· 9 years ago · Apr 09, 2017, 05:36 AM
1#!/bin/bash
2
3## This file is part of Whonix.
4## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
5## See the file COPYING for copying conditions.
6
7if [[ $EUID -ne 0 ]]; then
8 echo "Permiso denegado." 1>&2
9 exit 1
10 else
11 echo -e "Permiso aceptado."
12fi
13
14cd /root
15
16mkdir /root/bk
17
18#mv /etc/apt/sources.list.d/debian.list /etc/apt/sources.list.d/debian.list.bk
19cat << EOF > /etc/apt/sources.list.d/debian.list
20
21## This file is part of Whonix.
22## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
23## See the file COPYING for copying conditions.
24
25## This is a default sources.list for Anonymity Linux Distributions,
26## which are derivatives of Debian.
27
28## If you want to see the example, which came with the upstream
29## distribution, see: /usr/share/doc/apt/examples/sources.list
30
31## Instead of directly editing this file,
32## the user is advised to create the file /etc/apt/sources.list.d/user.list.
33## This is because when this package gets updated,
34## /etc/apt/sources.list.d/debian.list will be overwritten and may receive new
35## new default values and comments. The entire folder /etc/apt/sources.list.d/
36## gets scanned for additional sources.list files by apt-get.
37## The user may keep their settings even after updating this package.
38##
39## Without graphical user interface, you can use for example:
40## sudo nano /etc/apt/sources.list.d/user.list
41## With graphical user interface (KDE), you can use for example:
42## kdesudo kwrite /etc/apt/sources.list.d/user.list
43
44deb http://security.debian.org jessie/updates main contrib non-free
45deb http://ftp.us.debian.org/debian jessie main contrib non-free
46
47#deb-src http://security.debian.org jessie/updates main contrib non-free
48#deb-src http://ftp.us.debian.org/debian jessie main contrib non-free
49
50## Technical notes:
51## - Why is jessie-updates disabled by default?
52## See: http://wiki.debian.org/StableUpdates
53## - Why are sources (deb-src) disabled by default?
54## Because those are not required by most users, to save time while
55## running "sudo apt-get update".
56## - See also: http://www.debian.org/security/
57## - See also: /etc/apt/sources.list.d/
58EOF
59
60apt-get update && apt-get upgrade -y
61sleep 4
62
63apt-get install auditd apparmor
64sleep 4
65
66apt-get install -y tor tor-arm tor-geoipdb torsocks tor-arm obfs4proxy obfsproxy macchanger
67sleep 4
68
69apt-get install -y ntp ntpdate
70sleep 4
71ntpdate-debian
72sleep 2
73hwclock --systohc
74
75#/etc/apt/sources.list.d/torproject.list
76
77# /etc/resolv.conf.anondist
78# /etc/hosts.anondist
79# /etc/hostname.anondist
80# /etc/tor/torrc.anondist
81# /usr/share/tor/tor-service-defaults-torrc.anondist
82# /etc/default/tor.anondist
83# /etc/apparmor.d/local/system_tor.anondist
84# /etc/apparmor.d/local/usr.bin.obfsproxy.anondist
85
86
87
88
89
90
91
92
93
94cat << EOF > /lib/systemd/system/tor.service
95# This service is actually a systemd target,
96# but we are using a service since targets cannot be reloaded.
97
98[Unit]
99Description=Anonymizing overlay network for TCP (multi-instance-master)
100
101[Service]
102Type=oneshot
103RemainAfterExit=yes
104ExecStart=/bin/true
105ExecReload=/bin/true
106
107[Install]
108WantedBy=multi-user.target
109EOF
110cat << EOF > /lib/systemd/system/tor@.service
111[Unit]
112Description=Anonymizing overlay network for TCP (instance %i)
113After=network.target nss-lookup.target
114PartOf=tor.service
115ReloadPropagatedFrom=tor.service
116
117[Service]
118Type=notify
119NotifyAccess=all
120PIDFile=/var/run/tor-instances/%i/tor.pid
121PermissionsStartOnly=yes
122ExecStartPre=/usr/bin/install -Z -m 02755 -o _tor-%i -g _tor-%i -d /var/run/tor-instances/%i
123ExecStartPre=/bin/sed -e 's/@@NAME@@/%i/g; w /var/run/tor-instances/%i.defaults' /usr/share/tor/tor-service-defaults-torrc-instances
124ExecStartPre=/usr/bin/tor --defaults-torrc /var/run/tor-instances/%i.defaults -f /etc/tor/instances/%i/torrc --verify-config
125ExecStart=/usr/bin/tor --defaults-torrc /var/run/tor-instances/%i.defaults -f /etc/tor/instances/%i/torrc
126ExecReload=/bin/kill -HUP \${MAINPID}
127KillSignal=SIGINT
128TimeoutStartSec=300
129TimeoutStopSec=60
130Restart=on-failure
131LimitNOFILE=65536
132
133# Hardening
134NoNewPrivileges=yes
135PrivateTmp=yes
136PrivateDevices=yes
137ProtectHome=yes
138ProtectSystem=full
139ReadOnlyDirectories=/
140# We would really like to restrict the next item to [..]/%i but we can't,
141# as systemd does not support that yet. See also #781730.
142ReadWriteDirectories=-/var/lib/tor-instances
143ReadWriteDirectories=-/var/run
144CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE
145
146[Install]
147WantedBy=multi-user.target
148EOF
149cat << EOF > /lib/systemd/system/tor@default.service
150[Unit]
151Description=Anonymizing overlay network for TCP
152After=network.target nss-lookup.target
153PartOf=tor.service
154ReloadPropagatedFrom=tor.service
155
156[Service]
157Type=notify
158NotifyAccess=all
159PIDFile=/var/run/tor/tor.pid
160PermissionsStartOnly=yes
161ExecStartPre=/usr/bin/install -Z -m 02755 -o debian-tor -g debian-tor -d /var/run/tor
162ExecStartPre=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0 --verify-config
163ExecStart=/usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0
164ExecReload=/bin/kill -HUP \${MAINPID}
165KillSignal=SIGINT
166TimeoutStartSec=300
167TimeoutStopSec=60
168Restart=on-failure
169LimitNOFILE=65536
170
171# Hardening
172AppArmorProfile=system_tor
173NoNewPrivileges=yes
174PrivateTmp=yes
175PrivateDevices=yes
176ProtectHome=yes
177ProtectSystem=full
178ReadOnlyDirectories=/
179ReadWriteDirectories=-/proc
180ReadWriteDirectories=-/var/lib/tor
181ReadWriteDirectories=-/var/log/tor
182ReadWriteDirectories=-/var/run
183CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE
184EOF
185
186chmod +x /lib/systemd/system/tor*.service
187
188
189
190
191
192
193
194
195## 01
196
197### ETC
198
199mv /etc/hostname /etc/hostname.bk
200cat << EOF > /etc/hostname
201host
202EOF
203
204mv /etc/hosts /etc/hosts.bk
205cat << EOF > /etc/hosts
206## Anonymity Distribution /etc/hosts
207
208## Defaults
209127.0.0.1 localhost
210::1 localhost ip6-localhost ip6-loopback
211fe00::0 ip6-localnet
212ff00::0 ip6-mcastprefix
213ff02::1 ip6-allnodes
214ff02::2 ip6-allrouters
215## End of defaults
216
217## Anonymity Distribution specific
218127.0.0.1 host.localdomain host
219## End of Anonymity Distribution specific
220
221## End of Anonymity Distribution /etc/hosts
222EOF
223
224### USR
225
226## 02
227mv /usr/lib/pre.bsh /usr/lib/pre.bsh.bk
228cat << EOF > /usr/lib/pre.bsh
229#!/bin/bash
230
231## 02
232
233## This file is part of Whonix.
234## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
235## See the file COPYING for copying conditions.
236
237## Error log:
238## - implement trap ERR if function errorhandlergeneral does not exist
239## - run silent by default
240## - write xtrace to temporary log
241## - show full xtrace on unexpected non-zero exit code
242## - show exit code on unexpected non-zero exit code
243## - run syntax check "bash -n" on this script
244## - run syntax check "bash -n" on the script that sourced this script
245##
246## DEBDEBUG:
247## - enable xtrace (-x) for maintainer script when DEBDEBUG environment
248## variable is set to 1
249##
250## SKIP_SCRIPTS
251## - SKIP_SCRIPTS environment variable to skip scripts by name
252##
253## Colorful output:
254## - provide color function
255##
256## Shell options:
257## - enable errtrace
258
259## {{{ pre.bsh 0.7
260
261## bash script fragment
262
263if [ ! -d "/tmp/prepost" ]; then
264 mkdir --parents --mode=g+rw "/tmp/prepost"
265fi
266
267TEMP_DIR="\$(mktemp --directory --tmpdir="/tmp/prepost")"
268
269[ -o xtrace ]
270## returns:
271## - 0, if xtrace (-x) is set
272## - 1, if xtrace (-x) is not set
273XTRACE="\$?"
274
275## config-package-dev doesn't like 'set -o pipefail'
276## http://mailman.mit.edu/pipermail/config-package-dev/2015-May/000041.html
277#set -o pipefail
278
279set -o errtrace
280
281colors() {
282 if [ "\$TERM" = "" ]; then
283 return 0
284 fi
285
286 ## Thanks to:
287 ## http://mywiki.wooledge.org/BashFAQ/037
288 ## Variables for terminal requests.
289 [[ -t 2 ]] && {
290 alt=\$( tput smcup || tput ti ) # Start alt display
291 ealt=\$( tput rmcup || tput te ) # End alt display
292 hide=\$( tput civis || tput vi ) # Hide cursor
293 show=\$( tput cnorm || tput ve ) # Show cursor
294 save=\$( tput sc ) # Save cursor
295 load=\$( tput rc ) # Load cursor
296 bold=\$( tput bold || tput md ) # Start bold
297 stout=\$( tput smso || tput so ) # Start stand-out
298 estout=\$( tput rmso || tput se ) # End stand-out
299 under=\$( tput smul || tput us ) # Start underline
300 eunder=\$( tput rmul || tput ue ) # End underline
301 reset=\$( tput sgr0 || tput me ) # Reset cursor
302 blink=\$( tput blink || tput mb ) # Start blinking
303 italic=\$( tput sitm || tput ZH ) # Start italic
304 eitalic=\$( tput ritm || tput ZR ) # End italic
305 [[ \$TERM != *-m ]] && {
306 red=\$( tput setaf 1|| tput AF 1 )
307 green=\$( tput setaf 2|| tput AF 2 )
308 yellow=\$( tput setaf 3|| tput AF 3 )
309 blue=\$( tput setaf 4|| tput AF 4 )
310 magenta=\$( tput setaf 5|| tput AF 5 )
311 cyan=\$( tput setaf 6|| tput AF 6 )
312 }
313 white=\$( tput setaf 7|| tput AF 7 )
314 default=\$( tput op )
315 eed=\$( tput ed || tput cd ) # Erase to end of display
316 eel=\$( tput el || tput ce ) # Erase to end of line
317 ebl=\$( tput el1 || tput cb ) # Erase to beginning of line
318 ewl=\$eel\$ebl # Erase whole line
319 draw=\$( tput -S <<< ' enacs
320 smacs
321 acsc
322 rmacs' || { \\
323 tput eA; tput as;
324 tput ac; tput ae; } ) # Drawing characters
325 back=\$'\\b'
326 } 2>/dev/null ||:
327}
328
329colors
330
331disable_echo() {
332 exec 5>&1 1>> "\$TEMP_DIR/output"
333 exec 6>&2 2>> "\$TEMP_DIR/output"
334}
335
336enable_echo() {
337 exec 1>&5
338 exec 2>&6
339}
340
341if [ "\$XTRACE" = "0" ]; then
342 true "INFO: Setting DEBDEBUG to 1, because xtrace (-x) is set."
343 DEBDEBUG="1"
344fi
345
346if [ "\$DEBDEBUG" = "1" ]; then
347 set -x
348else
349 disable_echo
350fi
351
352force_echo() {
353 if [ ! "\$DEBDEBUG" = "1" ]; then
354 enable_echo
355 fi
356
357 if [ ! "\$DEBDEBUG" = "1" ]; then
358 echo "\$@"
359 fi
360 ## No need to use "true" or "echo" in case DEBDEBUG is set to 1,
361 ## because in that case we saw the output anyway, because set xtrace (-x) was set.
362
363 if [ ! "\$DEBDEBUG" = "1" ]; then
364 disable_echo
365 fi
366}
367
368error_handler_pre() {
369 local exit_code="\$?"
370 local last_err="\$BASH_COMMAND"
371
372 if [ ! "\$DEBDEBUG" = "1" ]; then
373 local output
374 output="\$(cat "\$TEMP_DIR/output")"
375 fi
376
377 if [ "\$output" = "" ]; then
378 output="## See above."
379 fi
380
381 if [ ! "\$DEBDEBUG" = "1" ]; then
382 exec 1>&5
383 exec 2>&6
384 fi
385
386 force_echo "
387####################################################################
388## \${red}\${bold}BEGIN ERROR in \$0 detected!\${reset}
389##
390## \${under}ERROR LOG\${reset}:
391\$output
392##
393## \${under}BASH_COMMAND\${reset}: \$BASH_COMMAND
394## \${under}EXIT_CODE\${reset}: \$exit_code
395##
396## \${red}\${bold}END ERROR in \$0 detected!\${reset}
397## \${red}\${bold}Please report this bug!\${reset}
398####################################################################
399" 1>&2
400
401 exit 1
402}
403
404## {{ Set up error handler.
405if [ "\$(type -t errorhandlergeneral)" = "function" ]; then
406 ## Function errorhandlergeneral exists (declared in
407 ## help-steps/pre). Prefer to use the more feature rich version of the error
408 ## handler.
409 trap "errorhandlergeneral" ERR
410else
411 ## Function errorhandlergeneral does not exist.
412 ## Fall back to a simpler error handler.
413 trap "error_handler_pre" ERR
414fi
415## }}
416
417## syntax check this script
418bash -n "\$BASH_SOURCE"
419
420## syntax check script that sourced this script
421bash -n "\$0"
422
423own_filename="\${0##*/}"
424
425for skip_script in \$SKIP_SCRIPTS; do
426 if [ "\$skip_script" = "\$own_filename" ]; then
427 force_echo "INFO: Skipping \$own_filename, because SKIP_SCRIPTS includes it."
428 exit 0
429 fi
430done
431unset skip_script
432
433## }}}
434EOF
435chmod 777 /usr/lib/pre.bsh
436
437mkdir -p /usr/share/anon-dist
438cat << EOF > /usr/share/anon-dist/marker
439## This file is part of Whonix.
440## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
441## See the file COPYING for copying conditions.
442
443## This is just a marker file.
444EOF
445
446mkdir -p /usr/share/anon-gw-base-files
447cat << EOF > /usr/share/anon-gw-base-files/gateway
448## This file is part of Whonix.
449## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
450## See the file COPYING for copying conditions.
451
452## This is just a marker file.
453EOF
454
455### VAR
456
457cat << EOF > /var/lib/dbus/machine-id
458b08dfa6083e7567a1921a715000001fb
459EOF
460
461## 03
462cat << EOF > anon-base-files.postinst
463#!/bin/bash
464
465## 03
466
467## This file is part of Whonix.
468## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
469## See the file COPYING for copying conditions.
470
471if [ -f /usr/lib/pre.bsh ]; then
472 source /usr/lib/pre.bsh
473fi
474
475set -e
476
477true "
478#####################################################################
479## INFO: BEGIN: \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
480#####################################################################
481"
482
483case "\$1" in
484 configure)
485 true "INFO: Configuring \$DPKG_MAINTSCRIPT_PACKAGE..."
486
487 build_version_file="/var/lib/anon-dist/build_version"
488 if [ ! -f "\$build_version_file" ]; then
489 echo "INFO: Logging anon_dist_build_version \$anon_dist_build_version to \$build_version_file..."
490 ## Sanity test.
491 if [ "\$anon_dist_build_version" = "" ]; then
492 ## If anon_dist_build_version is empty, use the version number of the package.
493 anon_dist_build_version="\$(zless /usr/share/doc/\$DPKG_MAINTSCRIPT_PACKAGE/changelog* | dpkg-parsechangelog -l- -SVersion)" || true
494 fi
495 mkdir --parents /var/lib/anon-dist
496 ## Debugging.
497 touch "\$build_version_file"
498 ## Logging.
499 echo "\$anon_dist_build_version" > "\$build_version_file"
500 ## Debugging.
501 cat "\$build_version_file"
502 fi
503
504 true 'INFO: Working around: "sudo: unable to resolve host host"'
505 if [ -f /etc/hostname ]; then
506 my_host_name="\$(cat "/etc/hostname")" || true
507 hostname "\$my_host_name" || true
508 fi
509
510 ret="0"
511 id user || { ret="\$?" ; true; };
512
513 if [ ! "\$ret" = "0" ]; then
514 echo 'INFO: Creating user "user"...'
515 if command -v qubesdb-read >/dev/null 2>&1 ; then
516 password=""
517 else
518 ## setting password of user user to changeme
519 ##
520 ## How this password was created:
521 ## sudo apt-get install whois
522 ## mkpasswd
523 ## changeme
524 ## Resulted in: aTayYxVyw5kDo
525 password="aTayYxVyw5kDo"
526 fi
527 useradd --password "\$password" --user-group --create-home --shell /bin/bash user
528 else
529 true 'Not creating user "user", because it user already exists.'
530 fi
531
532 usermod --append --groups adm,cdrom,audio,dip,sudo,plugdev user || true
533
534 true "INFO: End configuring \$DPKG_MAINTSCRIPT_PACKAGE."
535
536 ;;
537
538 *)
539 ;;
540esac
541
542true "INFO: debhelper beginning here."
543
544#DEBHELPER#
545
546true "INFO: Done with debhelper."
547
548true "
549#####################################################################
550## INFO: END : \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
551#####################################################################
552"
553
554## Explicitly "exit 0", so eventually trapped errors can be ignored.
555exit 0
556EOF
557chmod 755 anon-base-files.postinst
558./anon-base-files.postinst configure
559
560cp /etc/systemd/network/99-default.link /root/bk/99-default.link
561sleep 2
562ln -s /dev/null /etc/systemd/network/99-default.link
563sleep 2
564#activate update-initramfs
565update-initramfs -u
566sleep 2
567
568### ETC
569
570cat << EOF > /etc/network/interfaces.d/30_non-qubes-whonix
571## This file is part of Whonix.
572## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
573## See the file COPYING for copying conditions.
574
575## for more information see interfaces(5)
576
577## Loopback interface.
578auto lo
579iface lo inet loopback
580
581## When using Virtual Machines (not Physical Isolation),
582## - eth0 is the NAT interface to communicate with VirtualBox
583## - used to get access to the internet
584## - it will get an IP address such as 10.0.2.15
585## - Thus, the this IP address can NOT cause conflicts
586## with your LAN network or router.
587## We no longer use DHCP.
588## https://phabricator.whonix.org/T559
589auto eth0
590iface eth0 inet dhcp
591
592## Or alternatively we could use...
593## (Out commented by default.)
594## NAT interface to communicate with VirtualBox.
595#auto eth0
596#iface eth0 inet static
597 #address 10.0.2.15
598 #netmask 255.255.255.0
599 #gateway 10.0.2.2
600 ## broadcast required?
601 #broadcast 10.0.2.255
602
603## When using Virtual Machines (not Physical Isolation),
604## - eth1 is an internal, isolated, virtual network,
605## - provided and only visible inside Virtual Machines
606## - solely used to communicate with the Workstation.
607## - it has has no access to the host
608## - Thus, the following IP address can NOT cause conflicts
609## with your LAN network or router.
610auto eth1
611iface eth1 inet static
612 ## INT_IP and INT_IF
613 address 10.152.152.10
614 netmask 255.255.192.0
615 ## Out commented.
616 ## For what do we need network and broadcast anyway?
617 #network 192.168.0.0
618 #broadcast 192.168.0.255
619EOF
620
621mv /etc/network/interfaces /etc/network/interfaces.bk
622cat << EOF > /etc/network/interfaces
623source /etc/network/interfaces.d
624EOF
625
626## Alternative
627mv /etc/network/interfaces /etc/network/interfaces.bk2
628mv /etc/network/interfaces.d/30_non-qubes-whonix /etc/network/interfaces
629systemctl daemon-reload
630
631### LIB
632
633mkdir -p /lib/systemd/system/tor-controlport-filter.service.d
634cat << EOF > /lib/systemd/system/tor-controlport-filter.service.d/30_cpfpy.conf
635## This file is part of Whonix.
636## Copyright (C) 2012 - 2015 Patrick Schleizer <adrelanos@riseup.net>
637## See the file COPYING for copying conditions.
638
639[Service]
640## Run /usr/lib/tor-controlport-filter-merger as root to avoid permission conflicts.
641PermissionsStartOnly=true
642ExecStartPre=/usr/lib/tor-controlport-filter-merger
643
644ExecStart=
645ExecStart=/usr/lib/tor-controlport-filter --debug --listen-interface eth1
646EOF
647
648### USR
649
650mkdir -p /usr/share/whonix-gw-network-conf
651cat << EOF > /usr/share/whonix-gw-network-conf/network_internal_ip.txt
652network_internal_ip=10.152.152.10
653EOF
654
655### ETC
656
657cat << EOF > /etc/dhcp/dhclient-enter-hooks.d/nodnsupdate
658#!/bin/sh
659
660## This file is part of Whonix.
661## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
662## See the file COPYING for copying conditions.
663
664make_resolv_conf(){
665 :
666}
667EOF
668chmod 777 /etc/dhcp/dhclient-enter-hooks.d/nodnsupdate
669
670mv /etc/resolv.conf /etc/resolv.conf.bk
671cat << EOF > /etc/resolv.conf
672## This file is part of Whonix.
673## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
674## See the file COPYING for copying conditions.
675
676## /etc/dhcp/dhclient-enter-hooks.d/nodnsupdate (package anon-gw-dhcp-conf) can
677## prevent this file from getting overwritten by DHCP.
678## If you want to disable that, run.
679## sudo apt-get purge anon-gateway-dhcp-conf
680
681## Torified DNS server for Gateway's own traffic.
682nameserver 127.0.0.1
683
684## Advanced users only!
685## Only if you know what you are doing!
686## If you do *not* want Gateway's own DNS
687## (This has nothing to do with Workstation's DNS.)
688## to be routed through Tor, but using clearnet DNS,
689## use the VirtualBox DHCP server below
690## and comment out the torified DNS server above.
691#nameserver 10.0.2.3
692
693## Others
694nameserver 213.73.91.35
695nameserver 87.118.100.175
696EOF
697cp /etc/resolv.conf /etc/resolv.conf.anondist
698
699### LIB
700
701mkdir -p /lib/systemd/system/systemd-resolved.service.d
702cat << EOF > /lib/systemd/system/systemd-resolved.service.d/40_anon-dns-conf.conf
703## This file is part of Whonix.
704## Copyright (C) 2016 - 2016 Patrick Schleizer <adrelanos@riseup.net>
705## See the file COPYING for copying conditions.
706
707[Unit]
708ConditionPathExists=!/etc/resolv.conf.anondist
709EOF
710
711## 04
712cat << EOF > whonix-gw-firewall.postinst
713#!/bin/bash
714
715## 04
716
717## This file is part of Whonix.
718## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
719## See the file COPYING for copying conditions.
720
721if [ -f /usr/lib/pre.bsh ]; then
722 source /usr/lib/pre.bsh
723fi
724
725set -e
726
727true "
728#####################################################################
729## INFO: BEGIN: \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
730#####################################################################
731"
732
733case "\$1" in
734 configure)
735 true "INFO: Configuring \$DPKG_MAINTSCRIPT_PACKAGE..."
736
737 ## Create user sdwdate and whonxicheck so we do not have to depend on these packages.
738 adduser --home /nonexistent --quiet --system --group whonixcheck || true
739 adduser --home /nonexistent --quiet --system --group sdwdate || true
740
741 user_account_list="clearnet tunnel user"
742
743 for user_account in \$user_account_list ; do
744 ret="0"
745 id "\$user_account" || { ret="\$?" ; true; };
746
747 if [ "\$ret" = "0" ]; then
748 echo "INFO: Not creating user '\$user_account', because it already exists."
749 else
750 echo "INFO: Creating user '\$user_account'..."
751 if command -v qubesdb-read >/dev/null 2>&1 ; then
752 password=""
753 else
754 ## setting password of user \$user_account to changeme
755 ##
756 ## How this password was created:
757 ## sudo apt-get install whois
758 ## mkpasswd
759 ## changeme
760 ## Resulted in: aTayYxVyw5kDo
761 password="aTayYxVyw5kDo"
762 fi
763 useradd --create-home --password "\$password" --user-group --shell /bin/bash "\$user_account"
764 fi
765 done
766
767 true "INFO: End configuring \$DPKG_MAINTSCRIPT_PACKAGE."
768
769 ;;
770
771 *)
772 ;;
773esac
774
775true "INFO: debhelper beginning here."
776
777#DEBHELPER#
778
779true "INFO: Done with debhelper."
780
781true "
782#####################################################################
783## INFO: END : \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
784#####################################################################
785"
786
787## Explicitly "exit 0", so eventually trapped errors can be ignored.
788exit 0
789EOF
790chmod 755 whonix-gw-firewall.postinst
791./whonix-gw-firewall.postinst configure
792
793### ETC
794
795mkdir /etc/whonix_firewall.d
796cat << EOF > /etc/whonix_firewall.d/30_default.conf
797## This file is part of Whonix.
798## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
799## See the file COPYING for copying conditions.
800
801## Whonix /etc/whonix_firewall.d/30_default.conf
802
803## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom
804## configuration, which will override the defaults found here. When Whonix is
805## updated, this file may be overwritten.
806
807##########################
808## Flash Proxy Settings ##
809##########################
810
811## Allow incoming Flash Proxy connections on the external interface.
812## This has NOTHING to do with Adobe Flash.
813GATEWAY_ALLOW_INCOMING_FLASHPROXY=0
814
815## Flash Proxy incoming port.
816FLASHPROXY_PORT=9000
817
818################################
819## Transparent Proxy Settings ##
820################################
821
822## Read first:
823## https://www.whonix.org/wiki/Stream_Isolation
824
825#########################
826## For the Workstation ##
827#########################
828
829## Enable (1) or disable (0) transparent TCP proxying for the Whonix-Workstation.
830## Any misc TCP traffic, for example /usr/bin/wget.anondist-orig (circumventing uwt wrapper)
831## or any custom installed applications on the Whonix-Workstation will be
832## automatically routed through Tor. In most cases you have to enable
833## WORKSTATION_TRANSPARENT_DNS as well.
834WORKSTATION_TRANSPARENT_TCP=1
835
836## Enable (1) or disable (0) transparent UDP proxying for the Whonix-Workstation.
837## This setting has really no effect.
838## The Tor network does not support UDP yet.
839## This is not a Whonix specific limitation.
840## There is a limited workaround for tunneling udp over Tor with Whonix:
841## https://www.whonix.org/wiki/Tunnel_UDP_over_Tor
842## Do not bother changing this setting, it will do nothing.
843WORKSTATION_TRANSPARENT_UDP=0
844
845## Enable (1) or disable (0) transparent DNS proxying for the Whonix-Workstation.
846## Any misc DNS traffic, for example nslookup, from the Whonix-Workstation will be
847## automatically routed through Tor.
848WORKSTATION_TRANSPARENT_DNS=1
849
850## Enable (1) or disable (0) access to Tor SocksPorts for the Whonix-Workstation.
851## You most likely want to leave this enabled. Otherwise most applications that
852## come with Whonix-Workstation by default will no longer function.
853## This may be useful if you are using a big number of multiple internal network
854## interfaces, but want to only use transparent proxying. Because by disabling this
855## setting, you could skip a lot iptables rules. (The more iptables rules, the slower.)
856## For a list of ports and more information on screen isolation, see:
857## https://www.whonix.org/wiki/Stream_Isolation
858WORKSTATION_ALLOW_SOCKSIFIED=1
859
860## Enable (1) or disable (0) Control Port Filter Proxy for the Whonix-Workstation.
861## It enables Whonix-Workstation to issue a limited set of safe Tor control port
862## commands such as "SIGNAL NEWNYM", which enables Tor Browsers New Identity
863## feature. Uses white listing and filters out potentially harmful commands such
864## as "GETINFO address".
865CONTROL_PORT_FILTER_PROXY_ENABLE=1
866
867########################
868## Open External Ports #
869########################
870
871## Ports you wish to open on the external network interface.
872## (TCP only)
873## (UDP would require /usr/bin/whonix_firewall modifications.)
874
875#EXTERNAL_OPEN_PORTS+=" 22 "
876#EXTERNAL_OPEN_PORTS+=" 9050 "
877
878########################
879## Tor Relay Settings ##
880########################
881
882## Allow incoming DIRPORT connections for an optional Tor relay.
883GATEWAY_ALLOW_INCOMING_DIR_PORT=0
884
885## Allow incoming ORPORT connections for an optional Tor relay.
886GATEWAY_ALLOW_INCOMING_OR_PORT=0
887
888## DIRPORT incoming port.
889DIR_PORT=80
890
891## ORPORT incoming port.
892OR_PORT=443
893
894######################################################################
895## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
896## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
897## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
898## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
899## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
900######################################################################
901
902#####################
903## For the Gateway ##
904#####################
905
906## External interface
907## defaults to:
908EXT_IF="eth0"
909## to use multiple:
910#EXT_IF="\\
911#eth0
912#eth4
913#eth5"
914
915## Internal interface
916## defaults to:
917INT_IF="eth1"
918## to use multiple:
919#INT_IF="\\
920#eth1
921#eth2
922#eth3"
923
924## Internal "tunnel" interface, usually the same as
925## the Internal interface unless using vpn tunnels
926## between workstations and gateway
927## defaults to:
928#INT_TIF="eth1"
929## to use multiple:
930#INT_TIF="\\
931#eth1
932#eth2
933#eth3"
934
935## Enable (1) or disable (0) transparent TCP proxying for the Whonix-Gateway.
936## Experts only!
937## Any misc TCP traffic, for example /usr/bin/wget.anondist-orig (circumventing uwt wrapper)
938## from the Whonix-Gateway will be automatically routed through Tor.
939## For example apt-get, wget and gpg are torified using uwt wrappers.
940## In most cases you have to enable GATEWAY_TRANSPARENT_DNS as well.
941## DISABELD BY DEFAULT, because the Whonix-Gateway should only be used as a proxy.
942## There are currently no useful use cases recognized by Whonix developer adrelanos.
943## Enable this only if you know what you are doing!
944GATEWAY_TRANSPARENT_TCP=1
945
946## Enable (1) or disable (0) transparent UDP proxying for the Whonix-Gateway.
947## This setting has really no effect.
948## The Tor network does not support UDP yet.
949## This is not a Whonix specific limitation.
950## Do not bother changing this setting, it will do nothing.
951GATEWAY_TRANSPARENT_UDP=1
952
953## Enable (1) or disable (0) transparent DNS proxying for the Whonix-Gateway.
954## Experts only!
955## Any misc DNS traffic, for example nslookup, from the Whonix-Gateway will be
956## automatically routed through Tor.
957## DISABELD BY DEFAULT, because the Whonix-Gateway should only be used as a proxy.
958## There are currently no useful use cases recognized by Whonix developer adrelanos.
959## Enable this only if you know what you are doing!
960GATEWAY_TRANSPARENT_DNS=1
961
962#####################
963## AnyBOX settings ##
964#####################
965
966## The following section may be interesting for example for an I2PBOX.
967## https://www.whonix.org/wiki/I2P#I2PBOX
968
969## Add additional linux user ids that are excluded from NAT by default.
970#NO_NAT_USERS+=" \$(id -u i2psvc)"
971
972###########################
973## VPN-Firewall Settings ##
974###########################
975
976## Make sure Tor always connects through the VPN.
977## Enable: 1
978## Disable: 0
979## DISABELD BY DEFAULT, because it requires a VPN provider.
980#VPN_FIREWALL=1
981
982## For OpenVPN.
983#VPN_INTERFACE=tun0
984
985## Destinations you don not want routed through the VPN.
986## 10.0.2.2-10.0.2.24: VirtualBox DHCP
987# LOCAL_NET="\\
988# 127.0.0.0-127.0.0.24 \\
989# 192.168.0.0-192.168.0.24 \\
990# 192.168.1.0-192.168.1.24 \\
991# 10.152.152.0-10.152.152.24 \\
992# 10.0.2.2-10.0.2.24 \\
993# "
994
995################################################################
996## Torify Gateway / Hide the fact, that you are a Whonix user ##
997################################################################
998
999## For ensuring, that the Whonix-Workstation can only send traffic through Tor,
1000## it would not be required to route Whonix-Gateways traffic through Tor as well.
1001## Torifying the Whonix-Gateway prevents your ISP from knowing you are a Whonix user.
1002##
1003## This does NOT prevent your ISP from knowing you are a Tor user.
1004## If you want this, read:
1005## https://www.whonix.org/wiki/Hide_Tor_and_Whonix_from_your_ISP
1006##
1007## Torifying the Gateway has the disadvantage, that apt-get operating system updates
1008## are slower. It also makes testing, developing and all kinds of special non-stock
1009## configurations more complicated. You can optionally disable this feature.
1010##
1011## Experts only! There is also the user clearnet on the Whonix-Gateway, which
1012## is allowed to make non-Tor connections.
1013##
1014## Allow (1) or forbid (0) the root user on the Whonix-Gateway to make non-Tor connections.
1015## Experts only!
1016ALLOW_GATEWAY_ROOT_USER=1
1017## Allow (1) or forbid (0) the user user on the Whonix-Gateway to make non-Tor connections.
1018## Experts only!
1019ALLOW_GATEWAY_USER_USER=1
1020
1021#############################
1022## SSH into Whonix-Gateway ##
1023#############################
1024
1025## This will simply open incoming port 22 in the Whonix-Gateway firewall.
1026## A port forwarding from the host to the Whonix-Gateway has still to be created,
1027## see SSH into Whonix-Gateway.
1028## https://www.whonix.org/wiki/File_Transfer
1029## Experts only!
1030GATEWAY_ALLOW_INCOMING_SSH=0
1031
1032##########
1033## Misc ##
1034##########
1035
1036## Reject invalid outgoing packages (0) or do not reject them (1).
1037NO_REJECT_INVALID_OUTGOING_PACKAGES=0
1038
1039## Destinations you don not want routed through Tor, only for Whonix-Gateway!
1040## 10.0.2.2-10.0.2.24: VirtualBox DHCP
1041## NON_TOR_GATEWAY="\\
1042## 127.0.0.0-127.0.0.24 \\
1043## 192.168.0.0-192.168.0.24 \\
1044## 192.168.1.0-192.168.1.24 \\
1045## 10.152.152.0-10.152.152.24 \\
1046## 10.0.2.2-10.0.2.24 \\
1047## "
1048
1049## Drop all incoming ICMP traffic.
1050## Enable: 1
1051## Disable: 0
1052## DISABLED BY DEFAULT
1053GATEWAY_ALLOW_INCOMING_ICMP=0
1054
1055## End of Whonix /etc/whonix_firewall.d/30_default.conf
1056EOF
1057
1058### LIB
1059
1060cat << EOF > /lib/systemd/system/whonix-firewall.service
1061# This file is part of Qubes+Whonix.
1062# Copyright (C) 2015 Jason Mehring <nrgaway@gmail.com>
1063# Copyright (C) 2015 - 2016 Patrick Schleizer <adrelanos@riseup.net>
1064# License: GPL-2+
1065
1066## On Whonix-Gateway or Whonix-Workstation (if /usr/share/anon-gw-base-files/gateway or
1067## /usr/share/anon-ws-base-files/workstation exists), loads Whonix Firewall.
1068##
1069## (Does nothing inside Qubes TemplateVMs.)
1070##
1071## If loading Whonix Firewall fails, creates /var/run/anon-firewall/failed.status.
1072
1073[Unit]
1074Description=Whonix firewall loader
1075Documentation=https://www.whonix.org/wiki/Whonix-Gateway_Firewall
1076
1077DefaultDependencies=no
1078
1079Before=network-pre.target
1080Wants=network-pre.target
1081
1082## Preventing race condition with
1083## /etc/xdg/autostart/qubes-whonixsetup.desktop.
1084## TODO:
1085## Not the most efficient / clean solution.
1086## https://phabricator.whonix.org/T424
1087Before=qubes-gui-agent.service
1088
1089## For /etc/whonix_firewall.d and Qubes /rw/whonix_firewall.d.
1090After=local-fs.target
1091
1092## Why is this needed?
1093After=qubes-mount-dirs.service
1094
1095## Legacy.
1096After=qubes-mount-home.service
1097
1098## For /var/run/qubes/this-is-* files.
1099After=qubes-sysinit.target
1100
1101Before=shutdown.target
1102Conflicts=shutdown.target
1103
1104[Service]
1105Type=oneshot
1106RemainAfterExit=yes
1107ExecStart=/usr/lib/anon-shared-helper-scripts/enable-firewall
1108
1109[Install]
1110WantedBy=multi-user.target
1111
1112## Legacy.
1113Alias=qubes-whonix-firewall.service
1114EOF
1115
1116cat << EOF > /lib/systemd/system/whonix-firewall-sdwdate-watcher.service
1117## This file is part of Whonix.
1118## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
1119## See the file COPYING for copying conditions.
1120
1121## Restarts whonix-firewall when /var/run/sdwdate/first_success status file was
1122## created, i.e. when sdwdate succeeded so Whonix firewall will move from
1123## timesync-fail-closed mode to full mode.
1124
1125[Unit]
1126Description=Whonix firewall sdwdate watcher
1127Documentation=https://www.whonix.org/wiki/sdwdate
1128
1129ConditionPathExists=!/var/run/qubes/this-is-templatevm
1130
1131After=whonix-firewall.service
1132After=sdwdate.service
1133
1134[Service]
1135Type=simple
1136
1137SuccessExitStatus=143
1138KillMode=control-group
1139
1140ExecStart=/usr/lib/anon-shared-helper-scripts/firewall-restarter
1141
1142[Install]
1143WantedBy=multi-user.target
1144EOF
1145
1146mkdir -p /lib/systemd/system/control-port-filter-python.service.d
1147cat << EOF > /lib/systemd/system/control-port-filter-python.service.d/30_whonix_cpfpy.conf
1148## This file is part of Whonix.
1149## Copyright (C) 2012 - 2015 Patrick Schleizer <adrelanos@riseup.net>
1150## See the file COPYING for copying conditions.
1151
1152[Unit]
1153## Workaround:
1154## control-port-filter-python fails if it cannot bind on the network interface.
1155## This is the case when networking did not come up, which is the case when
1156## whonix-firewall.service failed. To make control-port-filter-python
1157## automatically start after lets says Whonix firewall config was fixed and the
1158## whonix-firewall.service was restarted.
1159After=whonix-firewall.service
1160Requires=whonix-firewall.service
1161EOF
1162
1163mkdir -p /root/bk/lib/systemd/system/networking.service.d
1164#cat << EOF > /lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
1165cat << EOF > /root/bk/lib/systemd/system/networking.service.d/30_whonix-gw-firewall-fail-closed.conf
1166## Copyright (C) 2016 Patrick Schleizer <adrelanos@riseup.net>
1167## See the file COPYING for copying conditions.
1168
1169[Unit]
1170## Fail Closed Mechanism.
1171## When the Whonix firewall systemd service failed, do not bring up the
1172## network.
1173After=whonix-firewall.service
1174Requires=whonix-firewall.service
1175EOF
1176
1177mkdir -p /lib/systemd/system/tor-controlport-filter.service.d
1178cat << EOF > /lib/systemd/system/tor-controlport-filter.service.d/30_whonix_cpfpy.conf
1179## This file is part of Whonix.
1180## Copyright (C) 2012 - 2015 Patrick Schleizer <adrelanos@riseup.net>
1181## See the file COPYING for copying conditions.
1182
1183[Unit]
1184## Workaround:
1185## control-port-filter-python fails if it cannot bind on the network interface.
1186## This is the case when networking did not come up, which is the case when
1187## whonix-firewall.service failed. To make control-port-filter-python
1188## automatically start after lets says Whonix firewall config was fixed and the
1189## whonix-firewall.service was restarted.
1190After=whonix-firewall.service
1191Requires=whonix-firewall.service
1192EOF
1193
1194### USR
1195
1196## 05
1197cat << EOF > /usr/bin/whonix_firewall
1198#!/bin/bash
1199
1200## 05
1201
1202## Copyright (C) 2012 - 2015 Patrick Schleizer <adrelanos@riseup.net>
1203## Copyright (C) 2014 - 2015 Jason Mehring <nrgaway@gmail.com>
1204## See the file COPYING for copying conditions.
1205
1206## --reject-with
1207## http://ubuntuforums.org/showthread.php?p=12011099
1208
1209## Set to icmp-admin-prohibited because icmp-port-unreachable caused
1210## confusion. icmp-port-unreachable looks like a bug while
1211## icmp-admin-prohibited hopefully makes clear it is by design.
1212
1213set -e
1214
1215error_handler() {
1216 echo "##################################################"
1217 echo "Whonix firewall script failed!"
1218 echo "##################################################"
1219
1220 echo "\$0 ##################################################" >> /var/log/sdwdate.log || true
1221 echo "\$0 Whonix firewall script failed!" >> /var/log/sdwdate.log || true
1222 echo "\$0 ##################################################" >> /var/log/sdwdate.log || true
1223
1224 exit 1
1225}
1226
1227trap "error_handler" ERR
1228
1229init() {
1230 echo "OK: Loading Whonix firewall..."
1231
1232 set -o pipefail
1233 set -o errtrace
1234
1235 ## In case sdwdate is not installed.
1236 ## Defensive measure to not mess up file permissions.
1237 mkdir --parents /var/run/sdwdate
1238 chown --recursive sdwdate:sdwdate /var/run/sdwdate
1239}
1240
1241source_config_folder() {
1242 shopt -s nullglob
1243 local i
1244 for i in /etc/whonix_firewall.d/*.conf /rw/config/whonix_firewall.d/*.conf; do
1245 bash_n_exit_code="0"
1246 bash_n_output="\$(bash -n "\$i" 2>&1)" || { bash_n_exit_code="\$?" ; true; };
1247 if [ ! "\$bash_n_exit_code" = "0" ]; then
1248 echo "Invalid config file: \$i
1249 bash_n_exit_code: \$bash_n_exit_code
1250 bash_n_output:
1251 \$bash_n_output" >&2
1252 exit 1
1253 fi
1254 source "\$i"
1255 done
1256}
1257
1258variables_defaults() {
1259 [ -n "\$iptables_cmd" ] || iptables_cmd="iptables --wait"
1260 [ -n "\$ip6tables_cmd" ] || ip6tables_cmd="ip6tables --wait"
1261
1262 [ -n "\$WORKSTATION_TRANSPARENT_TCP" ] || WORKSTATION_TRANSPARENT_TCP=1
1263 [ -n "\$WORKSTATION_TRANSPARENT_DNS" ] || WORKSTATION_TRANSPARENT_DNS=1
1264 [ -n "\$WORKSTATION_ALLOW_SOCKSIFIED" ] || WORKSTATION_ALLOW_SOCKSIFIED=1
1265 [ -n "\$CONTROL_PORT_FILTER_PROXY_ENABLE" ] || CONTROL_PORT_FILTER_PROXY_ENABLE=1
1266 [ -n "\$GATEWAY_ALLOW_INCOMING_DIR_PORT" ] || GATEWAY_ALLOW_INCOMING_DIR_PORT=0
1267 [ -n "\$GATEWAY_ALLOW_INCOMING_OR_PORT" ] || GATEWAY_ALLOW_INCOMING_OR_PORT=0
1268 [ -n "\$DIR_PORT" ] || DIR_PORT=80
1269 [ -n "\$OR_PORT" ] || OR_PORT=443
1270 [ -n "\$GATEWAY_TRANSPARENT_TCP" ] || GATEWAY_TRANSPARENT_TCP=0
1271 [ -n "\$GATEWAY_TRANSPARENT_UDP" ] || GATEWAY_TRANSPARENT_UDP=0
1272 [ -n "\$GATEWAY_TRANSPARENT_DNS" ] || GATEWAY_TRANSPARENT_DNS=0
1273 [ -n "\$ALLOW_GATEWAY_ROOT_USER" ] || ALLOW_GATEWAY_ROOT_USER=0
1274 [ -n "\$ALLOW_GATEWAY_USER_USER" ] || ALLOW_GATEWAY_USER_USER=0
1275 [ -n "\$GATEWAY_ALLOW_INCOMING_SSH" ] || GATEWAY_ALLOW_INCOMING_SSH=0
1276 [ -n "\$GATEWAY_ALLOW_INCOMING_ICMP" ] || GATEWAY_ALLOW_INCOMING_ICMP=0
1277
1278 ## Get Tor username, distro specific!
1279 [ -n "\$TOR_USER" ] || TOR_USER="\$(id -u debian-tor)"
1280
1281 ## Get user uids.
1282 [ -n "\$CLEARNET_USER" ] || CLEARNET_USER="\$(id -u clearnet)"
1283 [ -n "\$USER_USER" ] || USER_USER="\$(id -u user)"
1284 [ -n "\$ROOT_USER" ] || ROOT_USER="\$(id -u root)"
1285 [ -n "\$TUNNEL_USER" ] || TUNNEL_USER="\$(id -u tunnel)"
1286 [ -n "\$SDWDATE_USER" ] || SDWDATE_USER="\$(id -u sdwdate)"
1287 [ -n "\$WHONIXCHECK_USER" ] || WHONIXCHECK_USER="\$(id -u whonixcheck)"
1288
1289 echo "OK: TOR_USER: \$TOR_USER"
1290 echo "OK: CLEARNET_USER: \$CLEARNET_USER"
1291 echo "OK: USER_USER: \$USER_USER"
1292 echo "OK: ROOT_USER: \$ROOT_USER"
1293 echo "OK: TUNNEL_USER: \$TUNNEL_USER"
1294 echo "OK: SDWDATE_USER: \$SDWDATE_USER"
1295 echo "OK: WHONIXCHECK_USER: \$WHONIXCHECK_USER"
1296
1297 ## No NAT for clearnet user.
1298 NO_NAT_USERS+=" \$CLEARNET_USER"
1299
1300 ## No NAT for tunnel user.
1301 NO_NAT_USERS+=" \$TUNNEL_USER"
1302
1303 ## No NAT for user user.
1304 ## DISABLED BY DEFAULT. For testing/debugging only.
1305 if [ "\$ALLOW_GATEWAY_USER_USER" = "1" ]; then
1306 NO_NAT_USERS+=" \$USER_USER"
1307 fi
1308
1309 ## No NAT for root user.
1310 ## DISABLED BY DEFAULT. For testing/debugging only.
1311 if [ "\$ALLOW_GATEWAY_ROOT_USER" = "1" ]; then
1312 NO_NAT_USERS+=" \$ROOT_USER"
1313 fi
1314
1315 ## No NAT for Tor itself,
1316 ## unless VPN_FIREWALL mode is enabled.
1317 if [ "\$VPN_FIREWALL" = "1" ]; then
1318 true
1319 else
1320 NO_NAT_USERS+=" \$TOR_USER"
1321 fi
1322
1323 echo "OK: NO_NAT_USERS: \$NO_NAT_USERS"
1324
1325 if [ -d "/usr/lib/qubes" ]; then
1326 [ -n "\$qubes_vm_type" ] || qubes_vm_type="\$(qubesdb-read /qubes-vm-type)"
1327 [ -n "\$INT_IF" ] || INT_IF="vif+"
1328 [ -n "\$INT_TIF" ] || INT_TIF="vif+"
1329 fi
1330
1331 ## External interface
1332 [ -n "\$EXT_IF" ] || EXT_IF="eth0"
1333 ## Internal interface
1334 [ -n "\$INT_IF" ] || INT_IF="eth1"
1335 ## Internal "tunnel" interface, usually the same as
1336 ## the Internal interface unless using vpn tunnels
1337 ## between workstations and gateway
1338 [ -n "\$INT_TIF" ] || INT_TIF="eth1"
1339
1340 if [ "\$NON_TOR_GATEWAY" = "" ]; then
1341 if [ -d "/usr/lib/qubes" ]; then
1342 NON_TOR_GATEWAY="\\
1343 127.0.0.0-127.0.0.24 \\
1344 10.137.0.0-10.138.255.255 \\
1345 "
1346 else
1347 ## 10.0.2.2-10.0.2.24: VirtualBox DHCP
1348 NON_TOR_GATEWAY="\\
1349 127.0.0.0-127.0.0.24 \\
1350 192.168.0.0-192.168.0.24 \\
1351 192.168.1.0-192.168.1.24 \\
1352 10.152.152.0-10.152.152.24 \\
1353 10.0.2.2-10.0.2.24 \\
1354 "
1355 fi
1356 fi
1357
1358 [ -n "\$VPN_INTERFACE" ] || VPN_INTERFACE="tun0"
1359
1360 ## Destinations you do not routed through VPN, only for Whonix-Gateway.
1361 if [ "\$LOCAL_NET" = "" ]; then
1362 if [ -d "/usr/lib/qubes" ]; then
1363 LOCAL_NET="\\
1364 127.0.0.0-127.0.0.24 \\
1365 10.137.0.0-10.138.255.255 \\
1366 "
1367 else
1368 ## 10.0.2.2/24: VirtualBox DHCP
1369 LOCAL_NET="\\
1370 127.0.0.0-127.0.0.24 \\
1371 192.168.0.0-192.168.0.24 \\
1372 192.168.1.0-192.168.1.24 \\
1373 10.152.152.0-10.152.152.24 \\
1374 10.0.2.2-10.0.2.24 \\
1375 "
1376 fi
1377 fi
1378
1379 if [ "\$WORKSTATION_DEST_SOCKSIFIED" = "" ]; then
1380 ## 192.168.0.10 - Non-Qubes-Whonix-Gateway old IP
1381 ## 10.152.152.10 - Non-Qubes-Whonix-Gateway IP
1382 ## 10.137.0.0/8 - persistent Qubes-Whonix-Gateway IP range
1383 ## 10.138.0.0/8 - DispVM Qubes-Whonix-Gateway IP range
1384 WORKSTATION_DEST_SOCKSIFIED="\\
1385192.168.0.10,\\
138610.152.152.10,\\
138710.137.0.0/8,\\
138810.138.0.0/8"
1389 fi
1390
1391 ## The following ports are used
1392 ## - here in /usr/bin/whonix_firewall (package: whonix-gw-firewall)
1393 ## - by Tor in /usr/share/tor/tor-service-defaults-torrc (package: anon-gw-anonymizer-config)
1394 ##
1395 ## The following applications will be separated, preventing identity
1396 ## correlation through circuit sharing.
1397
1398 ## Transparent Proxy Ports for Whonix-Workstation
1399 [ -n "\$TRANS_PORT_WORKSTATION" ] || TRANS_PORT_WORKSTATION="9040"
1400 [ -n "\$DNS_PORT_WORKSTATION" ] || DNS_PORT_WORKSTATION="5300"
1401
1402 ## Transparent Proxy Ports for Whonix-Gateway
1403 [ -n "\$TRANS_PORT_GATEWAY" ] || TRANS_PORT_GATEWAY="9041"
1404 [ -n "\$DNS_PORT_GATEWAY" ] || DNS_PORT_GATEWAY="5400"
1405
1406 ## Control Port Filter Proxy Port
1407 [ -n "\$CONTROL_PORT_FILTER_PROXY_PORT" ] || CONTROL_PORT_FILTER_PROXY_PORT="9051"
1408
1409 [ -n "\$GATEWAY_ALLOW_INCOMING_FLASHPROXY" ] || GATEWAY_ALLOW_INCOMING_FLASHPROXY="0"
1410 [ -n "\$FLASHPROXY_PORT" ] || FLASHPROXY_PORT="9000"
1411
1412 ## Socks Ports for per application circuits.
1413 [ -n "\$SOCKS_PORT_TOR_DEFAULT" ] || SOCKS_PORT_TOR_DEFAULT="9050"
1414 [ -n "\$SOCKS_PORT_TB" ] || SOCKS_PORT_TB="9100"
1415 [ -n "\$SOCKS_PORT_IRC" ] || SOCKS_PORT_IRC="9101"
1416 [ -n "\$SOCKS_PORT_TORBIRDY" ] || SOCKS_PORT_TORBIRDY="9102"
1417 [ -n "\$SOCKS_PORT_IM" ] || SOCKS_PORT_IM="9103"
1418 [ -n "\$SOCKS_PORT_APT_GET" ] || SOCKS_PORT_APT_GET="9104"
1419 [ -n "\$SOCKS_PORT_GPG" ] || SOCKS_PORT_GPG="9105"
1420 [ -n "\$SOCKS_PORT_SSH" ] || SOCKS_PORT_SSH="9106"
1421 [ -n "\$SOCKS_PORT_GIT" ] || SOCKS_PORT_GIT="9107"
1422 [ -n "\$SOCKS_PORT_SDWDATE" ] || SOCKS_PORT_SDWDATE="9108"
1423 [ -n "\$SOCKS_PORT_WGET" ] || SOCKS_PORT_WGET="9109"
1424 [ -n "\$SOCKS_PORT_WHONIXCHECK" ] || SOCKS_PORT_WHONIXCHECK="9110"
1425 [ -n "\$SOCKS_PORT_BITCOIN" ] || SOCKS_PORT_BITCOIN="9111"
1426 [ -n "\$SOCKS_PORT_PRIVOXY" ] || SOCKS_PORT_PRIVOXY="9112"
1427 [ -n "\$SOCKS_PORT_POLIPO" ] || SOCKS_PORT_POLIPO="9113"
1428 [ -n "\$SOCKS_PORT_WHONIX_NEWS" ] || SOCKS_PORT_WHONIX_NEWS="9114"
1429 [ -n "\$SOCKS_PORT_TBB_DOWNLOAD" ] || SOCKS_PORT_TBB_DOWNLOAD="9115"
1430 [ -n "\$SOCKS_PORT_TBB_GPG" ] || SOCKS_PORT_TBB_GPG="9116"
1431 [ -n "\$SOCKS_PORT_CURL" ] || SOCKS_PORT_CURL="9117"
1432 [ -n "\$SOCKS_PORT_RSS" ] || SOCKS_PORT_RSS="9118"
1433 [ -n "\$SOCKS_PORT_TORCHAT" ] || SOCKS_PORT_TORCHAT="9119"
1434 [ -n "\$SOCKS_PORT_MIXMASTERUPDATE" ] || SOCKS_PORT_MIXMASTERUPDATE="9120"
1435 [ -n "\$SOCKS_PORT_MIXMASTER" ] || SOCKS_PORT_MIXMASTER="9121"
1436 [ -n "\$SOCKS_PORT_KDE" ] || SOCKS_PORT_KDE="9122"
1437 [ -n "\$SOCKS_PORT_GNOME" ] || SOCKS_PORT_GNOME="9123"
1438 [ -n "\$SOCKS_PORT_APTITUDE" ] || SOCKS_PORT_APTITUDE="9124"
1439 [ -n "\$SOCKS_PORT_YUM" ] || SOCKS_PORT_YUM="9125"
1440 [ -n "\$SOCKS_PORT_TBB_DEFAULT" ] || SOCKS_PORT_TBB_DEFAULT="9150"
1441
1442 ## For testing purposes only.
1443 ## To test if prerouting redirection rules for socksified interfere with transparent torification.
1444 ## https://phabricator.whonix.org/T462
1445 #[ -n "\$SOCKS_PORT_HTTP" ] || SOCKS_PORT_HTTP="80"
1446 #[ -n "\$SOCKS_PORT_SSL" ] || SOCKS_PORT_SSL="443"
1447
1448 ## Adding more Socks Ports here should no longer be necessary.
1449 ## There are already lots of custom ports prepared that you can use.
1450 ## See documentation:
1451 ## https://www.whonix.org/wiki/Stream_Isolation
1452 ##
1453 ## Additional Socks Ports for per application circuits could be
1454 ## added here, but you would have to:
1455 ## - Edit '/etc/tor/torrc' to add more 'SocksPort's.
1456 ## - And 'sudo service tor@default reload' afterwards.
1457 ## - Add more socks port variables to Whonix firewall configuration.
1458 ## (For example to '/etc/whonix_firewall.d/50_user.conf'.)
1459 ## Follow the 'SOCKS_PORT_...' naming scheme.
1460 ## (For example 'SOCKS_PORT_CUSTOM_ONE', 'SOCKS_PORT_CUSTOM_TWO', etc.)
1461 ## - And issue "sudo /usr/bin/whonix_firewall" afterwards.
1462
1463 socks_ports_list="\$(compgen -v | grep SOCKS\\_PORT\\_)"
1464}
1465
1466ipv4_defaults() {
1467 ## Set secure defaults.
1468 \$iptables_cmd -P INPUT DROP
1469
1470 ## FORWARD rules does not actually do anything if forwarding is disabled. Better be safe just in case.
1471 \$iptables_cmd -P FORWARD DROP
1472
1473 ## Only the Tor process is allowed to establish outgoing connections.
1474 \$iptables_cmd -P OUTPUT DROP
1475}
1476
1477ipv4_preparation() {
1478 ## Flush old rules.
1479 \$iptables_cmd -F
1480 \$iptables_cmd -X
1481 \$iptables_cmd -t nat -F
1482 \$iptables_cmd -t nat -X
1483 \$iptables_cmd -t mangle -F
1484 \$iptables_cmd -t mangle -X
1485}
1486
1487ipv4_drop_invalid_incoming_packages() {
1488 ## DROP INVALID
1489 \$iptables_cmd -A INPUT -m conntrack --ctstate INVALID -j DROP
1490 \$iptables_cmd -A INPUT -m state --state INVALID -j DROP
1491
1492 ## DROP INVALID SYN PACKETS
1493 \$iptables_cmd -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
1494 \$iptables_cmd -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
1495 \$iptables_cmd -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
1496
1497 ## DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK ONCE RESULTED IN KERNEL PANICS
1498 \$iptables_cmd -A INPUT -f -j DROP
1499
1500 ## DROP INCOMING MALFORMED XMAS PACKETS
1501 \$iptables_cmd -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
1502
1503 ## DROP INCOMING MALFORMED NULL PACKETS
1504 \$iptables_cmd -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
1505}
1506
1507qubes() {
1508 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1509 true "timesync-fail-closed mode, skipping rest of function \$FUNCNAME"
1510 return 0
1511 fi
1512
1513 if [ "\$qubes_vm_type" = "NetVM" ] || [ "\$qubes_vm_type" = "ProxyVM" ]; then
1514 local int_if_item
1515
1516 for int_if_item in \$INT_IF; do
1517 ## Allow connections from port 8082 of internal vif interface for tinyproxy
1518 ## tinyproxy is responsible to handle TemplateVMs updates.
1519 \$iptables_cmd -A INPUT -i "\$int_if_item" -p tcp -m tcp --dport 8082 -j ACCEPT
1520 \$iptables_cmd -A OUTPUT -o "\$int_if_item" -p tcp -m tcp --sport 8082 -j ACCEPT
1521 done
1522
1523 ## Qubes pre-routing. Will be able to intercept traffic destined for
1524 ## 10.137.255.254 to be re-routed to tinyproxy.
1525 \$iptables_cmd -t nat -N PR-QBS-SERVICES
1526 \$iptables_cmd -t nat -A PREROUTING -j PR-QBS-SERVICES
1527
1528 for int_if_item in \$INT_IF; do
1529 ## Redirects traffic destined for 10.137.255.154 to port 8082 (tinyproxy).
1530 \$iptables_cmd -t nat -A PR-QBS-SERVICES -d 10.137.255.254/32 -i "\$int_if_item" -p tcp -m tcp --dport 8082 -j REDIRECT
1531 done
1532
1533 ## Forward tinyproxy output to port 5300/9040 on internal (Tor) interface (eth1) to be
1534 ## able to connect to Internet (via Tor) to proxy updates for TemplateVM.
1535 \$iptables_cmd -t nat -A OUTPUT -p udp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:\${DNS_PORT_GATEWAY}"
1536 \$iptables_cmd -t nat -A OUTPUT -p tcp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:\${TRANS_PORT_GATEWAY}"
1537
1538 ## The same for squid from qubes-updates-cache, which runs as user vm-updates.
1539 if getent passwd vm-updates >/dev/null; then
1540 \$iptables_cmd -t nat -A OUTPUT -p udp -m owner --uid-owner vm-updates -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:\${DNS_PORT_GATEWAY}"
1541 \$iptables_cmd -t nat -A OUTPUT -p tcp -m owner --uid-owner vm-updates -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:\${TRANS_PORT_GATEWAY}"
1542 fi
1543 fi
1544}
1545
1546ipv4_input_rules() {
1547 ## Traffic on the loopback interface is accepted.
1548 \$iptables_cmd -A INPUT -i lo -j ACCEPT
1549
1550 ## Established incoming connections are accepted.
1551 \$iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT
1552
1553 ## Drop all incoming ICMP traffic by default.
1554 ## All incoming connections are dropped by default anyway, but should a user
1555 ## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
1556 ## still be dropped to filter for example ICMP time stamp requests.
1557 if [ ! "\$GATEWAY_ALLOW_INCOMING_ICMP" = "1" ]; then
1558 \$iptables_cmd -A INPUT -p icmp -j DROP
1559 fi
1560
1561 ## Allow all incoming connections on the virtual VPN network interface,
1562 ## when VPN_FIREWALL mode is enabled.
1563 ## DISABLED BY DEFAULT.
1564 if [ "\$VPN_FIREWALL" = "1" ]; then
1565 \$iptables_cmd -A INPUT -i "\$VPN_INTERFACE" -j ACCEPT
1566 fi
1567
1568 local ext_if_item
1569
1570 for ext_if_item in \$EXT_IF; do
1571 ## Allow incoming SSH connections on the external interface.
1572 ## DISABLED BY DEFAULT. For testing/debugging only.
1573 if [ "\$GATEWAY_ALLOW_INCOMING_SSH" = "1" ]; then
1574 \$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport 22 -j ACCEPT
1575 fi
1576
1577 ## Allow incoming Flash Proxy connections on the external interface.
1578 ## This has NOTHING to do with Adobe Flash.
1579 ## DISABLED BY DEFAULT.
1580 if [ "\$GATEWAY_ALLOW_INCOMING_FLASHPROXY" = "1" ]; then
1581 \$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport "\$FLASHPROXY_PORT" -j ACCEPT
1582 fi
1583
1584 local local_port_to_open
1585 for local_port_to_open in \$EXTERNAL_OPEN_PORTS; do
1586 \$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport "\$local_port_to_open" -j ACCEPT
1587 done
1588 done
1589
1590 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1591 true "timesync-fail-closed mode, skipping rest of function \$FUNCNAME"
1592 return 0
1593 fi
1594
1595 for ext_if_item in \$EXT_IF; do
1596 ## Allow incoming DIRPORT connections for an optional Tor relay.
1597 ## DISABLED BY DEFAULT.
1598 if [ "\$GATEWAY_ALLOW_INCOMING_DIR_PORT" = "1" ]; then
1599 \$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport "\$DIR_PORT" -j ACCEPT
1600 fi
1601
1602 ## Allow incoming ORPORT connections for an optional Tor relay.
1603 ## DISABLED BY DEFAULT.
1604 if [ "\$GATEWAY_ALLOW_INCOMING_OR_PORT" = "1" ]; then
1605 \$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport "\$OR_PORT" -j ACCEPT
1606 fi
1607
1608 ## Custom Open Ports on external interface
1609 ## - untested, should work
1610 ## - Replace 22,9050,9051,9150,9151 with any ports you like to be open, example: 9050,9051
1611 ## or just 9050
1612 ## - \$iptables_cmd v1.4.14: multiport needs -p tcp, -p udp, -p udplite, -p sctp or -p dccp
1613 #\$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --match multiport --dports 22,9050,9051,9150,9151 -j ACCEPT
1614 #\$iptables_cmd -A INPUT -i "\$ext_if_item" -p udp --match multiport --dports 22,9050,9051,9150,9151 -j ACCEPT
1615
1616 ## OPTIONAL Allow incoming OpenVPN connections on the external interface.
1617 #\$iptables_cmd -A INPUT -i "\$ext_if_item" -p tcp --dport 1194 -j ACCEPT
1618 done
1619
1620 local int_tif_item
1621 local int_if_item
1622
1623 for int_tif_item in \$INT_TIF; do
1624 if [ "\$WORKSTATION_TRANSPARENT_DNS" = "1" ]; then
1625 ## Allow DNS traffic to DnsPort.
1626 \$iptables_cmd -A INPUT -i "\$int_tif_item" -p udp --dport "\$DNS_PORT_WORKSTATION" -j ACCEPT
1627 fi
1628 done
1629
1630 for int_if_item in \$INT_IF; do
1631 if [ "\$WORKSTATION_TRANSPARENT_TCP" = "1" ]; then
1632 ## Allow TCP traffic TransPort.
1633 \$iptables_cmd -A INPUT -i "\$int_if_item" -p tcp --dport "\$TRANS_PORT_WORKSTATION" -j ACCEPT
1634 fi
1635 done
1636
1637 for int_tif_item in \$INT_TIF; do
1638 ## Allow TCP traffic to Control Port Filter Proxy.
1639 if [ "\$CONTROL_PORT_FILTER_PROXY_ENABLE" = "1" ]; then
1640 \$iptables_cmd -A INPUT -i "\$int_tif_item" -p tcp --dport "\$CONTROL_PORT_FILTER_PROXY_PORT" -j ACCEPT
1641 fi
1642
1643 ## Allow socksified applications.
1644 if [ "\$WORKSTATION_ALLOW_SOCKSIFIED" = "1" ]; then
1645 for socks_port in \$socks_ports_list; do
1646 true "\$socks_port: \${!socks_port}"
1647 \$iptables_cmd -A INPUT -i "\$int_tif_item" -p tcp --dport "\${!socks_port}" -j ACCEPT
1648 done
1649
1650 ## Accept ports 9152-9189 prepared for user custom applications.
1651 ## See /usr/share/tor/tor-service-defaults-torrc for more comments.
1652 \$iptables_cmd -A INPUT -i "\$int_tif_item" -p tcp --match multiport --dports 9152:9189 -j ACCEPT
1653 fi
1654 done
1655
1656 for int_if_item in \$INT_IF; do
1657 ## Redirect Control Port Filter Proxy to Control Port Filter Proxy port.
1658 if [ "\$CONTROL_PORT_FILTER_PROXY_ENABLE" = "1" ]; then
1659 \$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -d "\$WORKSTATION_DEST_SOCKSIFIED" -p tcp --dport "\$CONTROL_PORT_FILTER_PROXY_PORT" -j REDIRECT --to-ports "\$CONTROL_PORT_FILTER_PROXY_PORT"
1660 fi
1661
1662 if [ "\$WORKSTATION_ALLOW_SOCKSIFIED" = "1" ]; then
1663 for socks_port in \$socks_ports_list; do
1664 true "\$socks_port: \${!socks_port}"
1665 ## Redirect Browser/IRC/TorBirdy, etc. to SocksPort.
1666 \$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -d "\$WORKSTATION_DEST_SOCKSIFIED" -p tcp --dport "\${!socks_port}" -j REDIRECT --to-ports "\${!socks_port}"
1667 done
1668
1669 for port_number_temp in \$(seq 9152 9189); do
1670 ## Redirect ports 9152-9189 prepared for user custom applications.
1671 \$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -d "\$WORKSTATION_DEST_SOCKSIFIED" -p tcp --dport "\$port_number_temp" -j REDIRECT --to-ports "\$port_number_temp"
1672 done
1673 fi
1674
1675 if [ "\$WORKSTATION_TRANSPARENT_DNS" = "1" ]; then
1676 ## Redirect remaining DNS traffic to DNS_PORT_WORKSTATION.
1677 ## Only user installed applications not configured to use a SocksPort are affected.
1678 \$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -p udp --dport 53 -j REDIRECT --to-ports "\$DNS_PORT_WORKSTATION"
1679 fi
1680
1681 if [ "\$WORKSTATION_TRANSPARENT_TCP" = "1" ]; then
1682 ## Catch all remaining TCP and redirect to TransPort.
1683 ## Only user installed applications not configured to use a SocksPort are affected.
1684 \$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -p tcp --syn -j REDIRECT --to-ports "\$TRANS_PORT_WORKSTATION"
1685
1686 ## Optionally restrict TransPort.
1687 ## Replace above rule with a more restrictive one, e.g.:
1688 #\$iptables_cmd -t nat -A PREROUTING -i "\$int_if_item" -p tcp --match multiport --dports 80,443 --syn -j REDIRECT --to-ports "\$TRANS_PORT_WORKSTATION"
1689 fi
1690 done
1691}
1692
1693ipv4_input_defaults() {
1694 ## Log.
1695 #\$iptables_cmd -A INPUT -j LOG --log-prefix "Whonix blocked input4: "
1696
1697 ## Reject anything not explicitly allowed above.
1698 ## Drop is better than reject here, because we do not want to reveal it's a Whonix-Gateway.
1699 ## (In case someone running Whonix-Gateway on bare metal.)
1700 \$iptables_cmd -A INPUT -j DROP
1701}
1702
1703ipv4_forward() {
1704 ## Log.
1705 #\$iptables_cmd -A FORWARD -j LOG --log-prefix "Whonix blocked forward4: "
1706
1707 ## Reject everything.
1708 \$iptables_cmd -A FORWARD -j REJECT --reject-with icmp-admin-prohibited
1709}
1710
1711ipv4_reject_invalid_outgoing_packages() {
1712 ## Drop invalid outgoing packages,
1713 ## unless NO_REJECT_INVALID_OUTGOING_PACKAGES is set to 1.
1714 if [ ! "\$NO_REJECT_INVALID_OUTGOING_PACKAGES" = "1" ]; then
1715 ## https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
1716 \$iptables_cmd -A OUTPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp-admin-prohibited
1717 \$iptables_cmd -A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-admin-prohibited
1718 #\$iptables_cmd -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j REJECT --reject-with icmp-admin-prohibited
1719 #\$iptables_cmd -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j REJECT --reject-with icmp-admin-prohibited
1720
1721 ## DROP INVALID SYN PACKETS
1722 \$iptables_cmd -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j REJECT --reject-with icmp-admin-prohibited
1723 \$iptables_cmd -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j REJECT --reject-with icmp-admin-prohibited
1724 \$iptables_cmd -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-admin-prohibited
1725
1726 ## DROP PACKETS WITH INCOMING FRAGMENTS. THIS ATTACK ONCE RESULTED IN KERNEL PANICS
1727 \$iptables_cmd -A OUTPUT -f -j REJECT --reject-with icmp-admin-prohibited
1728
1729 ## DROP INCOMING MALFORMED XMAS PACKETS
1730 \$iptables_cmd -A OUTPUT -p tcp --tcp-flags ALL ALL -j REJECT --reject-with icmp-admin-prohibited
1731
1732 ## DROP INCOMING MALFORMED NULL PACKETS
1733 \$iptables_cmd -A OUTPUT -p tcp --tcp-flags ALL NONE -j REJECT --reject-with icmp-admin-prohibited
1734 fi
1735}
1736
1737ipv4_output() {
1738 ## Allow outgoing traffic on VPN interface,
1739 ## if VPN_FIREWALL mode is enabled.
1740 ## DISABLED BY DEFAULT.
1741 if [ "\$VPN_FIREWALL" = "1" ]; then
1742 \$iptables_cmd -A OUTPUT -o "\$VPN_INTERFACE" -j ACCEPT
1743 fi
1744
1745 local no_nat_user
1746 for no_nat_user in \$NO_NAT_USERS ; do
1747 \$iptables_cmd -t nat -A OUTPUT -m owner --uid-owner "\$no_nat_user" -j RETURN
1748 done
1749
1750 if [ "\$firewall_mode" = "full" ]; then
1751 ## Redirect of Gateway DNS traffic to DNS_PORT_GATEWAY.
1752 ## DISABLED BY DEFAULT. default. Using SocksPort instead.
1753 if [ "\$GATEWAY_TRANSPARENT_DNS" = "1" ]; then
1754 \$iptables_cmd -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports "\$DNS_PORT_GATEWAY"
1755 fi
1756 fi
1757
1758 if [ "\$firewall_mode" = "full" ]; then
1759 ## Exclude connections to local network, Whonix-Workstation, VirtualBox from being redirected through Tor,
1760 ## unless VPN_FIREWALL mode is enabled.
1761 ## ENABLED BY DEFAULT.
1762 if [ ! "\$VPN_FIREWALL" = "1" ]; then
1763 local non_tor_gateway_item
1764 for non_tor_gateway_item in \$NON_TOR_GATEWAY; do
1765 \$iptables_cmd -t nat -A OUTPUT -m iprange --dst-range "\$non_tor_gateway_item" -j RETURN
1766 done
1767 fi
1768 fi
1769
1770 if [ "\$firewall_mode" = "full" ]; then
1771 ## Redirect all Gateway TCP traffic to TRANS_PORT_GATEWAY.
1772 ## DISABLED BY DEFAULT. Using SocksPort instead.
1773 if [ "\$GATEWAY_TRANSPARENT_TCP" = "1" ]; then
1774 \$iptables_cmd -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports "\$TRANS_PORT_GATEWAY"
1775 fi
1776 fi
1777
1778 ## Existing connections are accepted.
1779 \$iptables_cmd -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
1780
1781 if [ "\$firewall_mode" = "full" ]; then
1782 ## Accept outgoing connections to local network, Whonix-Workstation and VirtualBox,
1783 ## unless VPN_FIREWALL mode is enabled.
1784 ## ENABLED BY DEFAULT.
1785 if [ ! "\$VPN_FIREWALL" = "1" ]; then
1786 for non_tor_gateway_item in \$NON_TOR_GATEWAY; do
1787 \$iptables_cmd -A OUTPUT -m iprange --dst-range "\$non_tor_gateway_item" -j ACCEPT
1788 done
1789 fi
1790 fi
1791
1792 if [ "\$firewall_mode" = "full" ]; then
1793 ## Accept outgoing connections to local network,
1794 ## when VPN_FIREWALL mode is enabled.
1795 ## DISABLED BY DEFAULT.
1796 if [ "\$VPN_FIREWALL" = "1" ]; then
1797 local local_net_item
1798 for local_net_item in \$LOCAL_NET; do
1799 \$iptables_cmd -A OUTPUT -m iprange --dst-range "\$local_net_item" -j ACCEPT
1800 done
1801 fi
1802 fi
1803
1804 ## Prevent connections to Tor SocksPorts.
1805 ## https://phabricator.whonix.org/T533#11025
1806 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1807 local socks_port_item
1808 for socks_port_item in \$socks_ports_list; do
1809 true "\$socks_port_item: \${!socks_port_item}"
1810 if [ "\$SOCKS_PORT_SDWDATE" = "\${!socks_port_item}" ]; then
1811 continue
1812 fi
1813 \$iptables_cmd -A OUTPUT -p tcp --dport "\${!socks_port_item}" --dst "127.0.0.1" -j REJECT
1814 done
1815 fi
1816
1817 ## Access to localhost is required even in timesync-fail-closed mode,
1818 ## otherwise breaks applications such as konsole and kwrite.
1819 \$iptables_cmd -A OUTPUT -o lo -j ACCEPT
1820
1821 for no_nat_user in \$NO_NAT_USERS ; do
1822 \$iptables_cmd -A OUTPUT -m owner --uid-owner "\$no_nat_user" -j ACCEPT
1823 done
1824
1825 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1826 ## Allow sdwdate talking to localhost and Tor in Whonix firewall timesync-fail-closed mode.
1827 ## Otherwise in Whonix firewall full mode this rule is redundant.
1828 \$iptables_cmd -A OUTPUT -m owner --uid-owner "\$SDWDATE_USER" -m iprange --dst-range "127.0.0.1" -j ACCEPT
1829 \$iptables_cmd -A OUTPUT -m owner --uid-owner "\$WHONIXCHECK_USER" -m iprange --dst-range "127.0.0.1" -j ACCEPT
1830
1831 \$iptables_cmd -A OUTPUT -p tcp --dport "\$CONTROL_PORT_FILTER_PROXY_PORT" --dst "127.0.0.1" -j ACCEPT
1832 fi
1833
1834 ## Log.
1835 #\$iptables_cmd -A OUTPUT -j LOG --log-prefix "Whonix blocked output4: "
1836
1837 ## Reject all other outgoing traffic.
1838 \$iptables_cmd -A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
1839}
1840
1841ipv6() {
1842 ## Policy DROP for all traffic as fallback.
1843 \$ip6tables_cmd -P INPUT DROP
1844 \$ip6tables_cmd -P OUTPUT DROP
1845 \$ip6tables_cmd -P FORWARD DROP
1846
1847 ## Flush old rules.
1848 \$ip6tables_cmd -F
1849 \$ip6tables_cmd -X
1850 \$ip6tables_cmd -t mangle -F
1851 \$ip6tables_cmd -t mangle -X
1852
1853 ## Allow unlimited access on loopback.
1854 ## Not activated, since we do not need it.
1855 #ip6tables_cmd -A INPUT -i lo -j ACCEPT
1856 #ip6tables_cmd -A OUTPUT -o lo -j ACCEPT
1857
1858 ## Log.
1859 #ip6tables_cmd -A INPUT -j LOG --log-prefix "Whonix blocked input6: "
1860 #ip6tables_cmd -A OUTPUT -j LOG --log-prefix "Whonix blocked output6: "
1861 #ip6tables_cmd -A FORWARD -j LOG --log-prefix "Whonix blocked forward6: "
1862
1863 ## Drop/reject all other traffic.
1864 \$ip6tables_cmd -A INPUT -j DROP
1865 ## --reject-with icmp-admin-prohibited not supported by ip6tables
1866 \$ip6tables_cmd -A OUTPUT -j REJECT
1867 ## --reject-with icmp-admin-prohibited not supported by ip6tables
1868 \$ip6tables_cmd -A FORWARD -j REJECT
1869}
1870
1871status_files() {
1872 mkdir --parents /var/run/whonix_firewall
1873 if [ -e /var/run/whonix_firewall/first_run_current_boot.status ]; then
1874 touch /var/run/whonix_firewall/consecutive_run.status
1875 return 0
1876 fi
1877 touch /var/run/whonix_firewall/first_run_current_boot.status
1878}
1879
1880date_cmd(){
1881 date -u +"%Y-%m-%d %T"
1882}
1883
1884echo_and_sdwdate_log() {
1885 echo "\$@"
1886 echo "\$(date_cmd) - \$0 - \$@" >> /var/log/sdwdate.log || true
1887}
1888
1889firewall_mode_detection() {
1890 if [ ! "\$firewall_mode" = "" ]; then
1891 echo_and_sdwdate_log "OK: Skipping firewall mode detection since already set to '\$firewall_mode'."
1892 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1893 echo_and_sdwdate_log "OK: (Only local Tor control port connections and torified sdwdate allowed.)"
1894 return 0
1895 elif [ "\$firewall_mode" = "full" ]; then
1896 echo_and_sdwdate_log "OK: Skipping firewall mode detection since already set to '\$firewall_mode'."
1897 echo_and_sdwdate_log "OK: (Full torified network access allowed.)"
1898 return 0
1899 else
1900 echo_and_sdwdate_log "ERROR: firewall_mode must be set to either 'full' or 'timesync-fail-closed'."
1901 error_handler
1902 fi
1903 fi
1904
1905 ## Run Whonix firewall in full mode if sdwdate already succeeded.
1906 if [ -e /var/run/sdwdate/first_success ]; then
1907 firewall_mode=full
1908 echo_and_sdwdate_log "OK: (/var/run/sdwdate/first_success exists.)"
1909 elif [ -e /var/run/sdwdate/success ]; then
1910 firewall_mode=full
1911 echo_and_sdwdate_log "OK: (/var/run/sdwdate/success exists.)"
1912 ## /var/run/whonix_firewall/first_run_current_boot.status already exists,
1913 ## therefore have Whonxi firewall run in full mode.
1914 elif [ -e /var/run/whonix_firewall/first_run_current_boot.status ]; then
1915 firewall_mode=full
1916 echo_and_sdwdate_log "OK: (/var/run/whonix_firewall/first_run_current_boot.status exists.)"
1917 else
1918 ## /var/run/whonix_firewall/first_run_current_boot.status does not yet exist,
1919 ## therefore return 'yes, timesync-fail-closed'.
1920 firewall_mode=timesync-fail-closed
1921 fi
1922
1923 if [ "\$firewall_mode" = "timesync-fail-closed" ]; then
1924 echo_and_sdwdate_log "OK: First run during current boot, therefore running in timesync-fail-closed mode."
1925 echo_and_sdwdate_log "OK: (Only local Tor control port connections and torified sdwdate allowed.)"
1926 else
1927 echo_and_sdwdate_log "OK: Consecutive run during current boot, therefore running in full mode."
1928 echo_and_sdwdate_log "OK: (Full torified network access allowed.)"
1929 fi
1930}
1931
1932end() {
1933 echo "OK: The firewall should not show any messages,"
1934 echo "OK: besides output beginning with prefix OK:..."
1935 echo_and_sdwdate_log "OK: Whonix firewall loaded."
1936
1937 exit 0
1938}
1939
1940main() {
1941 init
1942 firewall_mode_detection
1943 variables_defaults
1944 ipv4_defaults
1945 ipv4_preparation
1946 ipv4_drop_invalid_incoming_packages
1947 qubes
1948 ipv4_input_rules
1949 ipv4_input_defaults
1950 ipv4_forward
1951 ipv4_reject_invalid_outgoing_packages
1952 ipv4_output
1953 ipv6
1954 status_files
1955 end
1956}
1957
1958source_config_folder
1959main
1960EOF
1961chmod 777 /usr/bin/whonix_firewall
1962
1963mkdir /usr/lib/gateway-shortcuts
1964## 06
1965cat << EOF > /usr/lib/gateway-shortcuts/firewall30default
1966#!/bin/bash
1967
1968## 06
1969
1970## This file is part of Whonix.
1971## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
1972## See the file COPYING for copying conditions.
1973
1974set -x
1975
1976kdesudo kwrite /etc/whonix_firewall.d/30_default.conf
1977EOF
1978chmod 777 /usr/lib/gateway-shortcuts/firewall30default
1979## 07
1980cat << EOF > /usr/lib/gateway-shortcuts/firewall50user
1981#!/bin/bash
1982
1983## 07
1984
1985## This file is part of Whonix.
1986## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
1987## See the file COPYING for copying conditions.
1988
1989set -x
1990
1991kdesudo kwrite /etc/whonix_firewall.d/50_user.conf
1992EOF
1993chmod 777 /usr/lib/gateway-shortcuts/firewall50user
1994## 08
1995cat << EOF > /usr/lib/gateway-shortcuts/reloadfirewall
1996#!/bin/bash
1997
1998## 08
1999
2000## This file is part of Whonix.
2001## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2002## See the file COPYING for copying conditions.
2003
2004set -x
2005
2006cat /etc/motd
2007
2008sudo /usr/bin/whonix_firewall
2009
2010true "\$?"
2011
2012true "Feel free to close this window."
2013
2014sleep 86400
2015EOF
2016chmod 777 /usr/lib/gateway-shortcuts/reloadfirewall
2017
2018cat << EOF > /usr/share/applications/gateway-firewall30default.desktop
2019## This file is part of Whonix.
2020## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2021## See the file COPYING for copying conditions.
2022
2023[Desktop Entry]
2024Type=Application
2025Exec=/usr/lib/gateway-shortcuts/firewall30default
2026Name=Global Firewall Settings
2027GenericName=Whonix Default Firewall Settings
2028Comment=Open /etc/whonix_firewall.d/30_default in kwrite
2029Categories=System
2030Icon=/usr/share/icons/anon-icon-pack/firewall.png
2031Keywords=system;Whonix;firewall
2032EOF
2033chmod 777 /usr/share/applications/gateway-firewall30default.desktop
2034
2035cat << EOF > /usr/share/applications/gateway-reloadfirewall.desktop
2036## This file is part of Whonix.
2037## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2038## See the file COPYING for copying conditions.
