Hallo
Ich habe folgende Konfiguration, für ein über TOR abgesichertes Netzwerk, erstellt.
Hardware: INET ←> Fritzbox (als DSL-Modem und Router mit DHCP-Server 192.168.178.0/24) ←> eth1 Raspberry Pi (als TOR-Router mit DHCP-Server 192.168.2.0/24) eth0 ←> DD-WRT (als Router mit DHCP-Server 192.168.1.0/24) ←> diverse Clients per LAN und WLAN
Software: INET-Anwendung ←> TOR ←> Privoxy ←> transparenter Squid ←> lokale Anwendung
Ich gehe hier nur auf die Konfiguration des Raspberry ein.
squid.conf
acl myNetwork src 192.168.2.0/24 acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access allow myNetwork http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost http_access allow myNetwork http_access deny all http_port 3128 transparent http_port 443 coredump_dir /var/spool/squid3 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 cache_peer 192.168.2.1 parent 8118 7 no-query default never_direct allow all cache_access_log none forwarded_for off cache deny all
privoxy/config
user-manual /usr/share/doc/privoxy/user-manual confdir /etc/privoxy logdir /var/log/privoxy actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on. actionsfile default.action # Main actions file actionsfile easylistgermany.script.action actionsfile easylist.script.action actionsfile user.action # User customizations filterfile default.filter filterfile easylistgermany.script.filter filterfile easylist.script.filter filterfile user.filter # User customizations logfile logfile listen-address 192.168.2.1:8118 listen-address 127.0.0.1:8118 toggle 1 enable-remote-toggle 0 enable-remote-http-toggle 0 enable-edit-actions 0 enforce-blocks 0 buffer-limit 4096 forwarded-connect-retries 0 accept-intercepted-requests 0 allow-cgi-request-crunching 0 split-large-forms 0 keep-alive-timeout 5 socket-timeout 300 enable-edit-actions 1 debug 1 forward-socks4a / 127.0.0.1:9050 .
torrc
AutomapHostsOnResolve 1 TransPort 9040 TransListenAddress 192.168.2.1 SocksPort 9050 SocksListenAddress 127.0.0.1 DNSPort 9053 DNSListenAddress 192.168.2.1 DNSListenAddress 127.0.0.1 Log warn syslog RunAsDaemon 1 DataDirectory /var/lib/tor StrictNodes 1
iptables
sudo iptables -A FORWARD -o eth1 -i eth0 -s 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 22 -j REDIRECT --to-ports 22 sudo iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j REDIRECT --to-ports 9053 sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --syn -j REDIRECT --to-ports 9040
Das Ganze scheint so zu funktionieren.
Macht das in euren Augen Sinn? Leite ich wirklich alles durch TOR? Kann man das sauberer konfigurieren? Seht ihr Sicherheitmängel?
Gruß ubuntuuser.de.user
