68 lines
2.3 KiB
Plaintext
68 lines
2.3 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
define vpn_port=6174
|
|
define vpn_if=tun0
|
|
define outside_if=enp0s17
|
|
define vpn_subnet=10.10.10.0/24
|
|
|
|
define vpn_port_tor=6175
|
|
define vpn_if_tor=tun1
|
|
define vpn_subnet_tor=10.10.20.0/24
|
|
|
|
table inet filter {
|
|
|
|
|
|
chain input {
|
|
# allow OpenVPN connections to the Server
|
|
udp dport $vpn_port accept
|
|
|
|
# allow OpenVPN TOR connections to the Server
|
|
udp dport $vpn_port_tor accept
|
|
}
|
|
|
|
chain forward {
|
|
#Drop forwarded packets if they are not matched
|
|
type filter hook forward priority 0; policy drop;
|
|
|
|
# allow existing connections
|
|
ct state related,established accept
|
|
|
|
# allow packets from vpn interface
|
|
iifname $vpn_if oifname $outside_if accept
|
|
|
|
# allow packets from vpn interface
|
|
iifname $vpn_if_tor oifname $outside_if accept
|
|
}
|
|
|
|
chain output {
|
|
## Transproxy leak blocked:
|
|
# https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy#WARNING
|
|
ct state invalid counter drop
|
|
oifname != "lo" ip saddr != 127.0.0.1 ip daddr != 127.0.0.1 tcp flags & (fin|ack) == fin|ack counter drop
|
|
oifname != "lo" ip saddr != 127.0.0.1 ip daddr != 127.0.0.1 tcp flags & (rst|ack) == rst|ack counter drop
|
|
}
|
|
|
|
}
|
|
|
|
# create a ipv4 table only for NAT entries (you need both chains even if they're empty)
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100;
|
|
|
|
# enable NAT for VPN
|
|
iifname $vpn_if oifname $outside_if ip saddr $vpn_subnet masquerade
|
|
|
|
# enable NAT for TOR VPN
|
|
iifname $vpn_if_tor oifname $outside_if ip saddr $vpn_subnet_tor masquerade
|
|
}
|
|
|
|
chain prerouting {
|
|
# Transparent proxy to TOR
|
|
type nat hook prerouting priority 0;
|
|
iifname $vpn_if_tor ip saddr $vpn_subnet_tor udp dport 53 counter dnat to 10.10.20.1:53530
|
|
iifname $vpn_if_tor ip protocol tcp ip saddr $vpn_subnet_tor counter dnat to 10.10.20.1:9040
|
|
iifname $vpn_if_tor ip protocol udp ip saddr $vpn_subnet_tor counter dnat to 10.10.20.1:9040
|
|
}
|
|
|
|
} |