2039
2040[Desktop Entry]
2041Type=Application
2042Exec=/usr/lib/gateway-shortcuts/wrapper /usr/lib/gateway-shortcuts/reloadfirewall
2043Name=Reload Firewall
2044GenericName=Reload Whonix-Gateway Firewall
2045Comment=Reload Whonix-Gateway Firewall using "sudo /usr/bin/whonix_firewall"
2046Categories=System
2047Icon=/usr/share/icons/anon-icon-pack/quick_restart.ico
2048Keywords=system;Whonix;firewall
2049EOF
2050chmod 777 /usr/share/applications/gateway-reloadfirewall.desktop
2051
2052cat << EOF > /usr/share/applications/gateway-firewall50user.desktop
2053## This file is part of Whonix.
2054## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2055## See the file COPYING for copying conditions.
2056
2057[Desktop Entry]
2058Type=Application
2059Exec=/usr/lib/gateway-shortcuts/firewall50user
2060Name=User Firewall Settings
2061GenericName=Whonix User Firewall Settings
2062Comment=Open /etc/whonix_firewall.d/50_user in kwrite
2063Categories=System
2064Icon=/usr/share/icons/anon-icon-pack/nerolinux.ico
2065Keywords=system;Whonix;firewall
2066EOF
2067chmod 777 /usr/share/applications/gateway-firewall50user.desktop
2068
2069mkdir -p /usr/share/lintian/overrides
2070cat << EOF > /usr/share/lintian/overrides/whonix-gw-firewall
2071## shipped by anon-gw-anonymizer-config
2072whonix-gw-firewall: desktop-command-not-in-package usr/share/applications/gateway-reloadfirewall.desktop usr/lib/gateway-shortcuts/wrapper
2073EOF
2074
2075## 09
2076cat << EOF > anon-gw-anonymizer-config.postinst
2077#!/bin/bash
2078
2079## 09
2080
2081## This file is part of Whonix.
2082## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2083## See the file COPYING for copying conditions.
2084
2085if [ -f /usr/lib/pre.bsh ]; then
2086 source /usr/lib/pre.bsh
2087fi
2088
2089set -e
2090
2091true "
2092#####################################################################
2093## INFO: BEGIN: \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
2094#####################################################################
2095"
2096
2097configure_function() {
2098 addgroup --quiet debian-tor 2>/dev/null || true
2099
2100 ## Add user "user" to the group "debian-tor", so user "user" can access Tor's control port.
2101 ## User "user" already exists thanks to the anon-base-files package.
2102 addgroup --quiet user debian-tor
2103
2104 ## force-reload Tor, if running.
2105 service_tor_status_exit_code="0"
2106 systemctl --no-pager --no-block status tor@default >/dev/null 2>&1 || { service_tor_status_exit_code="\$?" ; true; };
2107 if [ "\$service_tor_status_exit_code" = "0" ]; then
2108 ## || true to avoid an error in case Tor's init script has been
2109 ## chmodded -x in meanwhile or in case the original config is erroneous.
2110 systemctl --no-pager --no-block force-reload tor@default || true
2111 fi
2112}
2113
2114case "\$1" in
2115 configure)
2116 true "INFO: Configuring \$DPKG_MAINTSCRIPT_PACKAGE..."
2117
2118 configure_function
2119
2120 true "INFO: End configuring \$DPKG_MAINTSCRIPT_PACKAGE."
2121
2122 ;;
2123
2124 *)
2125 ;;
2126esac
2127
2128true "INFO: debhelper beginning here."
2129
2130#DEBHELPER#
2131
2132true "INFO: Done with debhelper."
2133
2134true "
2135#####################################################################
2136## INFO: END : \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
2137#####################################################################
2138"
2139
2140## Explicitly "exit 0", so eventually trapped errors can be ignored.
2141exit 0
2142EOF
2143chmod 755 anon-gw-anonymizer-config.postinst
2144./anon-gw-anonymizer-config.postinst configure
2145
2146### ETC
2147
2148mv /etc/apparmor.d/local/system_tor /etc/apparmor.d/local/system_tor.bk
2149cat << EOF > /etc/apparmor.d/local/system_tor
2150## This file is part of Whonix.
2151## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2152## See the file COPYING for copying conditions.
2153
2154## Begin Tor Local AppArmor Profile for Anonymity Distributions
2155
2156## Workaround for: config-package-dev clashes with AppArmor profiles
2157## https://github.com/Whonix/Whonix/issues/66
2158
2159## A profile /etc/apparmor.d/anondist could not cover the system_tor
2160## profile, since that is enforced by the Tor systemd unit file.
2161## https://github.com/Whonix/Whonix/issues/67
2162
2163 ## Anonymity Distributions
2164 /etc/hosts.anondist r,
2165 /etc/resolv.conf.anondist r,
2166 /run/tor r,
2167 /run/tor/log rwk,
2168
2169## Add permissions for obfsproxy and flashproxy.
2170## AUDIT:
2171## These profile rules may be too permissive. Needs audit and someone dedicated
2172## to work on AppArmor profiles. It's not a serious security issue in any case,
2173## because AppArmor isn't enabled by default in Debian stretch yet and little
2174## work is being done on it at time of writing. So it's a lax AppArmor profile
2175## versus no AppArmor at all.
2176
2177 ## obfsproxy
2178 /usr/local/lib/python*/** r,
2179 /var/log/tor/log rw,
2180 /dev/urandom r,
2181 /dev/random r,
2182 /usr/** r,
2183 /etc/python*/sitecustomize.py r,
2184 ## https://forums.whonix.org/t/after-last-apt-get-upgrade-gateway-doesnt-connect-to-tor-anymore
2185 #/usr/bin/obfsproxy rix,
2186
2187 ## flashproxy
2188 @{HOME}/.tb/tor-browser/App/flashproxy-client rix,
2189 @{HOME}/.tb/tor-browser/App/flashproxy-reg-appspot rix,
2190 @{HOME}/.tb/tor-browser/App/flashproxy-reg-url rix,
2191 @{HOME}/.tb/tor-browser/App/flashproxy-reg-http rix,
2192 @{HOME}/.tb/tor-browser/App/flashproxy-reg-email rix,
2193 @{HOME}/.tb/tor-browser/App/** rm,
2194 /usr/bin/python* rix,
2195 /usr/lib/python*/dist-packages/** m,
2196 /usr/lib/python*/lib-dynload/** m,
2197 /usr/lib/pyshared/python*/OpenSSL/** m,
2198 /usr/lib/python*/lib-dynload/** m,
2199 /usr/lib/pyshared/python*/numpy/** m,
2200 /proc/*/mounts r,
2201
2202## End Tor Local AppArmor Profile for Anonymity Distributions
2203EOF
2204
2205mv /etc/apparmor.d/local/usr.bin.obfsproxy /etc/apparmor.d/local/usr.bin.obfsproxy.bk
2206cat << EOF > /etc/apparmor.d/local/usr.bin.obfsproxy
2207 # Qubes-Whonix.
2208 /rw/usrlocal/lib/python*/dist-packages/ r,
2209
2210 /var/lib/tor/pt_state/ rwk,
2211 /var/lib/tor/pt_state/scramblesuit/ rwk,
2212 /var/lib/tor/pt_state/scramblesuit/* rwk,
2213EOF
2214
2215cat << EOF > /etc/audit/rules.d/30_anon-gw-anonymizer-config.rules
2216## This file is part of Whonix.
2217## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2218## See the file COPYING for copying conditions.
2219
2220-w /var/lib/tor/lock -p wxa
2221EOF
2222
2223mv /etc/default/tor /etc/default/tor.bk
2224cat << EOF > /etc/default/tor
2225# Defaults for tor initscript
2226# sourced by /etc/init.d/tor
2227# installed at /etc/default/tor by the maintainer scripts
2228
2229#
2230# This is a bash shell fragment
2231#
2232RUN_DAEMON="yes"
2233
2234#
2235# Servers sometimes may need more than the default 1024 file descriptors
2236# if they are very busy and have many clients connected to them. The top
2237# servers as of early 2008 regularly have more than 10000 connected
2238# clients.
2239# (ulimit -n)
2240#
2241# (the default varies as it depends on the number of available system-wide file
2242# descriptors. See the init script in /etc/init.d/tor for details.)
2243#
2244# MAX_FILEDESCRIPTORS=
2245
2246#
2247# If tor is seriously hogging your CPU, taking away too much cycles from
2248# other system resources, then you can renice tor. See nice(1) for a
2249# bit more information. Another way to limit the CPU usage of an Onion
2250# Router is to set a lower BandwidthRate, as CPU usage is mostly a function
2251# of the amount of traffic flowing through your node. Consult the torrc(5)
2252# manual page for more information on setting BandwidthRate.
2253#
2254# NICE="--nicelevel 5"
2255
2256# Additional arguments to pass on tor's command line.
2257#
2258# ARGS="\$ARGS "
2259
2260#
2261# Uncomment the ulimit call below, and set "DisableDebuggerAttachment 0"
2262# in /etc/tor/torrc, if you want tor to produce coredumps on segfaults
2263# and assert errors.
2264#
2265# Keeping coredumps around is some sort of security issue since they
2266# may leak session keys, sensitive client data and more, should such
2267# files fall into the wrong hands. Therefore coredumps are not enabled
2268# by default.
2269#
2270# ulimit -c unlimited
2271
2272#
2273# Config option for the weekly cron file: Whether or not to remove old
2274# coredumps in /var/lib/tor. Coredumps can hold sensitive data, as such
2275# they probably should not be kept lying around if nobody will ever look
2276# at them. This option makes /etc/cron.weekly/tor clean out files older
2277# then three weeks.
2278#
2279CLEANUP_OLD_COREFILES=y
2280
2281#
2282# By default the tor init script will launch Tor using apparmor iff
2283# /usr/sbin/aa-status exists and is executable and calling it with --enabled
2284# returns true, /usr/sbin/aa-exec is executable, there is a
2285# /etc/apparmor.d/system_tor policy, and USE_AA_EXEC is set to 'yes'.
2286#
2287# USE_AA_EXEC="yes" # default
2288# USE_AA_EXEC="no"
2289
2290# Let the vidalia package override some of our settings.
2291# People who have vidalia installed might not want to run Tor as a system
2292# service. The vidalia .deb can ask them that and then set run-daemon to no.
2293if [ -e /etc/default/tor.vidalia ] && [ -x /usr/bin/vidalia ]; then
2294 . /etc/default/tor.vidalia
2295fi
2296
2297# Begin of modifications for Anonymity Distributions.
2298
2299## Must be "." rather than "source". Even though /etc/init.d/tor is a bash
2300## script, /etc/cron.weekly/tor is an sh script, which sources this script.
2301. /usr/lib/anon-shared-helper-scripts/torsocks-remove-ld-preload
2302
2303# End of modifications for Anonymity Distributions.
2304EOF
2305
2306cat << EOF > /etc/sudoers.d/anonymizer-config-gateway
2307## This file is part of Whonix.
2308## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2309## See the file COPYING for copying conditions.
2310
2311## Required for Tor restart and reload desktop icons.
2312%sudo ALL=NOPASSWD: /usr/sbin/service tor restart
2313%sudo ALL=NOPASSWD: /usr/sbin/service tor reload
2314%sudo ALL=NOPASSWD: /usr/sbin/service tor status
2315%sudo ALL=NOPASSWD: /usr/sbin/service tor@default restart
2316%sudo ALL=NOPASSWD: /usr/sbin/service tor@default reload
2317%sudo ALL=NOPASSWD: /usr/sbin/service tor@default status
2318EOF
2319
2320cat << EOF > /etc/sysctl.d/anonymizer-config-gateway.conf
2321## This file is part of Whonix.
2322## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2323## See the file COPYING for copying conditions.
2324
2325## Raising fs.file-max to 100000 as suggested by /etc/init.d/tor.
2326fs.file-max=100000
2327EOF
2328
2329mv /etc/tor/torrc /etc/tor/torrc.bk
2330cat << EOF > /etc/tor/torrc
2331# This file is part of Whonix
2332# Copyright (C) 2012 - 2013 adrelanos <adrelanos at riseup dot net>
2333# See the file COPYING for copying conditions.
2334
2335# Use this file for your user customizations.
2336# Please see /etc/tor/torrc.examples for help, options, comments etc.
2337
2338# Anything here will override Whonix's own Tor config customizations in
2339# /usr/share/tor/tor-service-defaults-torrc
2340
2341# Enable Tor through whonixsetup or manually uncomment "DisableNetwork 0" by
2342# removing the # in front of it.
2343DisableNetwork 0
2344
2345## Proxy
2346 #Socks4Proxy 127.0.0.1:1080
2347 #Socks5Proxy 127.0.0.1:1080
2348 ## https://www.socks-proxy.net/
2349 ## https://hidemy.name/en/proxy-list/?type=45&anon=34#list
2350 Socks5Proxy 37.191.199.121:45554 ##
2351
2352 #Socks5ProxyUsername <username>
2353 #Socks5ProxyPassword <password>
2354
2355 #HTTPSProxy 127.0.0.1:9666
2356 #HTTPSProxyAuthenticator <username>:<password>
2357
2358 #SOCKSPolicy accept 192.168.0.0/16
2359 #SOCKSPolicy accept6 FC00::/7
2360 #SOCKSPolicy reject *
2361
2362##
2363 ClientOnly 1
2364 ControlPort 9051
2365 HardwareAccel 1
2366
2367## Use hardware accaleration when possible for crypto
2368 HardwareAccel 1
2369
2370## Socket safety hacks
2371 TestSocks 1
2372 WarnUnsafeSocks 1 # Deprecated
2373 AllowNonRFC953Hostnames 0
2374 AllowDotExit 0 # Deprecated
2375 WarnPlaintextPorts 23,109,110,143,80
2376
2377## for DNS
2378 #AutomapHostsSuffixes .onion,.exit
2379 #AutomapHostsOnResolve 1
2380
2381## DNS safety hacks
2382 ClientRejectInternalAddresses 1
2383
2384## Circuit hacks
2385 NewCircuitPeriod 40
2386 MaxCircuitDirtiness 600
2387 MaxClientCircuitsPending 48
2388 UseEntryGuards 1
2389 UseEntryGuardsAsDirGuards 1
2390 EnforceDistinctSubnets 1
2391
2392## One exit node for sites. not random.
2393 #TrackHostExits .facebook.com,.facebook.net,.twitter.com,.fbcdn.com,.fbcdn.net,.akamaihd.com,.google.com,.google.it,.google.fr,.google.de,.google.br,.yandex.ru,.yandex.com,.gmail.com,.googleapis.com,.gstatic.com,.adform.net,.google-analitics.com,.googletagservices.com
2394 ExcludeNodes {US},{FR},{GB}
2395 #ExcludeNodes {US},{FR},{UK},{GB} ## ClientOption
2396 #ExitNodes 217.115.10.132,217.115.10.131,{KP},{AF},{DZ},{CU},{GM},{HT},{IS},{MR},{NG},{RU},{VN},{SO}
2397 #ExitNodes {KP},{AF},{DZ},{CU},{GM},{HT},{IS},{MR},{NG},{RU},{VN},{SO}
2398 #StrictNodes 1
2399
2400## Not Use with Bridges
2401 Sandbox 1
2402
2403## BRIDGES
2404 #UseBridges 1
2405
2406## meek configuration
2407 #ClientTransportPlugin meek exec ./PluggableTransports/meek-client-torbrowser -- ./PluggableTransports/meek-client
2408#
2409 #Bridge meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com
2410#
2411 #Bridge meek 0.0.2.0:3 A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 url=https://az786092.vo.msecnd.net/ front=ajax.aspnetcdn.com
2412
2413## fteproxy configuration
2414 #ClientTransportPlugin fte exec ./PluggableTransports/fteproxy.bin --managed
2415#
2416 #Bridge fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42
2417 #Bridge fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B
2418 #Bridge fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D
2419 #Bridge fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9
2420## https://bridges.torproject.org/options
2421## https://bridges.torproject.org/bridges?transport=fte
2422 #Bridge fte 37.218.246.134:36546 10ED7FB38D5F224F2B4760FCCC009BA11D17278A
2423 #Bridge fte 37.218.246.198:45579 4E92563FB937995CD036AD4FB6215BCDF6F38440
2424
2425## obfs4proxy configuration
2426 #ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec ./PluggableTransports/obfs4proxy
2427 #ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed
2428 #ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed
2429#
2430## https://bridges.torproject.org/options
2431## https://bridges.torproject.org/bridges
2432 #Bridge 79.46.175.64:443 222266A2BAEBB42CA6F9C9F0B29747EEFB80C9DA
2433 #Bridge 106.186.20.12:8443 14840EBC896A8EFCB034FA44781A8F5505EA0E61
2434 #Bridge 209.177.151.163:443 1CEBCFBD7B8ABC5911A61B2D442E748086F82A82
2435 #Bridge 125.24.140.206:443 BBD6B1B86E78914A8FFA54ACA63150B8C47A3029
2436 #Bridge 64.147.119.12:9001 9A40E168CA4773ADFEF8ACCA9E31606CF173B5B8
2437 #Bridge 97.95.175.2:9001 09CC9DBE760FB9786EBE588E726DA29DAB1C673C
2438#
2439 #Bridge obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0
2440 #Bridge obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0
2441 #Bridge obfs4 154.35.22.11:443 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0
2442 #Bridge obfs4 154.35.22.10:2934 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0
2443 #Bridge obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0
2444 #Bridge obfs4 154.35.22.9:5881 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0
2445 #Bridge obfs4 154.35.22.11:2413 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0
2446 #Bridge obfs4 154.35.22.13:4319 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0
2447 #Bridge obfs4 154.35.22.9:80 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0
2448 #Bridge obfs4 192.99.11.54:443 7B126FAB960E5AC6A629C729434FF84FB5074EC2 cert=VW5f8+IBUWpPFxF+rsiVy2wXkyTQG7vEd+rHeN2jV5LIDNu8wMNEOqZXPwHdwMVEBdqXEw iat-mode=0
2449 #Bridge obfs4 154.35.22.9:443 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0
2450 #Bridge obfs4 154.35.22.10:80 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0
2451 #Bridge obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0
2452 #Bridge obfs4 154.35.22.11:80 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0
2453 #Bridge obfs4 154.35.22.12:1894 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0
2454 #Bridge obfs4 154.35.22.10:443 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0
2455 #Bridge obfs4 83.212.101.3:50000 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0
2456 #Bridge obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=0
2457## https://bridges.torproject.org/options
2458## https://bridges.torproject.org/bridges?transport=obfs4
2459 #Bridge obfs4 178.62.219.37:9443 2A76D323DC6F7EDC9B9BC15E022E9A4D72410E8F cert=EiVi3teqXiF1/akTZl8jsrMezQTKN/vRBHkgxPv/wOLBWukRjWOUojTxKIZHPFFMzeRfTw iat-mode=0
2460 #Bridge obfs4 37.218.246.134:60028 10ED7FB38D5F224F2B4760FCCC009BA11D17278A cert=npziPX9jxOm0Gw35xof7cb+9qZEtzkwEutdKOVhMqvvl94CoeX0KjmIYTkgtb7OwFlhLNg iat-mode=0
2461 #Bridge obfs4 109.74.198.252:37771 8167F225405BFA71633BD2BC5B8599A1A827FCF3 cert=8fKTclguLI6vuDNrlTRrVj46v23NYQTs2TUApIpnay52HUUB+qFxUzGi3mkj+tL9o+SCZw iat-mode=0
2462#
2463 #Bridge scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH
2464## https://bridges.torproject.org/options
2465## https://bridges.torproject.org/bridges?transport=scramblesuit
2466 #Bridge scramblesuit 64.137.204.112:50979 C8D4451169070A8973C80A3FFCB733ED9CA9D080 password=HXJVU5B2EEEXRBMI4QOJCLAPRI4SJFZM
2467 #Bridge scramblesuit 37.218.246.134:44659 10ED7FB38D5F224F2B4760FCCC009BA11D17278A password=GEDAJW4QAWKN3TYSJJNUFUZHBOCW25C3
2468 #Bridge scramblesuit 194.132.208.190:35643 C36B0EDDAA5209D6D86052F74991B9AB4B68CCFE password=KHZGFRQ4HMK6CDTL2S5522JDDRJBP7HV
2469
2470 #Bridge websocket 0.0.1.0:1
2471#
2472## Change the second number here (9000) to the number of a port that can
2473## receive connections from the Internet (the port for which you
2474## configured port forwarding).
2475 #ClientTransportPlugin websocket exec ./PluggableTransports/<flashproxy-client> --register :0 :9000
2476
2477## Hiden Services
2478 HiddenServiceStatistics 0
2479 #HiddenServiceDir /var/lib/tor/ ## HiddenServiceOption
2480 #HiddenServiceDir <torfolder>/HServ/ ## HiddenServiceOption
2481#
2482## Port Range - Default
2483 #HiddenServicePort 21 127.0.0.1:21
2484 #HiddenServicePort 22 127.0.0.1:22
2485 #HiddenServicePort 23 127.0.0.1:23
2486 #HiddenServicePort 80 127.0.0.1:80
2487 #HiddenServicePort 443 127.0.0.1:443
2488 #HiddenServicePort 3306 127.0.0.1:3306
2489 #HiddenServicePort 8080 127.0.0.1:8080
2490 #HiddenServicePort 10000 127.0.0.1:10000
2491#
2492## Port Range - User
2493 #HiddenServicePort 4440 127.0.0.1:4440
2494 #HiddenServicePort 4441 127.0.0.1:4441
2495 #HiddenServicePort 4442 127.0.0.1:4442
2496 #HiddenServicePort 4443 127.0.0.1:4443
2497 #HiddenServicePort 4444 127.0.0.1:4444
2498 #HiddenServicePort 4445 127.0.0.1:4445
2499 #HiddenServicePort 4446 127.0.0.1:4446
2500 #HiddenServicePort 4447 127.0.0.1:4447
2501 #HiddenServicePort 4448 127.0.0.1:4448
2502 #HiddenServicePort 4449 127.0.0.1:4449
2503EOF
2504
2505cat << EOF > /etc/tor/torrc.examples
2506This file is part of Whonix
2507Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2508See the file COPYING for copying conditions.
2509
2510 **** Do NOT edit this file! ****
2511
2512This file will show you examples you can copy and paste to /etc/tor/torrc
2513
2514Additionally, you can read the official Tor Manual at:
2515https://www.torproject.org/docs/tor-manual.html.en
2516
2517 **** Do NOT edit this file! ****
2518
2519Contents
2520========
2521
2522 - Bridges
2523 - Firewall
2524 - Proxy
2525 - Hidden Services
2526
2527
2528Bridges
2529=======
2530
2531 Less sophisticated censors prevent users from accessing
2532 the Tor network by blocking connections to known relays.
2533 "Bridge relays" help these users access Tor by not being
2534 in the same public lists as normal relays.
2535
2536 Sophisticated censors can only be circumvented with
2537 private obfuscated bridges.
2538
2539 Because there is NOT a 100% way to hide Tor, Whonix does
2540 NOT recommend using Tor if you fear detection.
2541
2542 Finding Public Bridges
2543 ----------------------
2544
2545 https://bridges.torproject.org/bridges
2546
2547 If you can not reach the URL, send an email (from a
2548 gmail.com or yahoo.com account only) to
2549 bridges@torproject.org with "get bridges" in the
2550 message body.
2551
2552 Private Obfuscated Bridges
2553 --------------------------
2554
2555 A sophisticated user you trust -- outside the reach of
2556 the censors but accessible from your location -- must
2557 run a bridge service configured with obfsproxy (to
2558 help avoid detection) and the option
2559 "PublishServerDescriptor 0" (to not be listed by The
2560 Tor Project). However, since even private obfuscated
2561 bridges can ultimately be detected, Whonix does NOT
2562 recommend using bridges if you fear detection.
2563
2564 To use bridges, copy the two lines below and paste
2565 them into /etc/tor/torrc
2566
2567UseBridges 1
2568ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed
2569ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed
2570
2571 You must also add the IPs for your bridges. The
2572 following lines are an example of how it should look:
2573
2574bridge 23.22.110.133:443
2575bridge 24.22.1.54:443
2576bridge obfs2 209.176.111.47:42105
2577bridge obfs3 199.241.31.96:12873
2578bridge obfs4 141.201.27.48:420 gibberish cert=more-gibberish iat-mode=0
2579
2580
2581Firewall
2582========
2583
2584 The option ReachableAddresses ADDR[/MASK][:PORT]
2585 restricts the ports and IPs that Tor attempts to connect
2586 through. Study the examples below.
2587
2588 If your firewall blocks all ports but 80 and 443, copy the
2589 two lines below into /etc/tor/torrc
2590
2591ReachableAddresses accept *:80
2592ReachableAddresses accept *:443
2593
2594 If your firewall allows connections to everything inside
2595 net 99, rejects port 80 inside net 18, but otherwise
2596 accepts connections to port 80:
2597
2598ReachableAddresses 99.0.0.0/8
2599ReachableAddresses reject 18.0.0.0/8:80
2600ReachableAddresses accept *:80
2601
2602
2603Proxy
2604=====
2605
2606 If you use an HTTP, SOCKS 4, or SOCKS 5 proxy to connect to
2607 the internet, study the examples below and configure
2608 /etc/tor/torrc accordingly.
2609
2610 Note, you need to use the IP instead of the hostname
2611 (proxy.example.com). This may result in subtle differences
2612 your proxy may detect. See also Whonix documentation:
2613 https://www.whonix.org/wiki/Tunnel_Tor_through_proxy_or_VPN_or_SSH#Tunnel_Tor_through_proxy
2614
2615
2616 HTTP Proxy
2617 ----------
2618 If you use an HTTP proxy at 192.168.1.44 via port 443
2619
2620HTTPSProxy 192.168.1.44:443
2621
2622 If it requires a username and password
2623
2624HTTPSProxyAuthenticator username:password
2625
2626
2627 SOCKS 4
2628 -------
2629 To use a SOCKS 4 proxy at 10.0.1.3 via port 1080
2630
2631Socks4Proxy 10.0.1.3:1080
2632
2633
2634 SOCKS 5
2635 -------
2636 To use a SOCKS 5 proxy at 172.1.3.3 via port 1080
2637
2638Socks5Proxy 172.1.3.3:1080
2639
2640 If it requires a username and password
2641
2642Socks5ProxyUsername username
2643Socks5ProxyPassword password
2644
2645
2646Hidden Services
2647===============
2648
2649 To make a service on Whonix-Workstation accessible over
2650 Tor, you must assign a directory and port for it inside
2651 Whonix-Gateway's /etc/tor/torrc. Below are examples that
2652 you can copy to /etc/tor/torrc
2653
2654 For a longer tutorial, see:
2655 https://www.whonix.org/wiki/Hidden_Services
2656
2657
2658 Web Server
2659 ----------
2660
2661 If a web server is running in Whonix-Workstation, add
2662 the next two lines to /etc/tor/torrc to make it
2663 accessible to others.
2664
2665HiddenServiceDir /var/lib/tor/webserver/
2666HiddenServicePort 80 10.152.152.11:80
2667
2668 Find the .onion address for this service:
2669 sudo cat /var/lib/tor/webserver/hostname
2670 Backup /var/lib/tor/webserver/private_key
2671
2672
2673 TorChat
2674 -------
2675
2676HiddenServiceDir /var/lib/tor/torchat/
2677HiddenServicePort 11009 10.152.152.11:11009
2678
2679 Find the .onion address for this service:
2680 sudo cat /var/lib/tor/torchat/hostname
2681 Backup /var/lib/tor/torchat/private_key
2682
2683
2684 Mumble Server
2685 -------------
2686
2687HiddenServiceDir /var/lib/tor/mumble/
2688HiddenServicePort 80 10.152.152.11:80
2689
2690 Find the .onion address for this service:
2691 sudo cat /var/lib/tor/mumble/hostname
2692 Backup /var/lib/tor/mumble/private_key
2693EOF
2694
2695### USR
2696
2697cat << EOF > /usr/bin/anon-info
2698#!/bin/bash
2699
2700## This file is part of Whonix.
2701## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2702## See the file COPYING for copying conditions.
2703
2704if [ ! -e /etc/apt/sources.list.d/torproject.list ]; then
2705 echo "INFO: /etc/apt/sources.list.d/torproject.list does not exist."
2706else
2707 uncommented_lines="\$(cat /etc/apt/sources.list.d/torproject.list | grep -v '#' | grep deb)"
2708 echo "INFO: /etc/apt/sources.list.d/torproject.list uncommented lines:
2709\$uncommented_lines"
2710fi
2711
2712tor_version="\$(dpkg-query --show --showformat='\${Version}' "tor")"
2713echo "INFO: version of the 'tor' package: \$tor_version"
2714EOF
2715chmod 777 /usr/bin/anon-info
2716
2717mkdir -p /usr/lib/gateway-shortcuts
2718cat << EOF > /usr/lib/gateway-shortcuts/arm
2719#!/bin/bash
2720
2721## This file is part of Whonix.
2722## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2723## See the file COPYING for copying conditions.
2724
2725set -x
2726
2727cat /etc/motd
2728
2729arm
2730
2731true "Feel free to close this window."
2732
2733sleep 86400
2734EOF
2735chmod 777 /usr/lib/gateway-shortcuts/arm
2736
2737cat << EOF > /usr/lib/gateway-shortcuts/reloadtor
2738#!/bin/bash
2739
2740## This file is part of Whonix.
2741## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2742## See the file COPYING for copying conditions.
2743
2744set -x
2745
2746cat /etc/motd
2747
2748sudo service tor@default reload
2749
2750sudo service tor@default status
2751true "\$?"
2752
2753true "Feel free to close this window."
2754
2755sleep 86400
2756EOF
2757chmod 777 /usr/lib/gateway-shortcuts/reloadtor
2758
2759cat << EOF > /usr/lib/gateway-shortcuts/restarttor
2760#!/bin/bash
2761
2762## This file is part of Whonix.
2763## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2764## See the file COPYING for copying conditions.
2765
2766set -x
2767
2768cat /etc/motd
2769
2770sudo service tor@default restart
2771
2772sudo service tor@default status
2773
2774true "\$?"
2775
2776true "Feel free to close this window."
2777
2778sleep 86400
2779EOF
2780chmod 777 /usr/lib/gateway-shortcuts/restarttor
2781
2782cat << EOF > /usr/lib/gateway-shortcuts/stoptor
2783#!/bin/bash
2784
2785## This file is part of Whonix.
2786## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2787## See the file COPYING for copying conditions.
2788
2789set -x
2790
2791cat /etc/motd
2792
2793sudo service tor@default stop
2794
2795sudo service tor@default status
2796true "\$?"
2797
2798true "Feel free to close this window."
2799
2800sleep 86400
2801EOF
2802chmod 777 /usr/lib/gateway-shortcuts/stoptor
2803
2804cat << EOF > /usr/lib/gateway-shortcuts/tordata
2805#!/bin/bash
2806
2807## This file is part of Whonix.
2808## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2809## See the file COPYING for copying conditions.
2810
2811set -x
2812
2813kdesudo dolphin /var/lib/tor
2814EOF
2815chmod 777 /usr/lib/gateway-shortcuts/tordata
2816
2817cat << EOF > /usr/lib/gateway-shortcuts/torrc
2818#!/bin/bash
2819
2820## This file is part of Whonix.
2821## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2822## See the file COPYING for copying conditions.
2823
2824set -x
2825
2826kdesudo kwrite /etc/tor/torrc
2827EOF
2828chmod 777 /usr/lib/gateway-shortcuts/torrc
2829
2830cat << EOF > /usr/lib/gateway-shortcuts/torrcexamples
2831#!/bin/bash
2832
2833## This file is part of Whonix.
2834## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2835## See the file COPYING for copying conditions.
2836
2837set -x
2838
2839kwrite /etc/tor/torrc.examples
2840EOF
2841chmod 777 /usr/lib/gateway-shortcuts/torrcexamples
2842
2843cat << EOF > /usr/lib/gateway-shortcuts/wrapper
2844#!/bin/bash
2845
2846## This file is part of Whonix.
2847## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2848## See the file COPYING for copying conditions.
2849
2850set -x
2851set -e
2852
2853if command -v qubesdb-read ; then
2854 konsole -e "\$@"
2855else
2856 konsole --fullscreen -e "\$@"
2857fi
2858EOF
2859chmod 777 /usr/lib/gateway-shortcuts/wrapper
2860
2861
2862cat << EOF > /usr/share/applications/gateway-arm.desktop
2863## This file is part of Whonix.
2864## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2865## See the file COPYING for copying conditions.
2866
2867[Desktop Entry]
2868Type=Application
2869Exec=/usr/lib/gateway-shortcuts/wrapper /usr/lib/gateway-shortcuts/arm
2870Name=Arm - Tor Controller
2871GenericName=anonymizing relay monitor (arm)
2872Comment=anonymizing relay monitor (arm)
2873Categories=System
2874Icon=/usr/share/icons/anon-icon-pack/arm.ico
2875Keywords=system;tor;controller;Arm;
2876EOF
2877chmod 777 /usr/share/applications/gateway-arm.desktop
2878
2879cat << EOF > /usr/share/applications/gateway-reloadtor.desktop
2880## This file is part of Whonix.
2881## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2882## See the file COPYING for copying conditions.
2883
2884[Desktop Entry]
2885Type=Application
2886Exec=/usr/lib/gateway-shortcuts/wrapper /usr/lib/gateway-shortcuts/reloadtor
2887Name=Reload Tor
2888GenericName=Reload Tor
2889Comment=Reload Tor using "sudo service tor@default reload"
2890Categories=System
2891Icon=/usr/share/icons/anon-icon-pack/power_restart.ico
2892Keywords=system;tor;
2893EOF
2894chmod 777 /usr/share/applications/gateway-reloadtor.desktop
2895
2896cat << EOF > /usr/share/applications/gateway-restarttor.desktop
2897## This file is part of Whonix.
2898## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2899## See the file COPYING for copying conditions.
2900
2901[Desktop Entry]
2902Type=Application
2903Exec=/usr/lib/gateway-shortcuts/wrapper /usr/lib/gateway-shortcuts/restarttor
2904Name=Restart Tor
2905GenericName=Restart Tor
2906Comment=Shut down Tor and start Tor again using "sudo service tor@default restart"
2907Categories=System
2908Icon=/usr/share/icons/anon-icon-pack/restart.ico
2909Keywords=system;tor;
2910EOF
2911chmod 777 /usr/share/applications/gateway-restarttor.desktop
2912
2913cat << EOF > /usr/share/applications/gateway-stoptor.desktop
2914## This file is part of Whonix.
2915## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2916## See the file COPYING for copying conditions.
2917
2918[Desktop Entry]
2919Type=Application
2920Exec=/usr/lib/gateway-shortcuts/wrapper /usr/lib/gateway-shortcuts/stoptor
2921Name=Stop Tor
2922GenericName=Stop Tor
2923Comment=Stop Tor using "sudo service tor@default stop"
2924Categories=System
2925Icon=/usr/share/icons/anon-icon-pack/Saki-NuoveXT-2-Actions-stop.ico
2926Keywords=system;tor;
2927EOF
2928chmod 777 /usr/share/applications/gateway-stoptor.desktop
2929
2930cat << EOF > /usr/share/applications/gateway-tordata.desktop
2931## This file is part of Whonix.
2932## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2933## See the file COPYING for copying conditions.
2934
2935[Desktop Entry]
2936Type=Application
2937Exec=/usr/lib/gateway-shortcuts/tordata
2938Name=Tor Data
2939GenericName=Tor Data
2940Comment=Open /var/lib/tor folder in dolphin
2941Categories=System
2942Icon=/usr/share/icons/oxygen/64x64/places/folder-green.png
2943Keywords=system;tor;
2944EOF
2945chmod 777 /usr/share/applications/gateway-tordata.desktop
2946
2947cat << EOF > /usr/share/applications/gateway-torrcexamples.desktop
2948## This file is part of Whonix.
2949## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2950## See the file COPYING for copying conditions.
2951
2952[Desktop Entry]
2953Type=Application
2954Exec=/usr/lib/gateway-shortcuts/torrcexamples
2955Name=Tor Examples
2956GenericName=/etc/tor/torrc.examples
2957Comment=Open /etc/tor/torrc.examples in kwrite as read-only
2958Categories=System
2959Icon=/usr/share/icons/anon-icon-pack/text_x_makefile.ico
2960Keywords=system;tor;
2961EOF
2962chmod 777 /usr/share/applications/gateway-torrcexamples.desktop
2963
2964cat << EOF > /usr/share/applications/gateway-torrc.desktop
2965## This file is part of Whonix.
2966## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2967## See the file COPYING for copying conditions.
2968
2969[Desktop Entry]
2970Type=Application
2971Exec=/usr/lib/gateway-shortcuts/torrc
2972Name=Tor User Config
2973GenericName=Torrc
2974Comment=Open /etc/tor/torrc configuration file in kwrite
2975Categories=System
2976Icon=/usr/share/icons/anon-icon-pack/text_x_makefile.ico
2977Keywords=system;tor;
2978EOF
2979chmod 777 /usr/share/applications/gateway-torrc.desktop
2980
2981cat << EOF > /usr/share/lintian/overrides/anon-gw-anonymizer-config
2982## Debian systemd packaging does not reload daemons yet when drop-ins where added.
2983## Need to use systemctl directly so --no-pager --no-block can be used.
2984anon-gw-anonymizer-config: maintainer-script-calls-systemctl
2985EOF
2986
2987mv /usr/share/tor/tor-service-defaults-torrc /usr/share/tor/tor-service-defaults-torrc.bk
2988cat << EOF > /usr/share/tor/tor-service-defaults-torrc
2989## This file is part of Whonix.
2990## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
2991## See the file COPYING for copying conditions.
2992
2993## Please use "/etc/tor/torrc" for your custom configuration,
2994## which will override the defaults found here. When this package is updated,
2995## this file may be overwritten.
2996
2997## You can find the original upstream tor-service-defaults-torrc under
2998## /usr/share/tor/tor-service-defaults-torrc.anondist-orig
2999
3000######################################################################
3001## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
3002## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
3003## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
3004## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
3005## DO NOT CHANGE ANYTHING BELOW, UNLESS YOU KNOW WHAT YOU ARE DOING! #
3006######################################################################
3007
3008 ###################
3009#### Internals torrc #
3010 ######################################
3011 # Upstream Defaults File #
3012 # Enable / Disable Tor #
3013 # Leak Tests #
3014 # General Settings #
3015 # Workstation Trans/Dns-Port #
3016 # Workstation SocksPorts #
3017 # Gateway Trans/Dns-Port #
3018 # Gateway SocksPorts #
3019 #####################################
3020
3021#########################################
3022## Upstream Defaults File #
3023#########################################
3024
3025## These defaults are taken from /usr/share/tor/tor-service-defaults-torrc
3026## from 'tor' package version 0.2.8.6-1~d80.jessie+1 from deb.torproject.org.
3027
3028DataDirectory /var/lib/tor
3029PidFile /var/run/tor/tor.pid
3030RunAsDaemon 1
3031User debian-tor
3032
3033ControlSocket /var/run/tor/control GroupWritable RelaxDirModeCheck
3034ControlSocketsGroupWritable 1
3035SocksPort unix:/var/run/tor/socks WorldWritable
3036SocksPort 9050
3037
3038CookieAuthentication 1
3039CookieAuthFileGroupReadable 1
3040CookieAuthFile /var/run/tor/control.authcookie
3041
3042#Log notice file /var/log/tor/log
3043Log notice file /var/log/tor/log.sandbox
3044
3045#########################
3046## Enable / Disable Tor #
3047#########################
3048
3049## Tor is disabled by default.
3050## Users are supposed to enable Tor through whonixsetup or manually
3051## removing the # in front of "DisableNetwork 0" in /etc/tor/torrc.
3052DisableNetwork 1
3053
3054#########################################
3055## Leak Tests #
3056#########################################
3057
3058##+# #OptionalFeatureNr.6# Leak Testing.
3059##+#
3060##+# Manual Leak Testing:
3061##+# See Whonix/LeakTests. Activate this while testing for leaks. (Step 0)
3062##+# Deactivate after you are done! (Important!) (Step 9)
3063##+#
3064##+# Scripted Leak Testing:
3065##+# If you change the following two lines, beside removing the hash (#),
3066##+# beside commenting them in, you break the integrated leaktest script.
3067##+# See leaktest_whonix_gateway() ed.
3068##+# See https://www.whonix.org/wiki/Dev/Leak_Tests
3069##+# on information, how to use the integrated leaktest script.
3070#ReachableDirAddresses *:80
3071#ReachableORAddresses *:443
3072#FascistFirewall 1
3073
3074#########################################
3075## General Settings #
3076#########################################
3077
3078Log notice syslog
3079#Log notice file /run/tor/log
3080Log notice file /run/tor/log.sandbox
3081#Log notice file /var/log/tor/log
3082
3083## Not required:
3084#DataDirectory /...
3085#PidFile /...
3086#ControlSocket /...
3087#ControlSocketsGroupWritable 1
3088#CookieAuthentication 1
3089#CookieAuthFileGroupReadable 1
3090#CookieAuthFile /...
3091
3092#########################################
3093## mixmaster remailer #
3094#########################################
3095
3096## REVIEW: Are the virtual IP addresses 1.1.1.1 and 2.2.2.2 appropriate or are different values better?
3097
3098mapaddress 1.1.1.1 k54ids7luh523dbi.onion
3099mapaddress 2.2.2.2 gbhpq7eihle4btsn.onion
3100
3101#########################################
3102## Misc Settings #
3103#########################################
3104
3105VirtualAddrNetwork 10.192.0.0/10
3106AutomapHostsOnResolve 1
3107
3108###############################
3109## Workstation Trans/Dns-Port #
3110###############################
3111
3112## (comment mirrored from /usr/bin/whonix_firewall)
3113## Transparent Proxy Port for Workstation
3114## TRANS_PORT_WORKSTATION="9040"
3115##+# #OptionalFeatureNr.5# Best possible protection against Identity correlation through circuit sharing. ^5^
3116##
3117## TransPort is not used for anything preinstalled by default.
3118## Only as a catch all for user installed applications,
3119## which is documented.
3120##
3121## IsolateDestAddr should not be activated by default,
3122## if people install filesharing software it would be a nightmare if all connections to the massive amount
3123## of destination IP's would go through separate circuits.
3124##
3125## For the same reason IsolateDestPort should not be activated by default, since BitTorrent (in some cases)
3126## uses random ports.
