5

Circuit per tab is not necessarily a feature - it depends on your tor use case. If you’re using gl-inet solely to prevent leaks this will improve anonymity. If you are using gl-inet to provide extra isolation in case someone hacks the machine that is connected to gl-inet, then circuit-per-tab defeats this purpose. Why? To be able to spawn circuit-per-tab torbrowser needs to have access to tor control port (which is quite a sensitive port, btw). So you need to expose the control port to the machine with torbrowser. If your machine has been pwned, the attacker can simply access the control port and expose you etc.

With this firmware it’s actually quite easy to enable this feature (circuit-per-tab), you just need some reconfiguration:

  1. You need to expose direct socks proxy port to tor lan network (on 172.16.1.1 for wifi and 172.16.2.1 for lan port). This is because torbrowser needs direct connection to tor socks proxy. I would enable this by default in tor firmware, since it’s really useful for other purposes like connecting via ssh to hidden services etc. In default setup iptables reroutes every packet to port 9040 - we need to make exception for port 9050 like this:

Goto p0rtal.lan -> luci -> network -> firewall -> Custom Rules tab and prepend those lines to the body of enable_transparent_tor() function:

iptables -t nat -A PREROUTING -i wlan0 -p tcp -d 172.16.1.1 --dport 9050 -j RETURN

iptables -t nat -A PREROUTING -i eth1 -p tcp -d 172.16.2.1 --dport 9050 -j RETURN

Save and reboot the router. This will make connecting to 172.16.1.1:9050 and 172.16.2.1:9050 possible. Now we need to configure tor to spawn a socks5 proxy to listen there. Open p0rtal.lan and goto “Editor”. Edit the /etc/tor/torrc file and add lines:

SocksPort 9050

SocksBindAddress 172.16.1.1:9050

SocksBindAddress 172.16.2.1:9050

Reboot (or if you have ssh access you can simply restart tor: /etc/init.d/tor stop && sleep 3 && /etc/init.d/tor start - sleep is helpfull, since sometimes tor stops slowly and newly spawned instance can’t bind to port).

Now you have direct access to tor socks5 proxy port. Let’s check if it works. Install torbrowser-bundle on linux (no idea how to make it behave on other OS’es - don’t use them if you want to be anonymous anyways :stuck_out_tongue_winking_eye: well, maybe bsd is ok, but win and osx, well ;)). Now we need to tell torbrowser not to start it’s own tor instance locally and instead use external socks5 proxy for operation. You need to pass additional environment vars to torbrowser-launcher, like this (note: if you’re using the wired connections make sure to pass 172.16.2.1 as TOR_SOCKS_HOST):

TOR_SKIP_LAUNCH=1 TOR_SOCKS_HOST=172.16.1.1 TOR_SOCKS_PORT=9050 TOR_SKIP_CONTROLPORTTEST=1 TOR_NO_DISPLAY_NETWORK_SETTINGS=1 torbrowser-launcher

If everything went smoothly torbrowser should start and connect the usual way. If you get connection refused errors you must have goofed up somewhere :stuck_out_tongue_winking_eye:

Now, this is still single-circuit connection, we need to perform the same thing for tor control port and add to iptables:

iptables -t nat -A PREROUTING -i wlan0 -p tcp -d 172.16.1.1 --dport 9051 -j RETURN

iptables -t nat -A PREROUTING -i eth1 -p tcp -d 172.16.2.1 --dport 9051 -j RETURN

Edit torrc config and add a lines:

ControlPort 9051

ControlListenAddress 172.16.1.1:9051

ControlListenAddress 172.16.2.1:9051

Restart tor and try torbrowser with additional env variables (add them to the command line I shown above):

TOR_CONTROL_PORT=9051 TOR_CONTROL_HOST=172.16.1.1

Note: remove the TOR_SKIP_CONTROLPORTTEST - it tells torbrowser to… skip control port test (surprise, surprise!).

Note: this is suboptimal - you should add some authentication to tor control port, consult torrc or manpages (or google) for info how to add this. In my opinion the setup with exposed control port is less secure, but like I said - people have various use cases :wink: happy drug shopping or hacking or whatever your nefarious activities over tor are (let me guess… freedom fighting? ;P).

Cheers, Nobody.