Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- SPECIAL_ADDRS='255.255.255.255/32 240.0.0.0/4 233.252.0.0/24 224.0.0.0/4 203.0.113.0/24 198.51.100.0/24 198.18.0.0/15 192.168.0.0/16 192.88.99.0/24 192.0.2.0/24 192.0.0.0/24 172.16.0.0/12 169.254.0.0/16 127.0.0.0/8 100.64.0.0/10 10.0.0.0/8 0.0.0.0/8'
- # ---
- [ $EUID != 0 ] && echo run as root! && exit
- # ---
- if [ "$1" == "-F" ]; then
- iptables -F; iptables -t nat -F; iptables -P INPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -P OUTPUT ACCEPT; iptables -nvL; iptables -t nat -nvL
- chattr -f -i /etc/resolv.conf; echo nameserver 1.1.1.1 > /etc/resolv.conf; chattr -f +i /etc/resolv.conf
- exit
- fi
- # ---
- apt update
- apt install tor
- # ---
- iptables -F; iptables -t nat -F
- iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT DROP
- # ---
- iptables -A INPUT -m state --state INVALID -j DROP
- iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
- iptables -A INPUT -i lo -j ACCEPT
- iptables -A INPUT -j DROP
- # ---
- iptables -A FORWARD -j DROP
- # ---
- iptables -A OUTPUT -m state --state INVALID -j DROP
- iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -p udp -d 127.0.0.1 --dport 9053 -j ACCEPT
- iptables -A OUTPUT -p tcp -d 127.0.0.1 --dport 9040 --syn -j ACCEPT
- iptables -A OUTPUT -p tcp -m owner --uid-owner debian-tor -m state --state NEW --syn -j ACCEPT
- iptables -A OUTPUT -o lo -j ACCEPT
- for special_addr in $SPECIAL_ADDRS; do
- iptables -A OUTPUT -d $special_addr -j DROP
- done
- iptables -A OUTPUT -j DROP
- # ---
- iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination='127.0.0.1:9053'
- iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 --syn -j DNAT --to-destination='127.0.0.1:9040'
- iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner debian-tor --syn -j RETURN
- iptables -t nat -A OUTPUT -o lo -j RETURN
- for special_addr in $SPECIAL_ADDRS; do
- iptables -t nat -A OUTPUT -d $special_addr -j RETURN
- done
- iptables -t nat -A OUTPUT -p tcp --syn -j DNAT --to-destination='127.0.0.1:9040'
- # ---
- ip6tables -F; ip6tables -t nat -F
- ip6tables -P INPUT DROP; ip6tables -P FORWARD DROP; ip6tables -P OUTPUT DROP
- ip6tables -A INPUT -j DROP; ip6tables -A FORWARD -j DROP; ip6tables -A OUTPUT -j DROP
- # ---
- iptables -nvL; iptables -t nat -nvL
- # ---
- {
- echo DNSPort 127.0.0.1:9053
- echo AutomapHostsOnResolve 1
- echo AutomapHostsSuffixes .onion
- echo
- echo TransPort 127.0.0.1:9040
- echo VirtualAddrNetwork 10.192.0.0/10
- } > /etc/tor/torrc && systemctl restart tor
- # ---
- chattr -f -i /etc/hosts.allow && > /etc/hosts.allow && chattr -f +i /etc/hosts.allow
- chattr -f -i /etc/hosts.deny && echo ALL:ALL > /etc/hosts.deny && chattr -f +i /etc/hosts.deny
- chattr -f -i /etc/resolv.conf && echo nameserver 127.0.0.1 > /etc/resolv.conf && chattr -f +i /etc/resolv.conf
Add Comment
Please, Sign In to add comment