3127TransPort 10.152.152.10:9040
3128
3129## (comment mirrored from /usr/bin/whonix_firewall)
3130## DNS_PORT_WORKSTATION="5300"
3131##+# #OptionalFeatureNr.5# Best possible protection against Identity correlation through circuit sharing. ^5^
3132##
3133## DnsPort is not used for anything preinstalled by default.
3134## Only as a catch all for user installed applications,
3135## which is documented.
3136##
3137## Not listening on port 53 but rather on a port higher than 1024 to avoid
3138## issues with reloading Tor. (Tor drops privileges and is then unable to
3139## create listeners below 1024.)
3140##
3141## Not sure about IsolateDestAddr.
3142## IsolateDestPort has probably very little effect, since most DNS servers listen on port 53.
3143DnsPort 10.152.152.10:5300 IsolateDestPort
3144
3145###########################
3146## Workstation SocksPorts #
3147###########################
3148
3149## (comment mirrored from /usr/bin/whonix_firewall)
3150## Socks Ports for per application circuits.
3151## SOCKS_PORT_TOR_DEFAULT="9050"
3152## SOCKS_PORT_TB="9100"
3153## SOCKS_PORT_IRC="9101"
3154## SOCKS_PORT_TORBIRDY="9102"
3155## SOCKS_PORT_IM="9103"
3156## SOCKS_PORT_APT_GET="9104"
3157## SOCKS_PORT_GPG="9105"
3158## SOCKS_PORT_SSH="9106"
3159## SOCKS_PORT_GIT="9107"
3160## SOCKS_PORT_SDWDATE="9108"
3161## SOCKS_PORT_WGET="9109"
3162## SOCKS_PORT_WHONIXCHECK="9110"
3163## SOCKS_PORT_BITCOIN="9111"
3164## SOCKS_PORT_PRIVOXY="9112"
3165## SOCKS_PORT_POLIPO="9113"
3166## SOCKS_PORT_WHONIX_NEWS="9114"
3167## SOCKS_PORT_TBB_DOWNLOAD="9115"
3168## SOCKS_PORT_TBB_GPG="9116"
3169## SOCKS_PORT_CURL="9117"
3170## SOCKS_PORT_RSS="9118"
3171## SOCKS_PORT_TORCHAT="9119"
3172## SOCKS_PORT_MIXMASTERUPDATE="9120"
3173## SOCKS_PORT_MIXMASTER="9121"
3174## SOCKS_PORT_KDE="9122"
3175## SOCKS_PORT_GNOME="9123"
3176## SOCKS_PORT_APTITUDE="9124"
3177## SOCKS_PORT_YUM="9125"
3178## SOCKS_PORT_TBB_DEFAULT="9150"
3179
3180## Tor Default Port
3181## Only for applications, which expect Tor to be running on port 9050.
3182SocksPort 10.152.152.10:9050
3183
3184## legacy
3185SocksPort 10.152.152.10:9100
3186
3187## IRC: HexChat
3188## People are normally not connected to too many IRC servers,
3189## so they can use one circuit per server.
3190SocksPort 10.152.152.10:9101 IsolateDestAddr IsolateDestPort
3191
3192## Mail: Thunderbird with TorBirdy
3193## Not preinstalled.
3194## Not used by too many people. Most users do not connect to
3195## too many servers.
3196SocksPort 10.152.152.10:9102 IsolateDestAddr IsolateDestPort
3197
3198## Instant Messenger
3199## People are normally not connected to too many IM servers,
3200## so they can use one circuit per server.
3201SocksPort 10.152.152.10:9103 IsolateDestAddr IsolateDestPort
3202
3203## Operating system updates: apt-get
3204## Not using IsolateDestAddr IsolateDestPort, because too much
3205## performance loss, too much load on Tor network and no gain
3206## in security.
3207SocksPort 10.152.152.10:9104
3208
3209## gpg
3210## Not used by too many people. Most users do not connect to
3211## too many servers.
3212SocksPort 10.152.152.10:9105 IsolateDestAddr IsolateDestPort
3213
3214## ssh
3215## Not used by too many people. Most users do not connect to
3216## too many servers.
3217SocksPort 10.152.152.10:9106 IsolateDestAddr IsolateDestPort
3218
3219## git
3220## Not preinstalled.
3221## Not used by too many people. Most users do not connect to
3222## too many servers.
3223SocksPort 10.152.152.10:9107 IsolateDestAddr IsolateDestPort
3224
3225## Network Time Synchronization
3226## There are only three different connections.
3227SocksPort 10.152.152.10:9108 IsolateDestAddr IsolateDestPort
3228
3229## command line downloader: wget
3230## Only manually and by very few applications used. Should not
3231## hurt performance or Tor network. Very few connections are
3232## expected.
3233SocksPort 10.152.152.10:9109 IsolateDestAddr IsolateDestPort
3234
3235## whonixcheck
3236## Only connects to https://check.torproject.org and checks IP
3237## and Tor Browser version.
3238## Only one server and only one port.
3239## Would be fine without IsolateDestAddr IsolateDestPort,
3240## but add it anyway to have less exceptions.
3241SocksPort 10.152.152.10:9110 IsolateDestAddr IsolateDestPort
3242
3243## BitCoin
3244## Not using IsolateDestAddr IsolateDestPort.
3245## Makes too many connections to different servers. Should not
3246## hurt if they get through the same circuit.
3247SocksPort 10.152.152.10:9111
3248
3249## http to socks converter: privoxy
3250## Not in use for anything preinstalled.
3251## Not using IsolateDestAddr IsolateDestPort for the same reasons
3252## as mentioned under Web: Tor Browser.
3253## Only used for Thunderbird with TorBirdy, which is not
3254## preinstalled.
3255SocksPort 10.152.152.10:9112
3256
3257## http to socks converter: polipo
3258## Not in use for anything preinstalled.
3259## Not using IsolateDestAddr IsolateDestPort for the same reasons
3260## as mentioned under Web: Tor Browser.
3261SocksPort 10.152.152.10:9113
3262
3263## Whonix news download
3264## Only connects to the Whonix homepage and downloads a small file with
3265## latest important Whonix news.
3266## Only one server and only one port.
3267## Would be fine without IsolateDestAddr IsolateDestPort,
3268## but add it anyway to have less exceptions.
3269SocksPort 10.152.152.10:9114 IsolateDestAddr IsolateDestPort
3270
3271## Tor Browser bundle download
3272## Rarely used.
3273## Only one server and only one port.
3274## Would be fine without IsolateDestAddr IsolateDestPort,
3275## but add it anyway to have less exceptions.
3276SocksPort 10.152.152.10:9115 IsolateDestAddr IsolateDestPort
3277
3278## Tor Browser gpg public key download
3279## Rarely used.
3280## Only one server and only one port.
3281## Would be fine without IsolateDestAddr IsolateDestPort,
3282## but add it anyway to have less exceptions.
3283SocksPort 10.152.152.10:9116 IsolateDestAddr IsolateDestPort
3284
3285## Curl
3286## Only manually and by very few applications used. Should not
3287## hurt performance or Tor network. Very few connections are
3288## expected.
3289SocksPort 10.152.152.10:9117 IsolateDestAddr IsolateDestPort
3290
3291## RSS
3292## By default only for the Whonix Blog and for the torproject.org blog.
3293## Few users expected to add their own feeds.
3294SocksPort 10.152.152.10:9118 IsolateDestAddr IsolateDestPort
3295
3296## TorChat
3297## Not using IsolateDestAddr or IsolateDestPort, because upstream
3298## TorChat also does not do it. Since it only connects to
3299## hidden services it would perhaps not make a difference anyway.
3300SocksPort 10.152.152.10:9119
3301
3302## mixmaster-update
3303## Few users expected to use it.
3304## Since it only connects to one or very few servers using
3305## IsolateDestAddr IsolateDestPort.
3306SocksPort 10.152.152.10:9120 IsolateDestAddr IsolateDestPort
3307
3308## mixmaster
3309## This port is currently not in use. See Whonix mixmaster integration.
3310## https://www.whonix.org/wiki/Dev/Mixmaster
3311## Few users expected to use it.
3312## Since it only connects to one or very few servers using
3313## IsolateDestAddr IsolateDestPort.
3314SocksPort 10.152.152.10:9121 IsolateDestAddr IsolateDestPort
3315
3316## KDE application wide proxy.
3317## Not using IsolateDestAddr or IsolateDestPort, because also browsers
3318## could use this port.
3319SocksPort 10.152.152.10:9122
3320
3321## GNOME application wide proxy.
3322## This port is currently not in use.
3323## Not using IsolateDestAddr or IsolateDestPort, because also browsers
3324## could use this port.
3325SocksPort 10.152.152.10:9123
3326
3327## Operating system updates: aptitude
3328## Not using IsolateDestAddr IsolateDestPort, because too much
3329## performance loss, too much load on Tor network and no gain
3330## in security.
3331SocksPort 10.152.152.10:9124
3332
3333## Operating system updates: yum
3334## Not using IsolateDestAddr IsolateDestPort, because too much
3335## performance loss, too much load on Tor network and no gain
3336## in security.
3337SocksPort 10.152.152.10:9125
3338
3339## Tor Browser Bundle Default Port
3340## This port gets used if someone uses the default Tor Browser Bundle.
3341## (anon-ws-disable-stacked-tor runs on Workstation and forwards connections from
3342## 127.0.0.1:9150 to 10.152.152.10:9150.)
3343## Not using IsolateDestAddr IsolateDestPort, because too much
3344## performance loss, too much load on Tor network and not secure.
3345## Instead Tor Browser sets SOCKS username for a request based on first party domain.
3346## https://trac.torproject.org/projects/tor/ticket/3455
3347SocksPort 10.152.152.10:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth
3348
3349## Tor Messenger's default port
3350## This port gets used if someone uses the default Tor Messenger.
3351## (anon-ws-disable-stacked-tor runs on Workstation and forwards connections from
3352## 127.0.0.1:9152 to 10.152.152.10:9152.)
3353SocksPort 10.152.152.10:9152 IsolateDestAddr IsolateDestPort
3354
3355##+# #OptionalFeatureNr.4# More Socks Ports.
3356## Custom Ports #1:
3357## without IsolateDestAddr
3358## without IsolateDestPort
3359SocksPort 10.152.152.10:9153
3360SocksPort 10.152.152.10:9154
3361SocksPort 10.152.152.10:9155
3362SocksPort 10.152.152.10:9156
3363SocksPort 10.152.152.10:9157
3364SocksPort 10.152.152.10:9158
3365SocksPort 10.152.152.10:9159
3366
3367##+# #OptionalFeatureNr.4# More Socks Ports.
3368## Custom Ports #2:
3369## with IsolateDestAddr
3370## without IsolateDestPort
3371SocksPort 10.152.152.10:9160 IsolateDestAddr
3372SocksPort 10.152.152.10:9161 IsolateDestAddr
3373SocksPort 10.152.152.10:9162 IsolateDestAddr
3374SocksPort 10.152.152.10:9163 IsolateDestAddr
3375SocksPort 10.152.152.10:9164 IsolateDestAddr
3376SocksPort 10.152.152.10:9165 IsolateDestAddr
3377SocksPort 10.152.152.10:9166 IsolateDestAddr
3378SocksPort 10.152.152.10:9167 IsolateDestAddr
3379SocksPort 10.152.152.10:9168 IsolateDestAddr
3380SocksPort 10.152.152.10:9169 IsolateDestAddr
3381
3382##+# #OptionalFeatureNr.4# More Socks Ports.
3383## Custom Ports #3:
3384## without IsolateDestAddr
3385## with IsolateDestPort
3386SocksPort 10.152.152.10:9170 IsolateDestPort
3387SocksPort 10.152.152.10:9171 IsolateDestPort
3388SocksPort 10.152.152.10:9172 IsolateDestPort
3389SocksPort 10.152.152.10:9173 IsolateDestPort
3390SocksPort 10.152.152.10:9174 IsolateDestPort
3391SocksPort 10.152.152.10:9175 IsolateDestPort
3392SocksPort 10.152.152.10:9176 IsolateDestPort
3393SocksPort 10.152.152.10:9177 IsolateDestPort
3394SocksPort 10.152.152.10:9178 IsolateDestPort
3395SocksPort 10.152.152.10:9179 IsolateDestPort
3396
3397##+# #OptionalFeatureNr.4# More Socks Ports.
3398## Custom Ports #4:
3399## with IsolateDestAddr
3400## with IsolateDestPort
3401SocksPort 10.152.152.10:9180 IsolateDestAddr IsolateDestPort
3402SocksPort 10.152.152.10:9181 IsolateDestAddr IsolateDestPort
3403SocksPort 10.152.152.10:9182 IsolateDestAddr IsolateDestPort
3404SocksPort 10.152.152.10:9183 IsolateDestAddr IsolateDestPort
3405SocksPort 10.152.152.10:9184 IsolateDestAddr IsolateDestPort
3406SocksPort 10.152.152.10:9185 IsolateDestAddr IsolateDestPort
3407SocksPort 10.152.152.10:9186 IsolateDestAddr IsolateDestPort
3408SocksPort 10.152.152.10:9187 IsolateDestAddr IsolateDestPort
3409SocksPort 10.152.152.10:9188 IsolateDestAddr IsolateDestPort
3410SocksPort 10.152.152.10:9189 IsolateDestAddr IsolateDestPort
3411
3412###########################
3413## Gateway Trans/Dns-Port #
3414###########################
3415
3416## TransPort and DnsPort are not enabled in gateway firewall by default.
3417##
3418## (comment mirrored from /usr/bin/whonix_firewall)
3419## Transparent Proxy Ports for Whonix-Gateway
3420## TRANS_PORT_GATEWAY="9041"
3421## DNS_PORT_GATEWAY="5400"
3422TransPort 127.0.0.1:9041
3423DnsPort 127.0.0.1:5400
3424
3425#######################
3426## Gateway SocksPorts #
3427#######################
3428
3429## Developer comment:
3430##
3431## We actually do not need all of them,
3432## but they do not hurt anyway and
3433## it keeps the setup more generic,
3434## with less exceptions.
3435##
3436## Comments why we (not) use IsolateDestAddr and/or IsolateDestPort
3437## are the same as in section Workstation SocksPorts.
3438
3439## Already defined above under 'Upstream Defaults File'. Cannot add here again.
3440## Otherwise Tor would fail to start.
3441## SocksPort 127.0.0.1:9050
3442
3443SocksPort 127.0.0.1:9100
3444SocksPort 127.0.0.1:9101 IsolateDestAddr IsolateDestPort
3445SocksPort 127.0.0.1:9102 IsolateDestAddr IsolateDestPort
3446SocksPort 127.0.0.1:9103 IsolateDestAddr IsolateDestPort
3447SocksPort 127.0.0.1:9104
3448SocksPort 127.0.0.1:9105 IsolateDestAddr IsolateDestPort
3449SocksPort 127.0.0.1:9106 IsolateDestAddr IsolateDestPort
3450SocksPort 127.0.0.1:9107 IsolateDestAddr IsolateDestPort
3451SocksPort 127.0.0.1:9108 IsolateDestAddr IsolateDestPort
3452SocksPort 127.0.0.1:9109 IsolateDestAddr IsolateDestPort
3453SocksPort 127.0.0.1:9110 IsolateDestAddr IsolateDestPort
3454SocksPort 127.0.0.1:9111
3455SocksPort 127.0.0.1:9112
3456SocksPort 127.0.0.1:9113
3457SocksPort 127.0.0.1:9114 IsolateDestAddr IsolateDestPort
3458SocksPort 127.0.0.1:9115 IsolateDestAddr IsolateDestPort
3459SocksPort 127.0.0.1:9116 IsolateDestAddr IsolateDestPort
3460SocksPort 127.0.0.1:9117 IsolateDestAddr IsolateDestPort
3461SocksPort 127.0.0.1:9118 IsolateDestAddr IsolateDestPort
3462SocksPort 127.0.0.1:9119
3463SocksPort 127.0.0.1:9120 IsolateDestAddr IsolateDestPort
3464SocksPort 127.0.0.1:9121 IsolateDestAddr IsolateDestPort
3465SocksPort 127.0.0.1:9122
3466SocksPort 127.0.0.1:9123
3467SocksPort 127.0.0.1:9124
3468SocksPort 127.0.0.1:9125
3469SocksPort 127.0.0.1:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth
3470
3471#####################################################
3472## End of /usr/share/tor/tor-service-defaults-torrc #
3473#####################################################
3474EOF
3475
3476whonix_firewall
3477
3478sleep 3s
3479iptables-save
3480iptables-save > fw.rules
3481
3482## 10
3483cat << EOF > anon-gw-anonymizer-config.postrm
3484#!/bin/bash
3485
3486## 10
3487
3488## This file is part of Whonix.
3489## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
3490## See the file COPYING for copying conditions.
3491
3492if [ -f /usr/lib/pre.bsh ]; then
3493 source /usr/lib/pre.bsh
3494fi
3495
3496set -e
3497
3498true "
3499#####################################################################
3500## INFO: BEGIN: \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
3501#####################################################################
3502"
3503
3504case "\$1" in
3505 configure)
3506 true "INFO: Configuring \$DPKG_MAINTSCRIPT_PACKAGE..."
3507
3508 ## force-reload Tor, if running.
3509 service_tor_status_exit_code="0"
3510 systemctl --no-pager --no-block status tor@default >/dev/null 2>&1 || { service_tor_status_exit_code="\$?" ; true; };
3511 if [ "\$service_tor_status_exit_code" = "0" ]; then
3512 ## || true to avoid an error in case Tor's init script has been
3513 ## chmodded -x in meanwhile or
3514 systemctl --no-pager --no-block force-reload tor@default || true
3515 fi
3516
3517 true "INFO: End configuring \$DPKG_MAINTSCRIPT_PACKAGE."
3518
3519 ;;
3520
3521 *)
3522 ;;
3523esac
3524
3525true "INFO: debhelper beginning here."
3526
3527#DEBHELPER#
3528
3529true "INFO: Done with debhelper."
3530
3531true "
3532#####################################################################
3533## INFO: END : \$DPKG_MAINTSCRIPT_PACKAGE \$DPKG_MAINTSCRIPT_NAME \$@
3534#####################################################################
3535"
3536
3537## Explicitly "exit 0", so eventually trapped errors can be ignored.
3538exit 0
3539EOF
3540chmod 755 anon-gw-anonymizer-config.postrm
3541./anon-gw-anonymizer-config.postrm configure
3542
3543echo
3544echo "sudo -u debian-tor arm -b -i 9051"
3545service tor status
3546service tor@default status
3547echo
3548
3549cp /etc/resolv.conf /etc/resolv.conf.anondist
3550cp /etc/hosts /etc/hosts.anondist
3551cp /etc/hostname /etc/hostname.anondist
3552cp /etc/tor/torrc /etc/tor/torrc.anondist
3553cp /usr/share/tor/tor-service-defaults-torrc /usr/share/tor/tor-service-defaults-torrc.anondist
3554cp /etc/default/tor /etc/default/tor.anondist
3555cp /etc/apparmor.d/local/system_tor /etc/apparmor.d/local/system_tor.anondist
3556cp /etc/apparmor.d/local/usr.bin.obfsproxy /etc/apparmor.d/local/usr.bin.obfsproxy.anondist
3557
3558cat << EOF > /root/fw.rules
3559# Generated by iptables-save v1.4.21 on Thu Mar 16 08:04:51 2017
3560*mangle
3561:PREROUTING ACCEPT [3:1242]
3562:INPUT ACCEPT [3:1242]
3563:FORWARD ACCEPT [0:0]
3564:OUTPUT ACCEPT [1:52]
3565:POSTROUTING ACCEPT [1:52]
3566COMMIT
3567# Completed on Thu Mar 16 08:04:51 2017
3568# Generated by iptables-save v1.4.21 on Thu Mar 16 08:04:51 2017
3569*nat
3570:PREROUTING ACCEPT [0:0]
3571:INPUT ACCEPT [0:0]
3572:OUTPUT ACCEPT [0:0]
3573:POSTROUTING ACCEPT [0:0]
3574-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
3575-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
3576-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
3577-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9051 -j REDIRECT --to-ports 9051
3578-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
3579-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
3580-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
3581-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9124 -j REDIRECT --to-ports 9124
3582-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
3583-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
3584-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
3585-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9104 -j REDIRECT --to-ports 9104
3586-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
3587-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
3588-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
3589-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9111 -j REDIRECT --to-ports 9111
3590-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
3591-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
3592-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
3593-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9117 -j REDIRECT --to-ports 9117
3594-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
3595-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
3596-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
3597-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9107 -j REDIRECT --to-ports 9107
3598-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
3599-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
3600-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
3601-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9123 -j REDIRECT --to-ports 9123
3602-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
3603-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
3604-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
3605-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9105 -j REDIRECT --to-ports 9105
3606-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
3607-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
3608-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
3609-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9103 -j REDIRECT --to-ports 9103
3610-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
3611-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
3612-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
3613-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9101 -j REDIRECT --to-ports 9101
3614-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
3615-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
3616-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
3617-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9122 -j REDIRECT --to-ports 9122
3618-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9121 -j REDIRECT --to-ports 9121
3619-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9121 -j REDIRECT --to-ports 9121
3620-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9121 -j REDIRECT --to-ports 9121
3621-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9121 -j REDIRECT --to-ports 9121
3622-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9120 -j REDIRECT --to-ports 9120
3623-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9120 -j REDIRECT --to-ports 9120
3624-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9120 -j REDIRECT --to-ports 9120
3625-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9120 -j REDIRECT --to-ports 9120
3626-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9113 -j REDIRECT --to-ports 9113
3627-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9113 -j REDIRECT --to-ports 9113
3628-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9113 -j REDIRECT --to-ports 9113
3629-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9113 -j REDIRECT --to-ports 9113
3630-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9112 -j REDIRECT --to-ports 9112
3631-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9112 -j REDIRECT --to-ports 9112
3632-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9112 -j REDIRECT --to-ports 9112
3633-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9112 -j REDIRECT --to-ports 9112
3634-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
3635-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
3636-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
3637-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9118 -j REDIRECT --to-ports 9118
3638-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
3639-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
3640-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
3641-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9108 -j REDIRECT --to-ports 9108
3642-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
3643-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
3644-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
3645-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9106 -j REDIRECT --to-ports 9106
3646-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
3647-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
3648-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
3649-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9100 -j REDIRECT --to-ports 9100
3650-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
3651-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
3652-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
3653-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9150 -j REDIRECT --to-ports 9150
3654-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
3655-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
3656-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
3657-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9115 -j REDIRECT --to-ports 9115
3658-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9116 -j REDIRECT --to-ports 9116
3659-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9116 -j REDIRECT --to-ports 9116
3660-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9116 -j REDIRECT --to-ports 9116
3661-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9116 -j REDIRECT --to-ports 9116
3662-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
3663-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
3664-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
3665-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9102 -j REDIRECT --to-ports 9102
3666-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9119 -j REDIRECT --to-ports 9119
3667-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9119 -j REDIRECT --to-ports 9119
3668-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9119 -j REDIRECT --to-ports 9119
3669-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9119 -j REDIRECT --to-ports 9119
3670-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
3671-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
3672-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
3673-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050
3674-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
3675-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
3676-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
3677-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9109 -j REDIRECT --to-ports 9109
3678-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
3679-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
3680-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
3681-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9110 -j REDIRECT --to-ports 9110
3682-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
3683-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
3684-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
3685-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9114 -j REDIRECT --to-ports 9114
3686-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
3687-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
3688-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
3689-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9125 -j REDIRECT --to-ports 9125
3690-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9152 -j REDIRECT --to-ports 9152
3691-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9152 -j REDIRECT --to-ports 9152
3692-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9152 -j REDIRECT --to-ports 9152
3693-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9152 -j REDIRECT --to-ports 9152
3694-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9153 -j REDIRECT --to-ports 9153
3695-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9153 -j REDIRECT --to-ports 9153
3696-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9153 -j REDIRECT --to-ports 9153
3697-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9153 -j REDIRECT --to-ports 9153
3698-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9154 -j REDIRECT --to-ports 9154
3699-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9154 -j REDIRECT --to-ports 9154
3700-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9154 -j REDIRECT --to-ports 9154
3701-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9154 -j REDIRECT --to-ports 9154
3702-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9155 -j REDIRECT --to-ports 9155
3703-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9155 -j REDIRECT --to-ports 9155
3704-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9155 -j REDIRECT --to-ports 9155
3705-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9155 -j REDIRECT --to-ports 9155
3706-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9156 -j REDIRECT --to-ports 9156
3707-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9156 -j REDIRECT --to-ports 9156
3708-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9156 -j REDIRECT --to-ports 9156
3709-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9156 -j REDIRECT --to-ports 9156
3710-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9157 -j REDIRECT --to-ports 9157
3711-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9157 -j REDIRECT --to-ports 9157
3712-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9157 -j REDIRECT --to-ports 9157
3713-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9157 -j REDIRECT --to-ports 9157
3714-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9158 -j REDIRECT --to-ports 9158
3715-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9158 -j REDIRECT --to-ports 9158
3716-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9158 -j REDIRECT --to-ports 9158
3717-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9158 -j REDIRECT --to-ports 9158
3718-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9159 -j REDIRECT --to-ports 9159
3719-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9159 -j REDIRECT --to-ports 9159
3720-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9159 -j REDIRECT --to-ports 9159
3721-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9159 -j REDIRECT --to-ports 9159
3722-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9160 -j REDIRECT --to-ports 9160
3723-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9160 -j REDIRECT --to-ports 9160
3724-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9160 -j REDIRECT --to-ports 9160
3725-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9160 -j REDIRECT --to-ports 9160
3726-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9161 -j REDIRECT --to-ports 9161
3727-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9161 -j REDIRECT --to-ports 9161
3728-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9161 -j REDIRECT --to-ports 9161
3729-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9161 -j REDIRECT --to-ports 9161
3730-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9162 -j REDIRECT --to-ports 9162
3731-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9162 -j REDIRECT --to-ports 9162
3732-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9162 -j REDIRECT --to-ports 9162
3733-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9162 -j REDIRECT --to-ports 9162
3734-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9163 -j REDIRECT --to-ports 9163
3735-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9163 -j REDIRECT --to-ports 9163
3736-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9163 -j REDIRECT --to-ports 9163
3737-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9163 -j REDIRECT --to-ports 9163
3738-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9164 -j REDIRECT --to-ports 9164
3739-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9164 -j REDIRECT --to-ports 9164
3740-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9164 -j REDIRECT --to-ports 9164
3741-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9164 -j REDIRECT --to-ports 9164
3742-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9165 -j REDIRECT --to-ports 9165
3743-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9165 -j REDIRECT --to-ports 9165
3744-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9165 -j REDIRECT --to-ports 9165
3745-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9165 -j REDIRECT --to-ports 9165
3746-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9166 -j REDIRECT --to-ports 9166
3747-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9166 -j REDIRECT --to-ports 9166
3748-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9166 -j REDIRECT --to-ports 9166
3749-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9166 -j REDIRECT --to-ports 9166
3750-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9167 -j REDIRECT --to-ports 9167
3751-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9167 -j REDIRECT --to-ports 9167
3752-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9167 -j REDIRECT --to-ports 9167
3753-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9167 -j REDIRECT --to-ports 9167
3754-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9168 -j REDIRECT --to-ports 9168
3755-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9168 -j REDIRECT --to-ports 9168
3756-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9168 -j REDIRECT --to-ports 9168
3757-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9168 -j REDIRECT --to-ports 9168
3758-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9169 -j REDIRECT --to-ports 9169
3759-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9169 -j REDIRECT --to-ports 9169
3760-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9169 -j REDIRECT --to-ports 9169
3761-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9169 -j REDIRECT --to-ports 9169
3762-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9170 -j REDIRECT --to-ports 9170
3763-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9170 -j REDIRECT --to-ports 9170
3764-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9170 -j REDIRECT --to-ports 9170
3765-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9170 -j REDIRECT --to-ports 9170
3766-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9171 -j REDIRECT --to-ports 9171
3767-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9171 -j REDIRECT --to-ports 9171
3768-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9171 -j REDIRECT --to-ports 9171
3769-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9171 -j REDIRECT --to-ports 9171
3770-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9172 -j REDIRECT --to-ports 9172
3771-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9172 -j REDIRECT --to-ports 9172
3772-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9172 -j REDIRECT --to-ports 9172
3773-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9172 -j REDIRECT --to-ports 9172
3774-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9173 -j REDIRECT --to-ports 9173
3775-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9173 -j REDIRECT --to-ports 9173
3776-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9173 -j REDIRECT --to-ports 9173
3777-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9173 -j REDIRECT --to-ports 9173
3778-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9174 -j REDIRECT --to-ports 9174
3779-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9174 -j REDIRECT --to-ports 9174
3780-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9174 -j REDIRECT --to-ports 9174
3781-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9174 -j REDIRECT --to-ports 9174
3782-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9175 -j REDIRECT --to-ports 9175
3783-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9175 -j REDIRECT --to-ports 9175
3784-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9175 -j REDIRECT --to-ports 9175
3785-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9175 -j REDIRECT --to-ports 9175
3786-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9176 -j REDIRECT --to-ports 9176
3787-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9176 -j REDIRECT --to-ports 9176
3788-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9176 -j REDIRECT --to-ports 9176
3789-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9176 -j REDIRECT --to-ports 9176
3790-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9177 -j REDIRECT --to-ports 9177
3791-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9177 -j REDIRECT --to-ports 9177
3792-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9177 -j REDIRECT --to-ports 9177
3793-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9177 -j REDIRECT --to-ports 9177
3794-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9178 -j REDIRECT --to-ports 9178
3795-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9178 -j REDIRECT --to-ports 9178
3796-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9178 -j REDIRECT --to-ports 9178
3797-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9178 -j REDIRECT --to-ports 9178
3798-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9179 -j REDIRECT --to-ports 9179
3799-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9179 -j REDIRECT --to-ports 9179
3800-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9179 -j REDIRECT --to-ports 9179
3801-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9179 -j REDIRECT --to-ports 9179
3802-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9180 -j REDIRECT --to-ports 9180
3803-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9180 -j REDIRECT --to-ports 9180
3804-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9180 -j REDIRECT --to-ports 9180
3805-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9180 -j REDIRECT --to-ports 9180
3806-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9181 -j REDIRECT --to-ports 9181
3807-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9181 -j REDIRECT --to-ports 9181
3808-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9181 -j REDIRECT --to-ports 9181
3809-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9181 -j REDIRECT --to-ports 9181
3810-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9182 -j REDIRECT --to-ports 9182
3811-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9182 -j REDIRECT --to-ports 9182
3812-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9182 -j REDIRECT --to-ports 9182
3813-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9182 -j REDIRECT --to-ports 9182
3814-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9183 -j REDIRECT --to-ports 9183
3815-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9183 -j REDIRECT --to-ports 9183
3816-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9183 -j REDIRECT --to-ports 9183
3817-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9183 -j REDIRECT --to-ports 9183
3818-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9184 -j REDIRECT --to-ports 9184
3819-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9184 -j REDIRECT --to-ports 9184
3820-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9184 -j REDIRECT --to-ports 9184
3821-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9184 -j REDIRECT --to-ports 9184
3822-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9185 -j REDIRECT --to-ports 9185
3823-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9185 -j REDIRECT --to-ports 9185
3824-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9185 -j REDIRECT --to-ports 9185
3825-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9185 -j REDIRECT --to-ports 9185
3826-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9186 -j REDIRECT --to-ports 9186
3827-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9186 -j REDIRECT --to-ports 9186
3828-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9186 -j REDIRECT --to-ports 9186
3829-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9186 -j REDIRECT --to-ports 9186
3830-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9187 -j REDIRECT --to-ports 9187
3831-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9187 -j REDIRECT --to-ports 9187
3832-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9187 -j REDIRECT --to-ports 9187
3833-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9187 -j REDIRECT --to-ports 9187
3834-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9188 -j REDIRECT --to-ports 9188
3835-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9188 -j REDIRECT --to-ports 9188
3836-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9188 -j REDIRECT --to-ports 9188
3837-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9188 -j REDIRECT --to-ports 9188
3838-A PREROUTING -d 192.168.0.10/32 -i eth1 -p tcp -m tcp --dport 9189 -j REDIRECT --to-ports 9189
3839-A PREROUTING -d 10.152.152.10/32 -i eth1 -p tcp -m tcp --dport 9189 -j REDIRECT --to-ports 9189
3840-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9189 -j REDIRECT --to-ports 9189
3841-A PREROUTING -d 10.0.0.0/8 -i eth1 -p tcp -m tcp --dport 9189 -j REDIRECT --to-ports 9189
3842-A PREROUTING -i eth1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5300
3843-A PREROUTING -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
3844-A OUTPUT -m owner --uid-owner 1002 -j RETURN
3845-A OUTPUT -m owner --uid-owner 1003 -j RETURN
3846-A OUTPUT -m owner --uid-owner 1001 -j RETURN
3847-A OUTPUT -m owner --uid-owner 0 -j RETURN
3848-A OUTPUT -m owner --uid-owner 108 -j RETURN
3849-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5400
3850-A OUTPUT -m iprange --dst-range 127.0.0.0-127.0.0.24 -j RETURN
3851-A OUTPUT -m iprange --dst-range 192.168.0.0-192.168.0.24 -j RETURN
3852-A OUTPUT -m iprange --dst-range 192.168.1.0-192.168.1.24 -j RETURN
3853-A OUTPUT -m iprange --dst-range 10.152.152.0-10.152.152.24 -j RETURN
3854-A OUTPUT -m iprange --dst-range 10.0.2.2-10.0.2.24 -j RETURN
3855-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9041
3856COMMIT
3857# Completed on Thu Mar 16 08:04:51 2017
3858# Generated by iptables-save v1.4.21 on Thu Mar 16 08:04:51 2017
3859*filter
3860:INPUT DROP [0:0]
3861:FORWARD DROP [0:0]
3862:OUTPUT DROP [0:0]
3863-A INPUT -m conntrack --ctstate INVALID -j DROP
3864-A INPUT -m state --state INVALID -j DROP
3865-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
3866-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
3867-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
3868-A INPUT -f -j DROP
3869-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
3870-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
3871-A INPUT -i lo -j ACCEPT
3872-A INPUT -m state --state ESTABLISHED -j ACCEPT
3873-A INPUT -p icmp -j DROP
3874-A INPUT -i eth1 -p udp -m udp --dport 5300 -j ACCEPT
3875-A INPUT -i eth1 -p tcp -m tcp --dport 9040 -j ACCEPT
3876-A INPUT -i eth1 -p tcp -m tcp --dport 9051 -j ACCEPT
3877-A INPUT -i eth1 -p tcp -m tcp --dport 9124 -j ACCEPT
3878-A INPUT -i eth1 -p tcp -m tcp --dport 9104 -j ACCEPT
3879-A INPUT -i eth1 -p tcp -m tcp --dport 9111 -j ACCEPT
3880-A INPUT -i eth1 -p tcp -m tcp --dport 9117 -j ACCEPT
3881-A INPUT -i eth1 -p tcp -m tcp --dport 9107 -j ACCEPT
3882-A INPUT -i eth1 -p tcp -m tcp --dport 9123 -j ACCEPT
3883-A INPUT -i eth1 -p tcp -m tcp --dport 9105 -j ACCEPT
3884-A INPUT -i eth1 -p tcp -m tcp --dport 9103 -j ACCEPT
3885-A INPUT -i eth1 -p tcp -m tcp --dport 9101 -j ACCEPT
3886-A INPUT -i eth1 -p tcp -m tcp --dport 9122 -j ACCEPT
3887-A INPUT -i eth1 -p tcp -m tcp --dport 9121 -j ACCEPT
3888-A INPUT -i eth1 -p tcp -m tcp --dport 9120 -j ACCEPT
3889-A INPUT -i eth1 -p tcp -m tcp --dport 9113 -j ACCEPT
3890-A INPUT -i eth1 -p tcp -m tcp --dport 9112 -j ACCEPT
3891-A INPUT -i eth1 -p tcp -m tcp --dport 9118 -j ACCEPT
3892-A INPUT -i eth1 -p tcp -m tcp --dport 9108 -j ACCEPT
3893-A INPUT -i eth1 -p tcp -m tcp --dport 9106 -j ACCEPT
3894-A INPUT -i eth1 -p tcp -m tcp --dport 9100 -j ACCEPT
3895-A INPUT -i eth1 -p tcp -m tcp --dport 9150 -j ACCEPT
3896-A INPUT -i eth1 -p tcp -m tcp --dport 9115 -j ACCEPT
3897-A INPUT -i eth1 -p tcp -m tcp --dport 9116 -j ACCEPT
3898-A INPUT -i eth1 -p tcp -m tcp --dport 9102 -j ACCEPT
3899-A INPUT -i eth1 -p tcp -m tcp --dport 9119 -j ACCEPT
3900-A INPUT -i eth1 -p tcp -m tcp --dport 9050 -j ACCEPT
3901-A INPUT -i eth1 -p tcp -m tcp --dport 9109 -j ACCEPT
3902-A INPUT -i eth1 -p tcp -m tcp --dport 9110 -j ACCEPT
3903-A INPUT -i eth1 -p tcp -m tcp --dport 9114 -j ACCEPT
3904-A INPUT -i eth1 -p tcp -m tcp --dport 9125 -j ACCEPT
3905-A INPUT -i eth1 -p tcp -m multiport --dports 9152:9189 -j ACCEPT
3906-A INPUT -j DROP
3907-A FORWARD -j REJECT --reject-with icmp-admin-prohibited
3908-A OUTPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp-admin-prohibited
3909-A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-admin-prohibited
3910-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j REJECT --reject-with icmp-admin-prohibited
3911-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j REJECT --reject-with icmp-admin-prohibited
3912-A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with icmp-admin-prohibited
3913-A OUTPUT -f -j REJECT --reject-with icmp-admin-prohibited
3914-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j REJECT --reject-with icmp-admin-prohibited
3915-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j REJECT --reject-with icmp-admin-prohibited
3916-A OUTPUT -m state --state ESTABLISHED -j ACCEPT
3917-A OUTPUT -m iprange --dst-range 127.0.0.0-127.0.0.24 -j ACCEPT
3918-A OUTPUT -m iprange --dst-range 192.168.0.0-192.168.0.24 -j ACCEPT
3919-A OUTPUT -m iprange --dst-range 192.168.1.0-192.168.1.24 -j ACCEPT
3920-A OUTPUT -m iprange --dst-range 10.152.152.0-10.152.152.24 -j ACCEPT
3921-A OUTPUT -m iprange --dst-range 10.0.2.2-10.0.2.24 -j ACCEPT
3922-A OUTPUT -o lo -j ACCEPT
3923-A OUTPUT -m owner --uid-owner 1002 -j ACCEPT
3924-A OUTPUT -m owner --uid-owner 1003 -j ACCEPT
3925-A OUTPUT -m owner --uid-owner 1001 -j ACCEPT
3926-A OUTPUT -m owner --uid-owner 0 -j ACCEPT
3927-A OUTPUT -m owner --uid-owner 108 -j ACCEPT
3928-A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
3929COMMIT
3930# Completed on Thu Mar 16 08:04:51 2017
3931EOF
3932
3933cat << EOF > /usr/bin/machon
3934#!/bin/bash
3935if [[ \$EUID -ne 0 ]]; then
3936 echo "Permiso denegado." 1>&2
3937 exit 1
3938 else
3939 echo -e "Permiso aceptado."
3940fi
3941# START ####
3942 echo -e "\\n* Spoofing Mac Address...\\n"
3943 sudo service networking stop
3944 sudo service network-manager stop
3945 sleep 1
3946 echo -e "* eth0 MAC address:\\n"
3947 sleep 1
3948 sudo ifconfig eth0 down
3949 sleep 1
3950 sudo macchanger -a eth0
3951 sleep 1
3952 sudo ifconfig eth0 up
3953 sleep 1
3954 sudo service networking start
3955 sudo service network-manager start
3956 echo -e "\\n* Mac Address Spoofing [ON]"
3957 sleep 1
3958EOF
3959chmod 777 /usr/bin/machon
3960
3961cat << EOF > /usr/bin/machoff
3962#!/bin/bash
3963if [[ \$EUID -ne 0 ]]; then
3964 echo "Permiso denegado." 1>&2
3965 exit 1
3966 else
3967 echo -e "Permiso aceptado."
3968fi
3969# STOP ####
3970 echo -e "\\n* Restoring Mac Address...\\n"
3971 sudo service networking stop
3972 sudo service network-manager stop
3973 sleep 1
3974 echo -e "* eth0 MAC address:\\n"
3975 sleep 1
3976 sudo ifconfig eth0 down
3977 sleep 1
3978 sudo macchanger -p eth0
3979 sleep 1
3980 sudo ifconfig eth0 up
3981 sleep 1
3982 sudo service networking start
3983 sudo service network-manager start
3984 sleep 1
3985 echo -e "\\n* Mac Address Spoofing [OFF]"
3986 sleep 1
3987 echo -e "\\n* Now wiping cache, ram, & swap-space...\\n"
3988 sync; echo 3 > /proc/sys/vm/drop_caches
3989 swapoff -a && swapon -a
3990 sleep 1
3991 echo -e "* Cache, ram & swap-space [CLEANED]"
3992EOF
3993chmod 777 /usr/bin/machoff
3994
3995echo "
3996
3997alias 0='machoff && shutdown --poweroff +0'
3998alias 1='machon && sleep 2s && iptables-restore < /root/fw.rules && sleep 2s && systemctl start tor@default'
3999alias 2='curl wtfismyip.com/json'
4000alias 3='nano /etc/tor/torrc'
4001alias 4='service tor@default stop && sleep 2s && service tor@default start && sleep 2s && service tor@default status'
4002alias 5='systemctl status tor@default'
4003alias 6='sudo -u debian-tor arm'
4004
4005" >> /root/.bashrc
4006
4007echo
4008echo
4009echo "--------------------------------- END ... reboot me!"
4010echo
4011echo
4012exit 0
4013
4014# https://paste.ee/r/{}/0
4015# curl --upload-file ./hello.txt https://transfer.sh/hello.txt
4016
4017# /lib/systemd/system/tor@default.service
4018
4019
4020
4021
4022## /etc/network/interfaces
4023#auto eth1
4024#iface eth1 inet static
4025 #address 10.152.152.11
4026 #netmask 255.255.192.0
4027 #gateway 10.152.152.10
4028 #network 192.168.0.0
4029 #broadcast 192.168.0.255
4030 #dns-nameservers 10.152.152.10