Zrobiłem to w końcu -- puściłem cały ruch z wifi do kanału tora, z tym, że po swojemu ale działa. 
Rozdzieliłem sobie adresy na wire i wifi, odpowiednio na 192.168.1.0/24 oraz 10.168.1.0/24 -- w tym celu trzeba wyedytować 3 pliki:
plik /etc/config/dhcp:
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '24h'
...
config dhcp wifi
option interface wifi
option start 100
option stop 150
option leasetime 1h
plik /etc/config/network:
...
config interface 'lan'
option ifname 'eth1'
...
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
...
config interface wifi
option ifname wlan0
option proto static
option ipaddr 10.168.1.1
option netmask 255.255.255.0
plik /etc/config/wireless:
...
config wifi-iface
option device 'radio0'
option network 'wifi'
# option network 'lan'
...
Czyli z grubsza to samo co było w linku.
Po restarcie dnsmasq powinno w logu pisać coś takiego:
Fri Aug 22 12:25:57 2014 daemon.info dnsmasq-dhcp[1824]: DHCP, IP range 10.168.1.100 -- 10.168.1.249, lease time 1h
Fri Aug 22 12:25:57 2014 daemon.info dnsmasq-dhcp[1824]: DHCP, IP range 192.168.1.100 -- 192.168.1.249, lease time 1d
Do mojego skryptu iptables dodałem te poniższe regułki:
iptables -t filter -I tcp -i wlan0 -p tcp --dport 9040 -j ACCEPT
iptables -t filter -I udp -i wlan0 -p udp --dport 9053 -j ACCEPT
iptables -t nat -I PREROUTING -i wlan0 -p tcp --syn -j REDIRECT --to-ports 9040
iptables -t nat -I PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT --to-ports 9053
Bez nich, przy sprawdzaniu ip, pokazuje moje rzeczywiste ip, z nimi losowe ip tora.
Tablica nat wygląda jak poniżej:
# Generated by iptables-save v1.4.21 on Fri Aug 22 12:30:25 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [4:251]
:OUTPUT ACCEPT [4:304]
:POSTROUTING ACCEPT [4:304]
-A PREROUTING -i wlan0 -p udp -m udp --dport 53 -j REDIRECT --to-ports 9053
-A PREROUTING -i wlan0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.168.1.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Aug 22 12:30:25 2014
Poniżej jest tablica filter:
# Generated by iptables-save v1.4.21 on Fri Aug 22 12:30:25 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [4:304]
:fw-interfaces - [0:0]
:fw-open - [0:0]
:tcp - [0:0]
:udp - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p udp -m conntrack --ctstate NEW -j udp
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j tcp
-A INPUT -p tcp -m recent --set --name tcp-portscan --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m recent --set --name udp-portscan --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j fw-interfaces
-A FORWARD -j fw-open
-A FORWARD -j REJECT --reject-with icmp-host-unreachable
-A OUTPUT -m conntrack --ctstate INVALID -j DROP
-A fw-interfaces -s 192.168.1.0/24 -i br-lan -j ACCEPT
-A fw-interfaces -s 10.168.1.0/24 -i wlan0 -j ACCEPT
-A tcp -i wlan0 -p tcp -m tcp --dport 9040 -j ACCEPT
-A tcp -s 192.168.1.0/24 -i br-lan -p tcp -j ACCEPT
-A tcp -s 10.168.1.0/24 -i wlan0 -p tcp -j ACCEPT
-A tcp -p tcp -m recent --update --seconds 300 --name tcp-portscan --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A udp -i wlan0 -p udp -m udp --dport 9053 -j ACCEPT
-A udp -s 192.168.1.0/24 -i br-lan -p udp -j ACCEPT
-A udp -s 10.168.1.0/24 -i wlan0 -p udp -j ACCEPT
-A udp -p udp -m recent --update --seconds 300 --name udp-portscan --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A udp -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m conntrack --ctstate NEW -m comment --comment DHCP-broadcast -j ACCEPT
-A udp -s 192.168.220.220/32 -p udp -m udp --dport 68 -m conntrack --ctstate NEW -m comment --comment Allow-DHCP-Renew -j ACCEPT
COMMIT
# Completed on Fri Aug 22 12:30:25 2014
Konfiguracja samego tora wygląda tak:
root@red_viper:~# cat /etc/tor/torrc
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
TransListenAddress 10.168.1.1
DNSPort 9053
DNSListenAddress 10.168.1.1
DataDirectory /tmp/.tor
RunAsDaemon 1
User tor
Log notice file /tmp/tor.log
I jeszcze log z klienta, z obu interfejsów mojego lapka:
root:~# /etc/init.d/networking start
Configuring network interfaces...Internet Systems Consortium DHCP Client 4.3.1
Copyright 2004-2014 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Listening on LPF/eth1/3c:4a:92:00:4c:5b
Sending on LPF/eth1/3c:4a:92:00:4c:5b
Sending on Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 3
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPREQUEST on eth1 to 255.255.255.255 port 67
DHCPOFFER from 192.168.1.1
DHCPACK from 192.168.1.1
bound to 192.168.1.150 -- renewal in 40665 seconds.
Internet Systems Consortium DHCP Client 4.3.1
Copyright 2004-2014 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Listening on LPF/wlan0/c0:cb:38:01:f0:f5
Sending on LPF/wlan0/c0:cb:38:01:f0:f5
Sending on Socket/fallback
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 3
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 6
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPOFFER from 10.168.1.1
DHCPACK from 10.168.1.1
bound to 10.168.1.113 -- renewal in 1554 seconds.
root:~# ping -c 3 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.340 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.289 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.334 ms
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.289/0.321/0.340/0.022 ms
root:~# ping -c 3 10.168.1.1
PING 10.168.1.1 (10.168.1.1) 56(84) bytes of data.
64 bytes from 10.168.1.1: icmp_seq=1 ttl=64 time=2.04 ms
64 bytes from 10.168.1.1: icmp_seq=2 ttl=64 time=0.826 ms
64 bytes from 10.168.1.1: icmp_seq=3 ttl=64 time=0.810 ms
--- 10.168.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.810/1.227/2.047/0.580 ms
root:~# ip route show
default via 192.168.1.1 dev eth1
10.168.1.0/24 dev wlan0 proto kernel scope link src 10.168.1.113
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.150
192.168.10.0/24 dev br_lxc proto kernel scope link src 192.168.10.100
root:~# ifconfig eth1
eth1 Link encap:Ethernet HWaddr 3c:4a:92:00:4c:5b
inet addr:192.168.1.150 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fdc6:5ebf:4a60:0:3e4a:92ff:fe00:4c5b/64 Scope:Global
inet6 addr: fe80::3e4a:92ff:fe00:4c5b/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11042 errors:0 dropped:0 overruns:0 frame:0
TX packets:10878 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9908506 (9.4 MiB) TX bytes:1106654 (1.0 MiB)
root:~# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr c0:cb:38:01:f0:f5
inet addr:10.168.1.113 Bcast:10.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::c2cb:38ff:fe01:f0f5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:15027 errors:0 dropped:0 overruns:0 frame:0
TX packets:16875 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10243273 (9.7 MiB) TX bytes:2133089 (2.0 MiB)
IP po odłączeniu kabla:
Your IP Address Is:
94.242.246.24
Your IP Details:
ISP: root SA
Services: Tor Exit Node
Recently report forum spam source.
Country: Anonymous Proxy
Jak dla mnie działa, czy coś jeszcze powinno być?
