Skip to content

Instantly share code, notes, and snippets.

@safeith
Last active March 7, 2020 22:06
Show Gist options
  • Save safeith/06c6f672c273528e492d12351739b991 to your computer and use it in GitHub Desktop.
Save safeith/06c6f672c273528e492d12351739b991 to your computer and use it in GitHub Desktop.
#!/bin/bash
action=$1
if [ "$action" == "" ]
then
echo -e "\e[1mUsage:\e[0m"
echo -e " To TORIFY whole system run: torification enable"
echo -e " To UNTORIFY run: torification disable"
echo -e " To check STATUS run: torification status"
fi
cat <<EOF > /tmp/tor-fw.rules
*nat
:PREROUTING ACCEPT [6:2126]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [17:6239]
:POSTROUTING ACCEPT [6:408]
-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -o lo -j RETURN
--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN
-A OUTPUT -m owner --uid-owner "debian-tor" -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
--ipv6 -A INPUT -j REJECT
--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m owner --uid-owner "debian-tor" -j ACCEPT
--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
--ipv6 -A OUTPUT -j REJECT
COMMIT
EOF
checkIP(){
IP=$(curl -s https://ifconfig.me)
}
checkTor(){
connected_to_tor=false
check_torproject_org=$(curl -s https://check.torproject.org/ | cat | grep -m 1 Congratulations | xargs)
if [ "$check_torproject_org" == "Congratulations. This browser is configured to use Tor." ]
then
connected_to_tor=true
fi
}
if [ "$action" == "enable" ]
then
sudo iptables-restore < /tmp/tor-fw.rules
checkIP
echo -e "\e[1m\e[32mYou connected to TOR network \nTOR IP: $IP"
rm -rf /tmp/tor-fw.rules
fi
if [ "$action" == "status" ]
then
checkTor
if [ "$connected_to_tor" == true ]
then
checkIP
echo -e "\e[1m\e[32mYou are connected to TOR network \nTOR IP: $IP"
else
echo -e "\e[31mYou are not connected to TOR"
fi
fi
if [ "$action" == "disable" ]
then
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -t raw -F
sudo iptables -t raw -X
echo -e "\e[31mYou disconnected form TOR network"
fi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment