Skip to content

Commit cbf186a

Browse files
juhanurmijuhanurmi
committed
Additional settings for Tor relay.
1 parent da009a6 commit cbf186a

File tree

5 files changed

+185
-27
lines changed

5 files changed

+185
-27
lines changed

‎README.md

+17
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,20 @@ Electronic Frontier Finland (Effi) - Tor Exit Node
44
Electronic Frontier Finland (Effi) is a Finnish on-line civil rights organization founded in 2001. While not formally affiliated with the U.S.-based Electronic Frontier Foundation, the two organizations share many of their goals. Effi is a member of the Global Internet Liberty Campaign and a founding member of European Digital Rights (EDRi).
55

66
[Exit-tyyppisen reitittimen jakelema ilmoitussivu / Tor Exit Node info page.](http://htmlpreview.github.io/?https://github.com/juhanurmi/exitnode/blob/master/tor-exit-notice.html)
7+
8+
```sh
9+
sudo bash remove.sh
10+
sudo apt-get update && sudo apt-get upgrade
11+
sudo rpi-update
12+
sudo apt-get install haveged
13+
sudo apt-get install tor
14+
sudo cp torrc /etc/tor/torrc
15+
sudo cp tor-exit-notice.html /etc/tor/tor-exit-notice.html
16+
sudo cp sysctl.conf /etc/sysctl.conf
17+
sudo cp rules.v4 /etc/iptables/rules.v4
18+
sudo apt-get install iptables-persistent
19+
sudo modprobe ip_conntrack
20+
sudo service iptables-persistent restart
21+
sudo sysctl -p /etc/sysctl.conf
22+
sudo service tor restart
23+
```

‎remove.sh

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# BACKUP interfaces in case this script removes it
2+
sudo cp /etc/network/interfaces /etc/network/interfaces.bak
3+
4+
# GUI-related packages
5+
pkgs="
6+
x11-common
7+
xserver-xorg-video-fbdev
8+
xserver-xorg xinit
9+
gstreamer1.0-x gstreamer1.0-omx gstreamer1.0-plugins-base
10+
gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-alsa
11+
gstreamer1.0-libav
12+
epiphany-browser
13+
lxde lxtask menu-xdg gksu
14+
xserver-xorg-video-fbturbo
15+
xpdf gtk2-engines alsa-utils
16+
netsurf-gtk zenity
17+
desktop-base lxpolkit
18+
weston
19+
omxplayer
20+
raspberrypi-artwork
21+
lightdm gnome-themes-standard-data gnome-icon-theme
22+
qt50-snapshot qt50-quick-particle-examples
23+
"
24+
25+
# Edu-related packages
26+
pkgs="$pkgs
27+
idle python3-pygame python-pygame python-tk
28+
idle3 python3-tk
29+
python3-rpi.gpio
30+
python-serial python3-serial
31+
python-picamera python3-picamera
32+
python3-pygame python-pygame python-tk
33+
python3-tk
34+
debian-reference-en dillo x2x
35+
scratch nuscratch
36+
timidity
37+
smartsim penguinspuzzle
38+
pistore
39+
sonic-pi
40+
python3-numpy
41+
python3-pifacecommon python3-pifacedigitalio python3-pifacedigital-scratch-handler python-pifacecommon python-pifacedigitalio
42+
oracle-java8-jdk
43+
minecraft-pi python-minecraftpi
44+
wolfram-engine
45+
"
46+
# Because of of https://github.com/RPi-Distro/raspberrypi-ui-mods/issues/2 (thanks @robertely)
47+
apt-get -y remove raspberrypi-ui-mods
48+
49+
# Remove packages
50+
for i in $pkgs; do
51+
echo apt-get -y remove --purge $i
52+
done
53+
54+
# Remove automatically installed dependency packages
55+
echo apt-get -y autoremove
56+
57+
# Remove all packages marked rc (thanks @symm)
58+
dpkg --list |grep "^rc" | cut -d " " -f 3 | xargs dpkg --purge
59+
60+
# Return interfaces if needed
61+
sudo cp /etc/network/interfaces.bak /etc/network/interfaces

‎rules.v4

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
*raw
2+
-A PREROUTING -j NOTRACK
3+
-A OUTPUT -j NOTRACK
4+
COMMIT
5+
6+
*filter
7+
:INPUT ACCEPT [0:0]
8+
:FORWARD DROP [0:0]
9+
:OUTPUT ACCEPT [0:0]
10+
11+
## Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
12+
-A INPUT -i lo -j ACCEPT
13+
14+
## allow incoming SSH, port 22
15+
-A INPUT -p tcp --dport 22 -j ACCEPT
16+
17+
## DirPort, ORPort (optional: Webserver)
18+
-A INPUT -p tcp --dport 80 -j ACCEPT
19+
-A INPUT -p tcp --dport 443 -j ACCEPT
20+
21+
## Allow several ICMP types
22+
## http://www.oregontechsupport.com/articles/icmp.txt
23+
-A INPUT -p icmp -m icmp --icmp-type host-unreachable -j ACCEPT
24+
-A INPUT -p icmp -m icmp --icmp-type port-unreachable -j ACCEPT
25+
-A INPUT -p icmp -m icmp --icmp-type fragmentation-needed -j ACCEPT
26+
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
27+
-A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT
28+
-A INPUT -p icmp --icmp-type echo-request -j DROP
29+
30+
## to log denied packets uncomment this line
31+
#-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
32+
33+
## drop non-established TCP
34+
-A INPUT -p tcp --syn -j DROP
35+
36+
## allows all udp in, but avoids conntrack
37+
38+
COMMIT

‎sysctl.conf

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# used on high bandwidth nodes
2+
3+
kernel.printk = 3 4 1 3
4+
vm.swappiness=1
5+
vm.min_free_kbytes = 8192
6+
7+
# TCP settings
8+
9+
# disabling forwarding first as this will
10+
# reset some other values back to default (!)
11+
net.ipv4.ip_forward = 0
12+
net.ipv4.tcp_syncookies = 1
13+
#net.ipv4.tcp_synack_retries = 2
14+
#net.ipv4.tcp_syn_retries = 2
15+
16+
net.ipv4.conf.default.forwarding = 0
17+
net.ipv4.conf.default.proxy_arp = 0
18+
net.ipv4.conf.default.send_redirects = 1
19+
net.ipv4.conf.all.rp_filter = 0
20+
net.ipv4.conf.all.send_redirects = 0
21+
22+
kernel.sysrq = 1
23+
net.ipv4.icmp_echo_ignore_broadcasts = 1
24+
net.ipv4.conf.all.accept_redirects = 0
25+
net.ipv4.icmp_ignore_bogus_error_responses = 1
26+
27+
# optimizations
28+
net.core.rmem_max = 33554432
29+
net.core.wmem_max = 33554432
30+
net.ipv4.tcp_rmem = 4096 87380 33554432
31+
net.ipv4.tcp_wmem = 4096 65536 33554432
32+
net.core.netdev_max_backlog = 262144
33+
net.ipv4.tcp_no_metrics_save = 1
34+
net.ipv4.tcp_moderate_rcvbuf = 1
35+
net.ipv4.tcp_tw_recycle = 1
36+
net.ipv4.tcp_max_orphans = 262144
37+
net.ipv4.tcp_max_syn_backlog = 262144
38+
net.ipv4.tcp_fin_timeout = 4
39+
vm.min_free_kbytes = 65536
40+
net.ipv4.netfilter.ip_conntrack_max = 196608
41+
net.netfilter.nf_conntrack_tcp_timeout_established = 7200
42+
net.netfilter.nf_conntrack_checksum = 0
43+
net.netfilter.nf_conntrack_max = 196608
44+
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 15
45+
net.nf_conntrack_max = 196608
46+
net.ipv4.tcp_keepalive_time = 60
47+
net.ipv4.tcp_keepalive_intvl = 10
48+
net.ipv4.tcp_keepalive_probes = 3
49+
net.ipv4.ip_local_port_range = 1025 65530
50+
net.core.somaxconn = 20480
51+
net.ipv4.tcp_max_tw_buckets = 2000000
52+
net.ipv4.tcp_timestamps = 0

‎torrc_example

+17-27
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,23 @@
11
## Required: what port to advertise for incoming Tor connections.
22
ORPort 443
33

4-
# mirror directory information for others
4+
# mirror directory information for others
55
DirPort 80
66

77
## Required: A unique handle for this server. Choose one.
88
Nickname Dignify01
99

10-
## Contact info to be published in the directory, so we can contact you
11-
## if your relay is misconfigured or something else goes wrong. Google
12-
## indexes this, so spammers might also collect it.
13-
ContactInfo juha.nurmi<att>ahmia.fi
14-
15-
## The IP or fqdn for this server. Leave commented out and Tor will guess.
16-
## This may be required, if tor cannot guess your public IP.
17-
Address SET_IP_ADDRESS_HERE
10+
## Contact info to be published in the directory, so we can contact you
11+
## if your relay is misconfigured or something else goes wrong. Google
12+
## indexes this, so spammers might also collect it.
13+
ContactInfo juha.nurmi<<a>>ahmia.fi
1814

1915
## Uncomment to return an arbitrary blob of html on your DirPort.
2016
DirPortFrontPage /etc/tor/tor-exit-notice.html
2117

22-
OutboundBindAddress SET_IP_ADDRESS_HERE
23-
2418
RunAsDaemon 1
2519
AvoidDiskWrites 1
26-
#MaxMemInQueues 256 M
2720

28-
## To limit your bandwidth usage, define this. Note that BandwidthRate
29-
## must be at least 20 KB.
30-
#BandwidthRate 30720 KB # Throttle traffic to 10240KB/s
31-
#BandwidthBurst 51200 KB # But allow bursts up to 20480KB/s
32-
33-
ExitPolicy reject 0.0.0.0/8:*
34-
ExitPolicy reject 169.254.0.0/16:*
35-
ExitPolicy reject 127.0.0.0/8:*
36-
ExitPolicy reject 192.168.0.0/16:*
37-
ExitPolicy reject 10.0.0.0/8:*
38-
ExitPolicy reject 172.16.0.0/12:*
39-
ExitPolicy reject SET_IP_ADDRESS_HERE:*
4021
ExitPolicy accept *:20-23 # FTP, SSH, telnet
4122
ExitPolicy accept *:43 # WHOIS
4223
ExitPolicy accept *:53 # DNS
@@ -49,17 +30,24 @@ ExitPolicy accept *:220 # IMAP3
4930
ExitPolicy accept *:389 # LDAP
5031
ExitPolicy accept *:443 # HTTPS
5132
ExitPolicy accept *:464 # kpasswd
33+
ExitPolicy accept *:465 # URD for SSM (more often: an alternative SUBMISSION port, see 587)
5234
ExitPolicy accept *:531 # IRC/AIM
5335
ExitPolicy accept *:543-544 # Kerberos
5436
ExitPolicy accept *:554 # RTSP
5537
ExitPolicy accept *:563 # NNTP over SSL
38+
ExitPolicy accept *:587 # SUBMISSION (authenticated clients [MUA's like Thunderbird] send mail over STARTTLS SMTP here)
5639
ExitPolicy accept *:636 # LDAP over SSL
5740
ExitPolicy accept *:706 # SILC
5841
ExitPolicy accept *:749 # kerberos
5942
ExitPolicy accept *:873 # rsync
6043
ExitPolicy accept *:902-904 # VMware
6144
ExitPolicy accept *:981 # Remote HTTPS management for firewall
62-
ExitPolicy accept *:989-995 # FTP over SSL, Netnews Administration System, telnets, IMAP over SSL, ircs, POP3 over SSL
45+
ExitPolicy accept *:989-990 # FTP over SSL
46+
ExitPolicy accept *:991 # Netnews Administration System
47+
ExitPolicy accept *:992 # TELNETS
48+
ExitPolicy accept *:993 # IMAP over SSL
49+
ExitPolicy accept *:994 # IRCS
50+
ExitPolicy accept *:995 # POP3 over SSL
6351
ExitPolicy accept *:1194 # OpenVPN
6452
ExitPolicy accept *:1220 # QT Server Admin
6553
ExitPolicy accept *:1293 # PKT-KRB-IPSec
@@ -91,8 +79,9 @@ ExitPolicy accept *:8000 # iRDMI
9179
ExitPolicy accept *:8008 # HTTP alternate
9280
ExitPolicy accept *:8074 # Gadu-Gadu
9381
ExitPolicy accept *:8080 # HTTP Proxies
82+
ExitPolicy accept *:8082 # HTTPS Electrum Bitcoin port
9483
ExitPolicy accept *:8087-8088 # Simplify Media SPP Protocol, Radan HTTP
95-
ExitPolicy accept *:8332-8333 # BitCoin
84+
ExitPolicy accept *:8332-8333 # Bitcoin
9685
ExitPolicy accept *:8443 # PCsync HTTPS
9786
ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE
9887
ExitPolicy accept *:9418 # git
@@ -101,5 +90,6 @@ ExitPolicy accept *:10000 # Network Data Management Protocol
10190
ExitPolicy accept *:11371 # OpenPGP hkp (http keyserver protocol)
10291
ExitPolicy accept *:19294 # Google Voice TCP
10392
ExitPolicy accept *:19638 # Ensim control panel
93+
ExitPolicy accept *:50002 # Electrum Bitcoin SSL
94+
ExitPolicy accept *:64738 # Mumble
10495
ExitPolicy reject *:*
105-

0 commit comments

Comments
 (0)