Arrvee
Level 1 (0 points)

Q: create Tor anonymising middlebox osx

Hello,

 

i would like to create an tor anonymising middlebox (mac mini running mavericks and internet-sharing enabled). I don't know if this is the correct way to do it, so i hope you guys can give me some helpfull advise here. The goal is to redirect all external traffic trhough tor. Even https, imap and other connection types not just http request on port 80. This should be done for every device on the network (even ios devices), without to configure them sepreately. thats why i'm using the transparent proxy setup later on.

 

here is what i did:

 

i installed tor with brew and configured it with the following options

 

NATDPort 9040

NATDListenAddress 127.0.0.1

 

DNSPort 9053

DNSListenAddress 127.0.0.1

 

im using NATDPort because i could not get the TransPort Option to work. Tor tells me that Transport and TransListenAddress is not available in my Build. I have no idea how to compile tor on osx and getting these two options to work. The tor manual says that NATDPort is for systems that could not use Transport.

 

To redirect all external traffic through tor i use the following pf anchor. I found it on the tor wiki. It required to create a second loopback device, which i could not do either, so i tried to use the bridge100 device which was created by the internet-sharing option on Mavericks instead.

 

# destinations you don't want routed through Tor

non_tor = "{ 192.168.1.0/24 192.168.2.0/24 }"

 

# Tor's TransPort

trans_port = "9040"

 

#dns

rdr pass on bridge100 inet proto udp to 192.168.2.1 port domain -> 127.0.0.1 port 54

 

#http

rdr pass on bridge100 inet proto udp to 192.168.2.1 port http -> 127.0.0.1 port 3131

 

rdr pass on bridge100 inet proto tcp all -> 127.0.0.1 port $trans_port

#rdr pass on bridge100 inet proto udp to port domain -> 127.0.0.1 port domain

 

block return out

 

pass out quick on lo0 route-to bridge100 inet proto tcp to 127.192.0.0/10 flags S/SA modulate state

pass quick on { lo0 bridge100 } keep state

 

# uncomment the following line if you need to be able to connect to this system

# from elsewhere on your $non_tor subnet

#pass in proto tcp from $non_tor to $non_tor port { 22, 25, 80, 110 } flags S/SA keep state

pass in proto tcp from $non_tor to $non_tor flags S/SA keep state

 

pass out quick inet proto tcp user rene flags S/SA modulate state

pass out quick route-to bridge100 inet proto udp to port domain keep state

pass out quick inet to $non_tor keep state

pass out route-to bridge100 inet proto tcp all flags S/SA modulate state

 

i'm using pdnsd to cache dns queries, thats why im redirecting all port 53 requests to the localhost on port 54. Also i redirect port 80 requests to my transparent privoxy proxy on port 3131 of localhost. privoxy uses polipo to access tor at 127.0.0.1 port 9050 again. This is against unwanted cookies and trackers.

 

i'm not familiar with pf. The rules get loaded, properly, and i can see that there are requests sent to 127.0.0.1 port 9040. the dns queries do work, i can resolve hostnames through tor, but somehow i cannot establish any connection with that pf-anchor in combination with the NATDPort setting of tor. When i try to surf the web (just http not even https) i get a white page with just a body tag and no content.

 

i know this can be done with linux, but i don't want to change the os just for that.

 

I hope that anyone is able to help me here, until then i have to use the only-redirect-port-80 option

 

Happy Holidays and a Happy new Year!

Posted on Dec 31, 2013 7:46 AM

Close
Arrvee

Q: create Tor anonymising middlebox osx

  • All replies
  • Helpful answers

  • by OregonRebel,

    OregonRebel OregonRebel Jul 9, 2016 2:38 PM in response to Arrvee
    Level 1 (37 points)
    Mac OS X
    Jul 9, 2016 2:38 PM in response to Arrvee

        Hey Arrvee,

     

    Are you still using pdnsd? Are you also using DNSCrypt?

     

    I've been using DNSCrypt for a month or so and have been trying to set up pdnsd.

    I haven't found any complete setup instructions online for pdnsd and virtually nothing for using it on Mac.

     

    I entered sudo lsof -i -P | grep -i "listen" and it shows that pdnsd is listening on port 53.

     

    I ran some commands from here that were supposed to make pdnsd launch on boot.

    The last command, sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.pdnsd.plist, throws this error: /Library/LaunchDaemons/homebrew.mxcl.pdnsd.plist: Invalid property list.

     

    After reboot pdnsd isn't running.

  • by OregonRebel,

    OregonRebel OregonRebel Jul 9, 2016 4:20 PM in response to OregonRebel
    Level 1 (37 points)
    Mac OS X
    Jul 9, 2016 4:20 PM in response to OregonRebel

    I really don't know what's supposed to be in the pdnsd.conf file. I pasted some text from here and changed the server port to 54.

    Example: configuration for pdnsd

    Install pdnsd. A basic configuration to work with DNSCrypt is:

    /etc/pdnsd.conf
    global { perm_cache = 1024; cache_dir = "/var/cache/pdnsd"; run_as = "pdnsd"; server_ip = 127.0.0.1; status_ctl = on; query_method = udp_tcp; min_ttl = 15m;       # Retain cached entries at least 15 minutes. max_ttl = 1w;        # One week. timeout = 10;        # Global timeout option (10 seconds). neg_domain_pol = on; udpbufsize = 1024;   # Upper limit on the size of UDP messages. }  server { label = "dnscrypt-proxy"; ip = 127.0.0.1; port = 40; timeout = 4; proxy_only = on; }  source { owner = localhost; file = "/etc/hosts"; }

    Restart pdnsd.service to apply the changes.

     

    Now DNSCrypt no longer works - it's always on standby. But it does show the two DNS servers I've chosen as its current resolvers.

    And apparently homebrew.mxcl.pdnsd.plist also contains the wrong data.

    When I delete the DNS servers in System Prefs, the capture portal replaces them with 10.128.128.128.

    I don't want to use their servers but DNSCrypt is no longer functional.

  • by etresoft,

    etresoft etresoft Jul 9, 2016 6:18 PM in response to OregonRebel
    Level 7 (29,046 points)
    Jul 9, 2016 6:18 PM in response to OregonRebel

    Hello OregonRebel,

    This thread is over 2 years old. The new forum software needs to show the date better.

     

    In any event, this seems like a lot of work. It sounds like it would be much easier to just find a government facility that provides some kind of public guest WiFi access and do your computing from there. Tor has been outed as a government honeypot for some time now.

  • by OregonRebel,

    OregonRebel OregonRebel Jul 9, 2016 6:38 PM in response to etresoft
    Level 1 (37 points)
    Mac OS X
    Jul 9, 2016 6:38 PM in response to etresoft

    Thanks Etresoft, I ran your app again just yesterday.

    I'm aware the thread is old, but if thee poster is still registered they should receive the messages.

     

    This has nothing to do with using Tor, that's separate and for different uses than DNS encryption.

    I'm trying to prevent redirects, cache poisoning and ISP snooping.

     

    It's has been a lot of work, still not finished yet but getting closer.

     

    Started with DNSCrypt, then read that it is recommended to have a local DNS cache so that every query isn't sent out to the server again, which should reduce load times.

  • by OregonRebel,

    OregonRebel OregonRebel Jul 9, 2016 6:33 PM in response to OregonRebel
    Level 1 (37 points)
    Mac OS X
    Jul 9, 2016 6:33 PM in response to OregonRebel

  • by OregonRebel,

    OregonRebel OregonRebel Jul 9, 2016 7:18 PM in response to OregonRebel
    Level 1 (37 points)
    Mac OS X
    Jul 9, 2016 7:18 PM in response to OregonRebel

  • by etresoft,

    etresoft etresoft Jul 10, 2016 6:22 PM in response to OregonRebel
    Level 7 (29,046 points)
    Jul 10, 2016 6:22 PM in response to OregonRebel

    Hello again OregonRebel,

    If you have a specific question about DNSCrypt, or about some other issue that led you to that software, it would be best to start your own question. Piggy-backing on an old thread is an excellent way to get your question ignored.

  • by OregonRebel,

    OregonRebel OregonRebel Jul 10, 2016 7:06 PM in response to etresoft
    Level 1 (37 points)
    Mac OS X
    Jul 10, 2016 7:06 PM in response to etresoft

    Got your attention didn't I?

     

    I posted here because it was the only discussion listed when I searched for pdnsd.

    I'm not gonna start a new post here for something that very few people use and even fewer Mac users use.

    I could piggyback on an old DNSCrypt thread but my question isn't about DNSCrypt.

    Arrvee stated that he (presumably) was using pdnsd, thus he would be an appropriate person to ask.

     

    While I appreciate the use of your software, your responses have been unhelpful and annoying.

    You seemed to imply that I was attempting to hide my illicit online activity when in fact my question had nothing whatsoever to do with Tor. 

     

    I won't mention how annoying that nag screen is in EtreCheck since it is a useful tool that I'm sure you spend a considerable amount of time on and you deserve to be compensated.

  • by etresoft,

    etresoft etresoft Jul 11, 2016 1:53 PM in response to OregonRebel
    Level 7 (29,046 points)
    Jul 11, 2016 1:53 PM in response to OregonRebel

    OregonRebel wrote:

     

    Got your attention didn't I?

     

    I posted here because it was the only discussion listed when I searched for pdnsd.

    I'm not gonna start a new post here for something that very few people use and even fewer Mac users use.

    I could piggyback on an old DNSCrypt thread but my question isn't about DNSCrypt.

    Arrvee stated that he (presumably) was using pdnsd, thus he would be an appropriate person to ask.

    There are people around who run some funky software. They will be happy to help. All you have to do is ask them. Arrvee hasn't posted anything in years.

     

    While I appreciate the use of your software, your responses have been unhelpful and annoying.

    You seemed to imply that I was attempting to hide my illicit online activity when in fact my question had nothing whatsoever to do with Tor. 

    My goal in responding was to try, and apparently fail, to get you to construct a better question and get a good answer. I didn't say anything about your activity. This is a thread about Tor and there are still many people who think it is something other than a government-funded project.

     

    I won't mention how annoying that nag screen is in EtreCheck since it is a useful tool that I'm sure you spend a considerable amount of time on and you deserve to be compensated.

    There are ways to disable the nag screen.

     

    But now that I re-read your question, it does seem that your problem is with constructing a valid plist file. There are lots of people who can help with that. But they won't know need help until you ask.