run ss&kcp&tor on openwrt, provide a transparent proxy for pc/phone
- tor-router-nexx-wt3020 https://github.com/enovella/tor-router-nexx-wt3020
- openwrt-ss-kcp https://github.com/boxhg/openwrt-ss-kcp
Wan: 10.0.0.1 Lan: 192.168.0.1
- kcptun-client : 12345, (tcp tunnel for ss)
- ss-local : 1080, (Socks5 Proxy for tor)
- Tor-SocksPort: 9050 (Socks5 Proxy for tor)
- Tor-TransPort: 9040 (Transparent Proxy )
- Tor-DnsPort: 9053 (UDP Proxy)
The network Traffic is:
client device(pc,mobile) ---> Openwrt { tor:9040 --> ss:1080 --> kcp:12345 } ---> Internet
Dns traffic:
client's dns query --> Openwrt { Router:53 -> Tor-Dns: 9053} ---> Internet
See here: Run OpenWrt 18.06.2 with SS+Kcp On VMware
opkg install tor
opkg install tor-geoip
User tor
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
SocksPort 127.0.0.1:9050
SocksPort 192.168.0.1:9050
TransPort 192.168.0.1:9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort
TransPort 127.0.0.1:9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort
DNSPort 127.0.0.1:9053
DNSPort 192.168.0.1:9053
# GeoIP for stats
GeoIPFile /usr/share/tor/geoip
GeoIPv6File /usr/share/tor/geoip6
# Tweaks
CircuitBuildTimeout 5
KeepalivePeriod 60
NewCircuitPeriod 15
NumEntryGuards 8
Socks5Proxy localhost:1080
ExcludeNodes {us},{hk},{mo},{sg},{th}
ExcludeExitNodes {us},{hk},{mo},{sg},{th}
ExitNodes {ru}
iptables -t nat -A PREROUTING -i br-lan -s $(uci get network.lan.ipaddr)/$(ipcalc.sh $(uci get network.lan.ipaddr) $(uci get network.lan.netmask)|grep PREFIX|cut -d "=" -f 2) -d $(uci get network.lan.ipaddr) -j RETURN # DNT
#iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 9053 # DNT
iptables -t nat -A PREROUTING -i br-lan -p tcp --syn -j REDIRECT --to-ports 9040 # DNT
# Drop ICMP # DNT
#iptables -A INPUT -p icmp --icmp-type 8 -j DROP # DNT
# security rules from https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html # DNT
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP # DNT
#iptables -A OUTPUT -m state --state INVALID -j DROP # DNT
# security rules to prevent kernel leaks from link above # DNT
iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP # DNT
iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP # DNT
# disable chrome and firefox udp leaks # DNT
iptables -t nat -A PREROUTING -p udp -m multiport --dport 3478,19302 -j REDIRECT --to-ports 9999 # DNT
iptables -t nat -A PREROUTING -p udp -m multiport --sport 3478,19302 -j REDIRECT --to-ports 9999 # DNT
enter Network-DHCP/DNS:
General Settings
DNS Forwarder: 127.0.0.1#9053
Resolv and Hosts Files:(Must checked)
Ignore resolve file: checked