TOR on GL-MT300A and GL-MT300N

tamila · 2016-12-15T00:32:07.000Z

Thanks for you answer!

I’m really interested in your amazing project that adds Tor support. I got a few questions and suggestions, as well. As a matter or fact, I’d like to give a donation to you.

Can you please tell me your bitcoin wallet number?

alzhao · 2016-12-16T00:10:45.000Z

@Tamila, thanks for your donation. We are a commercial company so we don’t take donations now. If you like our products you can give us good reviews and buy more. Thanks!

tamila · 2016-12-16T05:25:28.000Z

I have already bought 3 of them - I like their capabilities, physical size and energy consumption.

They also look beautiful

They have nice Tor support, so I was planning to buy more for my friends who need anonymity. However, I got some questions:

How is Tor provided? Transparent mode, proxy gateway or some other?
Which protocols are supported for Tor - only http[s] or every one?
What is the difference between openwrt-mt300a-tor-1.4.bin and openwrt-gl-mt300a-tor-luci-1.0.bin ? Which is better?
Would it be possible to get the manual or a brief description of the features, to better understand aspects of their work?
Would it be possible to add openwrt-gl-mt300a-tor-luci-1.0.bin to list.txt too?

alzhao · 2016-12-17T21:17:31.000Z

Tor is provide as transparent mode.

All data goes to Tor.

Check Overview - GL.iNet Docs for details about the firmware. The old luci version only contains luci and 1.4 has a simple UI.

tamila · 2017-02-14T06:21:18.000Z

Dear alzhao,

Bugreport: I have found a big problem with firmware openwrt-mt300a-tor-1.4.bin
Apparently, TOR mode only works for LAN interface; WiFi traffic bypasses TOR and goes out “as is”, unprotected, which endangers WiFi users.
Would it be possible to fix that?

alzhao · 2017-02-14T10:00:45.000Z

@Tamila,

Can you test again? Basically wifi and lan are in the same subnet and should behave the same.

When you move the switch to the left, it is in Tor. When you move the switch to the right, you have normal Internet.

tamila · 2017-02-17T07:22:45.000Z

"When you move the switch to the left, it is in Tor. When you move the switch to the right, you have normal Internet"

I remember this very well :) Here are the results of testing the router by browser for address http://checkip.org :

Switch to the right (Normal):
LAN: IP = 95.133.11.28 (my real dynamic IP, Ukraine)
WAN: IP = 95.133.11.28 (my real dynamic IP, Ukraine)
Switch to the left (Tor):
LAN: IP = 109.163.234.7 (Romania, Tor is works)
WAN: IP = 95.133.11.28 (my real dynamic IP, Ukraine) - Tor here is not failure!

alzhao · 2017-02-17T13:37:51.000Z

can you tell me what else you changed in the router settings? For example, did you use repeater, or did you change LAN IP address etc.?

tamila · 2017-02-19T03:17:32.000Z

Please, my settings in attach…

tamila · 2017-02-19T03:18:16.000Z

… continue -

alzhao · 2017-02-20T15:52:01.000Z

I just tested. I tried to set static IP and change wifi name as you do.

I don’t find any problem.

Basically the LAN port and WiFi is in the same sub network. The router routes all traffic from this sub network to Tor. So if LAN is on Tor, wifi is on Tor as well.

Are you sure you are not connecting to another wifi network? You can check your phone’s IP address to see if it is still 192.168.8.x if you don’t change LAN ip of the router.

If you are sure. Can you send me the content of /etc/config/network and /etc/firewall.user to have a check?

tamila · 2017-02-21T04:20:39.000Z

Please, my 2 configs and command ‘brctl show’ in attach:

tamila · 2017-02-21T04:24:12.000Z

Hmmm…

Configs in archive config.tar.gz to attach:

alzhao · 2017-02-21T10:02:30.000Z

From the log I cannot see any problem.

Can you post /etc/config/wireless as well?

What is the configure of your main router? Maybe I need to test exactly the same, even the same setting for the main router.

tamila · 2017-02-22T05:22:54.000Z

I don’t have a main router. My GL-MT300A included in the Internet directly.

/etc/config/wireless

config wifi-device ‘radio0’
option type ‘mac80211’
option path ‘10180000.wmac’
option htmode ‘HT20’
option hwmode ‘11ng’
option txpower ‘20’
option channel ‘auto’
option disabled ‘0’

config wifi-iface
option device ‘radio0’
option network ‘lan’
option mode ‘ap’
option ifname ‘wlan0’
option wds ‘1’
option ssid ‘MYAP’
option encryption ‘psk2’
option key ‘Urt…7’
option disabled ‘0’

tamila · 2017-03-10T10:54:07.000Z

Dear alzhao,

I have found reasons for my problems with TOR gateway on openwrt-mt300a-tor-1.4.bin
Trouble came from second DHCP server in the same LAN segment as TOR gateway.
Apparently, this foreign DHCP traffic went through LAN-WLAN bridge and changed settings of WiFi-connected client.
After disabling that second DHCP server, TOR gateway works as expected.
Sorry for troubling you with this problem, and thanks for the great work!!!

alzhao · 2017-03-10T11:23:47.000Z

Thanks for letting me know.

Yes, you cannot have a 2nd DHCP server in LAN network. That will break everything.

Odol · 2018-04-16T23:58:55.498Z

Dear alzhao,
Your TOR firmware works very well!
But you can make the Onion Router work even safer for users.
To do this, add another important project the P.O.R.T.A.L to it, please!
Link: GitHub - grugq/portal: Personal Onion Router To Assure Liberty
Thank you!

alzhao · 2018-04-17T10:26:41.473Z

The firmware is developed according to PORTAL.

I even talked with the Author about this.

What is the real difference now?

Odol · 2018-04-17T19:05:10.307Z

Those, P.O.R.T.A.L is built into the your firmware TOR?