LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 01-17-2024, 09:02 AM   #1
Jason.nix
Member
 
Registered: Feb 2023
Posts: 567

Rep: Reputation: 10
Post iptables rules for using OpenVPN with Tor


Hello,
To set up a normal OpenVPN server, I use the following iptables rules:
Code:
# IF_MAIN=enp0s3
# IF_TUNNEL=tun0
# YOUR_OPENVPN_SUBNET=10.8.0.0/16
# iptables -I INPUT -p udp --dport 1194 -j ACCEPT
# iptables -A FORWARD -i $IF_MAIN -o $IF_TUNNEL -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A FORWARD -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j ACCEPT
# iptables -t nat -A POSTROUTING -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j MASQUERADE
I want to tunnel OpenVPN on Tor and I found the following iptables rules:
Code:
# export OVPN=tun0
# IPTABLES -A INPUT -i $OVPN -s 10.8.0.0/24 -m state --state NEW -j ACCEPT
# IPTABLES -t nat -A PREROUTING -i $OVPN -p udp --dport 53 -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:53530
# IPTABLES -t nat -A PREROUTING -i $OVPN -p tcp -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:9040
# IPTABLES -t nat -A PREROUTING -i $OVPN -p udp -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:9040
Are the iptables rules above enough or do I still need the iptables rules I use to set up a normal OpenVPN server?

Thank you.
 
Old 01-18-2024, 12:34 PM   #2
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,760

Rep: Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931
No expert but I think you can configure OpenVPN to use TOR as a socks proxy.
Tor configuration add/modify

SOCKSPort XXXX PreferSOCKSNoAuth (where XXXX is the desired port number)

Add to the open client configuration
socks-proxy localhost XXXX (Where XXXX is the port used above)
 
Old 01-18-2024, 02:26 PM   #3
Jason.nix
Member
 
Registered: Feb 2023
Posts: 567

Original Poster
Rep: Reputation: 10
Quote:
Originally Posted by michaelk View Post
No expert but I think you can configure OpenVPN to use TOR as a socks proxy.
Tor configuration add/modify

SOCKSPort XXXX PreferSOCKSNoAuth (where XXXX is the desired port number)

Add to the open client configuration
socks-proxy localhost XXXX (Where XXXX is the port used above)
Hello,
Thank you so much for your reply.
I just want to know are the second iptables rules enough or not?
 
Old 01-18-2024, 03:11 PM   #4
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,760

Rep: Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931
I am not an expert...

I don't think there would be any changes to the rules. Tor would only be running on the client not the server. The OpenVPN traffic at the server should be no different with or without TOR. When it leaves at the exit relay traffic should just be the "normal" tunnel.

Once Tor is "on" on the client OpenVPN traffic should automatically be routed through the socks proxy on the client and travel through until it hits the exit relay. Once it exits it again should be just the OpenVPN tunnel.
 
Old 01-19-2024, 06:54 AM   #5
Jason.nix
Member
 
Registered: Feb 2023
Posts: 567

Original Poster
Rep: Reputation: 10
Quote:
Originally Posted by michaelk View Post
I am not an expert...

I don't think there would be any changes to the rules. Tor would only be running on the client not the server. The OpenVPN traffic at the server should be no different with or without TOR. When it leaves at the exit relay traffic should just be the "normal" tunnel.

Once Tor is "on" on the client OpenVPN traffic should automatically be routed through the socks proxy on the client and travel through until it hits the exit relay. Once it exits it again should be just the OpenVPN tunnel.
Hello,
Thanks again.
So are both rules needed?
 
Old 01-19-2024, 07:07 AM   #6
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,760

Rep: Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931
Which rules are you asking about?
 
Old 01-20-2024, 01:47 AM   #7
Jason.nix
Member
 
Registered: Feb 2023
Posts: 567

Original Poster
Rep: Reputation: 10
Quote:
Originally Posted by michaelk View Post
Which rules are you asking about?
Hello,
Are the following rules enough?
Code:
# export OVPN=tun0
# iptables -I INPUT -p udp --dport 1194 -j ACCEPT
# IPTABLES -A INPUT -i $OVPN -s 10.8.0.0/24 -m state --state NEW -j ACCEPT
# IPTABLES -t nat -A PREROUTING -i $OVPN -p udp --dport 53 -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:53530
# IPTABLES -t nat -A PREROUTING -i $OVPN -p tcp -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:9040
# IPTABLES -t nat -A PREROUTING -i $OVPN -p udp -s 10.8.0.0/24 -j DNAT --to-destination 10.8.0.1:9040
 
Old 01-20-2024, 03:39 AM   #8
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,760

Rep: Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931
On the vpn server side I don't think you need to change any rules at all.

On the client side configure the VPN to use the tor proxy as posted above. No special iptables rules are necessary.

As I understand how it works. Unless you have a tor server also running on the vpn server.

Last edited by michaelk; 01-20-2024 at 04:08 AM.
 
Old 01-20-2024, 02:30 PM   #9
Jason.nix
Member
 
Registered: Feb 2023
Posts: 567

Original Poster
Rep: Reputation: 10
Quote:
Originally Posted by michaelk View Post
On the vpn server side I don't think you need to change any rules at all.

On the client side configure the VPN to use the tor proxy as posted above. No special iptables rules are necessary.

As I understand how it works. Unless you have a tor server also running on the vpn server.
Hello,
Thanks again.
Yes, the Tor is running on the OpenVPN server.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] /etc/udev/rules.d/40-libsane.rules and /etc/udev/rules.d/S99-2000S1.rules missing LABEL=libsane_rules_end mumahendras3 Slackware 6 03-09-2020 02:27 AM
How to route? system -> openvpn -> tor -> openvpn -> internet LeFex Linux - Networking 3 01-09-2019 01:54 PM
Tor Browser Bundle/Tor and IPTables: Solution Needed Nonetas Linux - Networking 3 03-01-2018 11:27 PM
Tor Browser Bundle/Tor and IPTables: Working Solution Sought Nonetas Linux - Security 1 01-14-2018 06:23 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 01:33 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration