#!/usr/bin/bash

#################################
# This config sets up anon user to have all traffic firewalled to go through
# tor

# I developed this on Xubuntu 18.4 LTS ( adapted from one I was using on Arch )

ANON_USER=anon

#############################
#
## IPv6
#

echo "Setting up ipv6 rules"
ip6tables --flush

# Set default chain policies
ip6tables --policy INPUT DROP
ip6tables --policy FORWARD DROP
ip6tables --policy OUTPUT ACCEPT

# Accept on localhost
ip6tables --append INPUT --in-interface lo --jump ACCEPT

# Allow established sessions to receive traffic
ip6tables --append INPUT \
        --match conntrack --ctstate ESTABLISHED,RELATED \
    --jump ACCEPT


# Deny all tcp IPv6 output to $ANON_USER
ip6tables --append OUTPUT \
        ! --out-interface lo \
        --protocol tcp \
            --match owner --uid-owner "$ANON_USER" \
    --jump DROP

# Deny all non-tcp IPv6 output to $ANON_USER
ip6tables --append OUTPUT \
        ! --out-interface lo \
        ! --protocol tcp \
            --match owner --uid-owner "$ANON_USER" \
    --jump DROP

# accept local connections outbound to localhost if nobody objects
ip6tables --append OUTPUT --out-interface lo --jump ACCEPT

ip6tables-save > /etc/iptables/rules.v6

#############################
#
## IPv4
#

echo "Setting up ipv4 rules"
iptables --flush

# Set default chain policies
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT ACCEPT

# Accept on localhost
iptables --append INPUT --in-interface lo --jump ACCEPT

# Allow established sessions to receive traffic
iptables --append INPUT \
        --match conntrack --ctstate ESTABLISHED,RELATED \
    --jump ACCEPT



###################################################
# The following stuff is to set up an anon user firewalled
# to only be able to send traffic via tor. ( haven't installed tor yet )

# all traffic send here goes out through tor
TOR_TRANS_PORT=9040
# does dns via tor
TOR_DNS_PORT=5353

# The normal dns port where dns queries go
DNS_PORT=53


echo "ipv4.$ANON_USER"

# Accept tcp traffic bound for TOR_TRANS_POR for ANON_USER
iptables --table filter \
    --append OUTPUT \
        --protocol tcp \
            --dport "$TOR_TRANS_PORT" \
            --match owner --uid-owner "$ANON_USER" \
    --jump ACCEPT

# Accept udp traffic bound for TOR_DNS_PORT for ANON_USER
iptables --table filter \
    --append OUTPUT \
        --protocol udp \
            --dport "$TOR_DNS_PORT" \
            --match owner --uid-owner "$ANON_USER" \
    --jump ACCEPT

# REDIRECT to TOR_TRANS_PORT all tcp bound for nonlocal interface for ANON_USER
iptables --table nat \
    --append OUTPUT \
        ! --out-interface lo \
        --protocol tcp \
            --match owner --uid-owner "$ANON_USER" \
    --jump REDIRECT --to-ports "$TOR_TRANS_PORT"

# REDIRECT to TOR_DNS_PORT all udp bound for DNS_PORT on nonlocal interface for ANON_USER
iptables --table nat \
    --append OUTPUT \
        ! --out-interface lo \
        --protocol udp \
            --dport "$DNS_PORT" \
            --match owner --uid-owner "$ANON_USER" \
    --jump REDIRECT --to-ports "$TOR_DNS_PORT"

# REJECT all other nontcp traffic on nonlocal interface for ANON_USER
iptables --table filter \
    --append OUTPUT \
        ! --protocol tcp \
            --match owner --uid-owner "$ANON_USER" \
    --jump REJECT

# REDIRECT to TOR_DNS_PORT all udp bound for DNS_PORT on local interface for ANON_USER
iptables --table nat \
    --append OUTPUT \
        --out-interface lo \
        --protocol udp \
            --dport "$DNS_PORT" \
            --match owner --uid-owner "$ANON_USER" \
    --jump REDIRECT --to-ports "$TOR_DNS_PORT"

# REJECT all other nontcp bound on local interface for ANON_USER
iptables --table filter \
    --append OUTPUT \
        --out-interface lo \
        ! --protocol tcp \
            --match owner --uid-owner "$ANON_USER" \
    --jump REJECT


#
# This is to deal with a bug in tor where there was leaking
#
# See https://lists.torproject.org/pipermail/tor-talk/2014-March/032503.html
iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP
 iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP

# accept other local connections outbound to localhost if nobody objects
iptables --append OUTPUT --out-interface lo --jump ACCEPT
# WARNING WARNING WARNING
# Any server listening on the local interface that is running as another user
# may forward traffic sent to it over clearnet!  The systemd dns server does
# this unless ( above ) we redirect local traffic to that server to go
# through tor.  THERE MAY BE OTHER CASES OF THIS hidden in the woodwork..
# I don't THINK there are, but I don't know lots of things.

iptables-save > /etc/iptables/rules.v4


echo "
# PUT THIS IN /etc/tor/torrc and restart tor + remove single # comment chars

## TRANSPARENT PROXY
VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 5353

I tested this with

# Check for congradulations you are using tor ( and check again after reboot til you know iptables-persistent is working )

lynx http://check.torproject.org

# This is the onion address for endchan.  Regular dns doesn't know about onion
# so if this is redirected and you see endchan, your dns is being redirected through tor.

lynx  http://enxx3byspwsdo446jujc52ucy2pf5urdbhqw3kbsfhlfjwmbpj5smdad.onion/

Though dns works w/lynx browser firefox still needs to be told to do socks5 proxy 127.0.0.1 9050 and to proxy dns through socks5

You can still use tor browser under this config if you really care.

"