A question about Tor proxy

Jason.nix · 12-27-2023, 11:44 AM

Hello,
I have a Debian server with Tor installed on it. This server is located in an internal network and the Tor configuration is as follows:

Code:

RunAsDaemon 1
SOCKSPort 192.168.1.2:9050
DataDirectory @LOCALSTATEDIR@/lib/tor
CookieAuthentication 0

I use Tor by setting a SOCKS5 type proxy in the browser. I use these iptables rules:

Code:

-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 9050 -m state --state NEW -j ACCEPT

If I set a public IP address on the NIC, can anyone connect to port 9050 from the Internet? As you can see, I have given internal IP address to Tor in Tor configuration.

Thank you.

TenTenths · 12-28-2023, 05:29 AM

Nobody can tell you because you don't provide enough information on how your internal network accesses the internet.

At the very least provide details of what you're using as a router between your normal internal network and the internet.

Jason.nix · 12-28-2023, 09:49 AM

Quote:

Originally Posted by TenTenths

Nobody can tell you because you don't provide enough information on how your internal network accesses the internet.

At the very least provide details of what you're using as a router between your normal internal network and the internet.

Hello,
Thank you so much for your reply.
My internal network is connected to the Internet through a modem:

Quote:

Internal Network ---> Modem ---> Internet

TenTenths · 12-28-2023, 09:58 AM

Quote:

Originally Posted by Jason.nix

Hello,
Thank you so much for your reply.
My internal network is connected to the Internet through a modem:

Ok, so it's still unclear.

Are you telling us you have a modem connected to a computer on your internal network with that computer configured to act as a router, or do you (as is more common these days) connect your internal network to your ISP provided device which is acting as router / "modem"?

Regardless, you should be able to configure whichever part is your router to allow incoming traffic from the WAN side on a specific port to a specific IP/Port on your LAN side, in which case your TOR server should be publicly accessible. Assuming your ISP doesn't block traffic on that port further upstream.

Jason.nix · 12-30-2023, 12:29 AM

Quote:

Originally Posted by TenTenths

Ok, so it's still unclear.

Are you telling us you have a modem connected to a computer on your internal network with that computer configured to act as a router, or do you (as is more common these days) connect your internal network to your ISP provided device which is acting as router / "modem"?

Regardless, you should be able to configure whichever part is your router to allow incoming traffic from the WAN side on a specific port to a specific IP/Port on your LAN side, in which case your TOR server should be publicly accessible. Assuming your ISP doesn't block traffic on that port further upstream.

Hello,
Thanks again.
My modem acts like a router and Debian server connected to the Internet directly.

Jason.nix · 01-22-2024, 01:45 AM

Hello,
No idea?
How can I make a port only accessible to a range of IP addresses?

Thank you.

___ · 01-23-2024, 02:28 AM

Maybe https://serverfault.com/questions/24...n-specifc-port

Jason.nix · 01-23-2024, 11:52 PM

Quote:

Originally Posted by ___

Maybe https://serverfault.com/questions/24...n-specifc-port

Hello,
Thank you so much for your reply.
Assuming the Tor proxy is running on the address 192.168.1.2, are the following policies and rules sufficient?

Code:

*filter
:INPUT DROP [862:113997]
:FORWARD DROP [0:0]
:OUTPUT DROP [76190:79547849]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -p tcp -s 192.168.1.0/24 --dst 192.168.1.2 --dport 9050 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9050 -j DROP