


Who is this good for?


What is Tor?


According to the Tor website:



What you'll need

You'll need a few things to run this tutorial:

Chances are you've got a couple of these items already. If not, our Onion Pi starter pack has everything you need



Please follow these tutorials in order to







Install Tor

Essentially, this tutorial just follows the tor "anonymizing middlebox" writeup here.

If you hate typing a lot, this script from breadk will do it all for you! Make sure to read through the script to make sure you don't want to change anything! (More about how to use it here!) We do suggest going step by step so you can have the experience of all the upkeep tasks.

We'll begin by installing tor - the onion routing software.

Log into your pi by Ethernet or console cable and run

sudo apt-get update
sudo apt-get install tor
Edit the tor config file by running
sudo nano /etc/tor/torrc
and copy and paste the text into the top of the file, right below the the FAQ notice.
Download: file
Log notice file /var/log/tor/notices.log
AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

Let's edit the host access point so it is called something memorable like Onion Pi - don't forget to set a good password, don't use the default here!

sudo nano /etc/hostapd/hostapd.conf

(Don't forget to do the AP setup step in "Preparation" before this!)

Time to change our ip routing tables so that connections via the wifi interface (wlan0) will be routed through the tor software.
Type the following to flush the old rules from the ip NAT table
sudo iptables -F
sudo iptables -t nat -F
If you want to be able to ssh to your Pi after this, you'll need to add an exception for port 22 like this (not shown in the screenshot below)
Type the following to route all DNS (UDP port 53) from interface wlan0 to internal port 53 (DNSPort in our torrc)
Type the following to route all TCP traffic from interface wlan0 to port 9040 (TransPort in our torrc)
Next you can check that the ip tables are right with
sudo iptables -t nat -L

If all is good, we'll save it to our old NAT save file
It will automatically get loaded when the networking is set up on reboot (as we did in the last tutorial on making a Pi access point)
Next we'll create our log file (handy for debugging) with
sudo touch /var/log/tor/notices.log
sudo chmod 644 /var/log/tor/notices.log
Check it with
ls -l /var/log/tor
Start the tor service manually
sudo service tor start
Check its really running (you can run this whenever you're not sure, it something is wrong you'll see a big FAIL notice
sudo service tor status
Finally, make it start on boot
sudo update-rc.d tor enable
That's it, now you're ready to test in the next step.

Test It!

OK now the fun part! It's time to test your TOR anonymizing proxy. On a computer, check out the available wifi networks, you should see the Onion Pi network
Connect to it using the password you entered into the hostapd configuration file
You can open up a Terminal or command prompt and ping to check that your connection to the Pi is working. However you won't be able to ping outside of it because ping's are not translated through the proxy
To check that the proxy is working, visit a website like http://www.ipchicken.com which will display your IP address as it sees it and also the matching domain name if available. The IP address should not be from your internet provider - in fact, if you reload the page it should change!
Your web browsing traffic is now anonymized!
BEFORE YOU START USING YOUR PROXY - remember that there are a lot of ways to identify you, even if your IP address is 'randomized'. Delete your browser cache, history and cookies (some browsers allow "anonymous sessions") and read https://www.torproject.org/ for a lot more information on how to use TOR in a smart and safe way

Do more...

Now that you have this project set up, you can do more...

Set up as a Wifi-to-Wifi Tor middlebox

We use Ethernet because it requires no configuration or passwords, just click the cable to get DHCP but if you want, its possible to set it up as a WiFi-to-WiFi proxy. You'll need two WiFi adapter, then edit /etc/networks/interfaces to add wlan1 and enter in the SSID/password for your Internet provider using our WiFi tutorial We don't have a tutorial for this project

Configure Tor to make your Exit Node in a particular country only

Its very easy to configure tor to give you a presence in any country of your choice. For example here's my torrc that makes me 'present' in Great Britain.
Replace aaa.bbb.ccc.ddd by the IP address of your RPi and GB by the country code of your choice.
Configure your browser to uses a Socks 5 proxy on aaa.bbb.ccc.ddd, port 9050

Log notice file /var/log/tor/notices.log
SocksListenAddress aaa.bbb.ccc.ddd
ExitNodes {GB}
StrictNodes 1

Set up as a Tor Relay or Exit Node

If you like using Tor, help make it faster by joining as a relay, or increasing the anonymity by becoming an exit node. Check out the Tor project website for how to edit your torrc to turn your Pi into either.

Donate to the Tor Project

If you like using Tor, but can't run a relay or exit node - consider donating to the project which helps pay for developers, servers and more. Your donation is tax-deductable if you are in the US
