which in turn is connected through tor, and then have all the rest of my traffic routed through port 9040 (tor's TransPort). So:

browser {pointed at privoxy} > privoxy > polipo > tor
{all traffic not passed through privoxy} > 127.0.0.1:9040

here is my iptables config:

# Generated by iptables-save v2.4.15 on Fri Oct 12 16:33:33 2012
*nat
:PREROUTING ACCEPT [12:3420]
:INPUT ACCEPT [1:261]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner polipo -m owner ! --uid-owner privoxy -j ACCEPT
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner tor -m owner ! --uid-owner polipo -m owner !-j REDIRECT --to-ports 9040

#-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner tor -j REDIRECT --to-ports 9040

COMMIT
# Completed on Fri Oct 12 16:33:33 2012
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*filter
:INPUT DROP [9:1175]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [8:488]

# general
-A OUTPUT -p tcp -m owner --uid-owner tor -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# allow loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -p all -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# allow NTPD time syncs
-A OUTPUT -p udp --dport 123 -j ACCEPT

# allow tor
-A OUTPUT -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp --dport 8123 -j ACCEPT
-A OUTPUT -p tcp --dport 8118 -j ACCEPT

# allow pings
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

COMMIT
# Completed on Fri Oct 12 16:33:33 2012

With this configuration, my traffic is blocked by iptables when connected to privoxy and when not connected to privoxy.

here is the output of iptables -nvL:

Chain INPUT (policy DROP 58 packets, 13301 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1153  590K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   55  3617 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       127.0.0.1            127.0.0.1           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 523 packets, 31380 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  525  146K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 43
  528  103K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   55  3617 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:123
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9040
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8123
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8118
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8

does anyone see something I don't?

Last edited by ParanoidAndroid (2013-03-12 06:08:08)

WonderWoofy

Member

From: Los Gatos, CA

Registered: 2012-05-19

Posts: 8,414

Re: iptables, privoxy, polipo & tor.. major headache.

Just an FYI, there is nothing that makes me not want to read a page more than the inclusion of things like "help" in the title.

I guess at least you didn't use all capitals or put "critical" in there...

ParanoidAndroid

Member

Registered: 2012-10-14

Posts: 114

Re: iptables, privoxy, polipo & tor.. major headache.

duly noted. I appreciate your feedback, but most unfortunately, your constructive criticism does not answer my initial question.

[EDIT]
for the sake of simplicity, I grouped privoxy and polipo under gid "proxy" and tried to use iptables to redirect all but that traffic to port 9040. It still won't work. Here's my iptables config:

# Generated by iptables-save v2.4.15 on Fri Oct 12 16:33:33 2012
*nat
:PREROUTING ACCEPT [12:3420]
:INPUT ACCEPT [1:261]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A OUTPUT -p tcp -m tcp -m owner ! --gid-owner proxy -j ACCEPT
-A OUTPUT -p tcp -m tcp -m owner ! --uid-owner tor -m owner ! --gid-owner proxy -j REDIRECT --to-ports 9040

COMMIT
# Completed on Fri Oct 12 16:33:33 2012
# Generated by iptables-save v1.4.15 on Fri Oct 12 16:33:33 2012
*filter
:INPUT DROP [9:1175]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [8:488]

# general
-A OUTPUT -p tcp -m owner --uid-owner tor -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
#-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# allow loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -p all -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# allow NTPD time syncs
-A OUTPUT -p udp --dport 123 -j ACCEPT

# allow tor
-A OUTPUT -p tcp --dport 9040 -j ACCEPT
-A OUTPUT -p tcp --dport 9050 -j ACCEPT
-A OUTPUT -p tcp --dport 8118 -j ACCEPT
-A OUTPUT -p tcp --dport 8123 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT

# allow pings
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

COMMIT
# Completed on Fri Oct 12 16:33:33 2012

I've tried every combination of rules I can imagine, and nothing I do seems to redirect traffic properly. At the moment, traffic can get through my proxies but it also gets redirected to 9040, which causes tor to deny it.

Last edited by ParanoidAndroid (2013-03-14 07:20:07)