core-v3

#!/bin/sh -eu

# ---

# core v3
# The Unlicense

# ---

type tor || exit 1
[ $(id -u) -ne 0 ] && echo 'run as root !' && exit 2

# ---

PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
DNS_PORT=9053; TRANS_PORT=9040; VIRTUAL_ADDR=10.192.0.0/10; TOR_UID='debian-tor'
RESERVED_IP='255.255.255.255/32 240.0.0.0/4 233.252.0.0/24 224.0.0.0/4 203.0.113.0/24 198.51.100.0/24 198.18.0.0/15 192.168.0.0/16 192.88.99.0/24 192.0.2.0/24 192.0.0.0/24 172.16.0.0/12 169.254.0.0/16 127.0.0.0/8 100.64.0.0/10 10.0.0.0/8 0.0.0.0/8'

# ---

iptables -t nat -F; iptables -t nat -X; iptables -t nat -Z

# ---

iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports $DNS_PORT
iptables -t nat -A OUTPUT -p tcp -d $VIRTUAL_ADDR --syn -j REDIRECT --to-ports $TRANS_PORT

iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
iptables -t nat -A OUTPUT -o lo -j RETURN

for reserved_ip in $RESERVED_IP; do
  iptables -t nat -A OUTPUT -d $reserved_ip -j RETURN
done

iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT

# ---

iptables -t nat -nvL

# ---

iptables -F; iptables -X; iptables -Z

# ---

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j DROP
iptables -P INPUT DROP

# ---

iptables -A FORWARD -j DROP
iptables -P FORWARD DROP

# ---

iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p udp -d 127.0.0.1 --dport $DNS_PORT -j ACCEPT
iptables -A OUTPUT -p tcp -d 127.0.0.1 --dport $TRANS_PORT --syn -j ACCEPT

iptables -A OUTPUT -p tcp -m owner --uid-owner $TOR_UID -m state --state NEW --syn -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1 -o lo -j ACCEPT

for reserved_ip in $RESERVED_IP; do
  iptables -A OUTPUT -d $reserved_ip -j DROP
done

iptables -A OUTPUT -j DROP
iptables -P OUTPUT DROP

# ---

iptables -nvL

# ---

[ ! -e /etc/tor/torrc.bak ] && cp -v /etc/tor/torrc /etc/tor/torrc.bak

# ---

{
  echo DNSPort 127.0.0.1:$DNS_PORT
  echo AutomapHostsOnResolve 1
  echo AutomapHostsSuffixes .onion
  echo
  echo TransPort 127.0.0.1:$TRANS_PORT
  echo VirtualAddrNetwork $VIRTUAL_ADDR
} > /etc/tor/torrc; cat /etc/tor/torrc; /etc/init.d/tor restart