Connecting to Tor before a Proxy using Transparent Proxying Method

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

There are 3 different ways to configure an additional proxy.

User → Tor → Proxy → Internet

• Proxy Settings Method
• Proxyfier Method
• Transparent Proxying Method

Before combining Tor with other tunnels, be sure to read and understand the risks!

See also proxy warning!

Instructions on how to connect to Tor before a proxy (User → Tor → Proxy → Internet) using Transparent Proxying Method

Introduction

Advanced users only!

To make clear, what this is about. Whonix-Gateway^™ is already serving as a Transparent Proxy , which means, that all applications not explicitly configured to use a SocksPort, can connect through Tor without any settings. This section is about configuring Whonix-Workstation^™ also to act as a Transparent Proxy . Use case: a user wants to ensure all traffic goes through Tor (by using Whonix-Gateway^™) and want to additionally ensure, all traffic goes through a proxy choosen by the user after the Tor link, i.e. user → Tor → proxy → internet.

You always have to keep in mind, which kind of data and which kind of proxy you are using. There are CGIproxies, http(s) proxies and socks4/4a/5 proxies.

In case you redirect the network layer directly with iptables, you need a TransPort. Unfortunately very few applications, do offer a TransPort. For example, Tor supports a TransPort. In most other cases, you need to translate the different kinds of data.

Due to the nature of Transparent Proxying, we need to redirect with iptables and end up with a "Trans data stream". Because most proxies are either http or socks we need to translate this. Below we discuss a few tools which help here, not all are required, depending on what you want to do.

Required reading:

• Whonix_versus_Proxies
• Tor Plus VPN or proxy

Tools

Tor is a socks proxy and also has a TransPort. You must also keep in mind, that Tor does not support UDP, although it offers a DnsPort.

redsocks can also accept "Trans data streams" and can forward them to https, socks4 and socks5 proxies. If you were to use a http proxy (no https, without connect-method, see proxy article), you could access only http sites, no https sites. Furthermore redsocks can also convert UDP DNS queries to TCP DNS queries.

DNS resolution

The complication (and also advantage/feature) with transparent proxying is, that the internet application (browser, etc.) is not aware of the proxy. Therefore the internet application will attempt to do the DNS resolution itself using the system, not using the proxy. The DNS requests also must be considered. Since Tor does not support UDP, we have to transmit DNS queries via TCP.

It is impossible to resolve DNS directly on the proxy, when using the proxy as a transparent proxy, see Transparent Proxying Method for explanation. You need an extra DNS server, which answers over TCP.

You have several options to resolve DNS.

• A) Tor: Either leave the setup as it is, Tor's DnsPort and therefore the Tor exit relays will still do the DNS requests. (See DNS rule #1.) This is probably not what you want, since you wanted to cloak your identity with an additional proxy after Tor.
• B) Public DNS resolver: Alternatively you can use a public DNS resolver. The instructions for Alternative DNS Resolver should work out of the box (tested). (See DNS rule #2.)

All DNS resolvers should work, as long TCP is supported and as long you are querying a TCP enabled DNS server.

Read the DNS related warnings.

How to setup proxy tunnel-link after Tor (User→Tor→Proxy→Internet)

Unfinished!
Advanced users only!

Everything on Whonix-Workstation.

Get a working proxy and test (with any of the above methods) if it works reliable.

Install redsocks.

sudo apt install redsocks

Enable redsocks autostart.

Open file /etc/default/redsocks in an editor with root rights.

Non-Qubes-Whonix^™

This box uses sudoedit for better security.

sudoedit /etc/default/redsocks

Qubes-Whonix^™

NOTES:

• When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/default/redsocks

• After applying this change, shutdown the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and unspecific to Qubes-Whonix^™.

Others and Alternatives

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/default/redsocks

Look for.

START=no

And replace it with.

START=yes

Configure redsocks by editing /etc/redsocks.conf to your needs.

Open file /etc/redsocks.conf in an editor with root rights.

Non-Qubes-Whonix^™

This box uses sudoedit for better security.

sudoedit /etc/redsocks.conf

Qubes-Whonix^™

NOTES:

• When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/redsocks.conf

• After applying this change, shutdown the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and unspecific to Qubes-Whonix^™.

Others and Alternatives

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/redsocks.conf

Under.

redsocks {

You have to edit.

        ip = 127.0.0.1;
        port = 1080;
        type = socks5

To your needs.

Start redsocks.

sudo service redsocks start

Create a file fw.bsh.

And use the following firewall rules.

TODO: convert to nftables

#!/bin/bash
## These iptables rules redirect the traffic for all users,
## including root, with the exception of the user redsocks,
## through the proxy.

## TODO: these iptables rules need review.
## TODO: use iptables default policy drop.

## Choose either DNS rule #1 or DNS rule #2.

## For debugging/testing use this command in console.
## tail -f /var/log/syslog

## Flush old rules.
iptables -F
iptables -t nat -F
iptables -X

## Allow unlimited traffic on the loopback interface.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT --dst 127.0.0.1 -j ACCEPT

## Established incoming connections are accepted.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

## Established outgoing connections are accepted.
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

## DNS rule #1.
## Allow DNS directly through {{project_name_gateway_short}}.
#iptables -A OUTPUT --dst 10.152.152.10 -p udp --dport 53 -j ACCEPT

## DNS rule #2.
## For DNSCrypt set /etc/resolv.conf to
## nameserver 127.0.0.1
##
## sudo dnscrypt-proxy --tcp-only --user=user
##
## DNSCrypt listening on port 53
iptables -t nat -A OUTPUT --dst 127.0.0.1 -p udp --dport 53 -j ACCEPT
iptables -t nat -A OUTPUT --dst 127.0.0.1 -p tcp --dport 53 -j ACCEPT

## redsocks must be allowed to establish direct connections.
iptables -A OUTPUT -j ACCEPT -m owner --uid-owner redsocks
iptables -t nat -A OUTPUT -j ACCEPT -m owner --uid-owner redsocks

## Redirect remaining traffic to redsocks.
iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-port 12345

## TODO: UDP rule untested.
#iptables -t nat -A OUTPUT -p udp -j REDIRECT --to-port 10053

## Log blocked traffic for debugging.
iptables -A OUTPUT -j LOG --log-level 4 --log-prefix "iptables: "

## Reject all other traffic.
iptables -A OUTPUT -j REJECT

Make the firewall script executable.

sudo chmod +x fw.bsh

Apply the firewall rules.

sudo fw.bsh

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!