From 97f63b4739f2f0d5ed680997583908a063d9bdbe Mon Sep 17 00:00:00 2001
From: Marek Paśnikowski <marekpasnikowski@protonmail.com>
Date: Thu, 21 Apr 2022 18:08:24 +0200
Subject: Force All Internet Traffic Through Tor

* iptables.tor.rules: Import firewall rules from Arch Wiki
describing Transparent Torification ...
* system-configuration (iptables-configuration): ... and use them here.
---
 iptables.tor.rules       | 35 +++++++++++++++++++++++++++++++++++
 system-configuration.scm |  6 ++++++
 2 files changed, 41 insertions(+)
 create mode 100644 iptables.tor.rules

diff --git a/iptables.tor.rules b/iptables.tor.rules
new file mode 100644
index 0000000..d0a7454
--- /dev/null
+++ b/iptables.tor.rules
@@ -0,0 +1,35 @@
+*nat
+:PREROUTING ACCEPT [6:2126]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [17:6239]
+:POSTROUTING ACCEPT [6:408]
+
+-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
+-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
+-A OUTPUT -o lo -j RETURN
+--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN
+-A OUTPUT -m owner --uid-owner "tor" -j RETURN
+-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
+-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
+COMMIT
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
+--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
+--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
+--ipv6 -A INPUT -j REJECT
+--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
+--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
+--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT
+-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -m owner --uid-owner "tor" -j ACCEPT
+--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
+--ipv6 -A OUTPUT -j REJECT
+COMMIT
diff --git a/system-configuration.scm b/system-configuration.scm
index 38f9c39..213d60e 100644
--- a/system-configuration.scm
+++ b/system-configuration.scm
@@ -45,6 +45,12 @@
     ( append
       ( list
         ( service cups-service-type )
+        ( service iptables-service-type
+          ( iptables-configuration
+            ( ipv4-rules
+              ( local-file "iptables.tor.rules" ) )
+            ( ipv6-rules
+              ( local-file "iptables.tor.rules" ) ) ) )
         ( service openssh-service-type )
         ( service gnome-desktop-service-type )
         ( service tor-service-type
-- 
cgit v1.2.3