I have an SSH tunnel set up (on Linux) and I want to route all my network traffic through it, except that I also have Tor running and I do not want Tor traffic to go through the SSH tunnel. I can route all traffic through the SSH tunnel by using redsocks (I make SSH run a SOCKS proxy, run redsocks, and use an iptables rule to redirect all traffic to redsocks, so all traffic goes through the tunnel).

However I do not know how to have Tor avoid the tunnel and make direct connections... iptables used to have a --pid-owner option which would have been perfect for this but it was removed because it could not be implemented properly.

So, what is the best way to do this, now? (The SSH tunnel approach is fixed: I cannot switch to a different kind of VPN.)

  • Run tor on the same system you're running redsocks on.
  • Make an exception for the tor socks port 9050 on your remote system - put an iptables rule above allowing it, etc.
  • Tell your browser to connect to {remote system IP}:9050 for Tor use instead of localhost.
  • If you are also running privoxy locally, consider running that on the remote system too.

Another thing is to use a different SOCKS proxy that lets you forward certain ports to another local proxy server. I think squid lets you do this.

  • I think that that will allow me to connect to my local Tor service, but when the tor client tries to connect to other Tor nodes, that traffic will be routed through the SSH tunnel, won't it? because my iptables rule routes all traffic to redsocks. What I want to do is stop that happening, by allowing tor to connect directly to whatever it wants and everything else to go through the ssh tunnel. – dgalgarret Apr 12 '18 at 13:25
  • You'll use the Tor on the other end of the SSH tunnel. The only other way is to keep up on the IP address of Tor nodes (really difficult since there are hidden bridges now) and allow them via iptables Another thing is to simply make your browser use the redsocks proxy. – LawrenceC Apr 12 '18 at 13:52

The iptables option is --uid-owner, part of the -m owner match, which may be why you had so much trouble finding it.

A rule like this would work:

-A OUTPUT -m owner --uid-owner 998 -m conntrack --ctstate NEW -j ACCEPT

where 998 is instead tor's UID. And where you adapt it to your existing firewall.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.