# Wireguard AND tor simultaneously **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [July 5, 2023, 4:37pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129 "2023-07-05T16:37:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Gluser1](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@Gluser1](https://forum.gl-inet.com/u/Gluser1)\ **Post date:** [July 5, 2023, 4:37pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/1 "2023-07-05T16:37:06Z")
Is it possible without manual changes to have a wireguard VPN client as the egress, and then have tor within wireguard? I know this is a technical possibility but I mean specifically with MV1000a or other glinet products with tor and WireGuard suppory From what I can tell, the UI can’t do this, they’re mutually exclusive For those in countries where authorities track those using tor, this is an important feature, because it’s easy to fingerprint tor Wireguard can also be fingerprinted, but generally tor traffic is considered to be an indicator that a user is a threat. Tor is also more rare, so regimes are able to focus on it more easily (I do not have metrics but I would guess in all countries (with strict monitoring or with freedom) have a ratio higher than 100 wireguard users for every single tor user. It’s safer to be “just a more wireeguard user” than “the few tor users” Thank you!!! Edit: many alternatives exist but they require additional architecture. For example, a wireguard server in an area outside of the country which uses tor. It’s an added hop and cost and management headaches ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [July 5, 2023, 4:58pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/2 "2023-07-05T16:58:10Z")
Okay right off the bat the word that worries me most is _regime(s)_. If you’re that deep in hostile territory & they monitor as you describe I’d _really_ implore against leaving traces of Tor configuration on an unencrypted ([data at rest](https://en.wikipedia.org/wiki/Data_at_Rest), ie: conf files, logs on the GL device) that’d be easily accessible to anyone w/ a JTAG/GPIO reader. They’d have some bit of hardware like that to read the flash storage, even if overwritten w/ one pass, no doubt. I take no responsibility for your actions or outcome but I’d put WG on the GL device, ensuring **all** traffic defaults to WG (via a ‘VPN Polilcy’), the Internet Kill Switch feature, then use Tails OS when you need to do what you need to do. If nothing else if was good enough for Snowden then I think it deserves serious consideration. Make sure your VPN provider has a solid reputation of _non-logging_ & openly gives the results of third-party auditing to that effect (eg: [Mullvad](https://mullvad.net/en), [IVPN](https://www.ivpn.net/)). Note the Burme (MV1000) uses firmware v. 3.216. Capabilities have improved since that release. I would consider upgrading to a v. 4.2.1 device like the Slate Plus ([A1300](https://www.gl-inet.com/products/gl-a1300/)), Beryl AX ([MT3000](https://www.gl-inet.com/products/gl-mt3000/)) or Slate AX ([ATX1800](https://www.gl-inet.com/products/gl-axt1800/)) if possible. Consider a [BusKill](https://www.buskill.in/) dead-man’s switch. Side note: for secure IM over Tor on mobiles, check out SimpleX Chat. Use it over Wi-Fi w/ your WG-enabled Burme… but _test, test, test_ regardless of what direction you go. > **[VPN - GL.iNet Router Docs 3](https://docs.gl-inet.com/router/en/3/setup/gl-mv1000/vpn/)** > > Documentation for GL.iNet Router Productions > **[Tails (operating system)](https://en.wikipedia.org/wiki/Tails_(operating_system))** > > Tails, or "The Amnesic Incognito Live System," is a security-focused Debian-based Linux distribution aimed at preserving privacy and anonymity. It connects to the Internet exclusively through the anonymity network Tor. The system is designed to be booted as a live DVD or live USB and never writes to the hard drive or SSD, leaving no digital footprint on the machine unless explicitly told to do so. It can also be run as a virtual machine, with some additional security risks. The Tor Proje Tails ... > **[BusKill: The USB Laptop Kill Cord](https://www.buskill.in/)** > > \#BusKill is a laptop #DeadManSwitch triggered by someone physically yanking your laptop away from you. Powered by #USB & #udev. #opsec #infosec #CyberSecurity #travel #safety #TravelSecurity #security #privacy #bitcoin #btc #crypto > **[SimpleX Chat: private and secure messenger without any user IDs (not even...](https://simplex.chat/)** > > SimpleX Chat - a private and encrypted messenger without any user IDs (not even random ones)! Make a private connection via link / QR code to send messages and make calls. ---
**Author:** ![Gluser1](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@Gluser1](https://forum.gl-inet.com/u/Gluser1)\ **Post date:** [July 5, 2023, 5:45pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/3 "2023-07-05T17:45:04Z")
(To edit, I wrote this, not from any help, I think you can understand?) Good thank you. It is all very good and sound technically I think for many cases. But am looking for ways, only care for “wire”, not to be deniable and stop visitors (too late) If an authority or person “comes” it’s not like a police in usa, where it is encrypted, no way to “prove” any things, a judge says the rules are ok for you, now we leave, have a nice night 🙂 . And not FBI in use where army full with forensic experts will come to see the hardware and software. More like traffic officer than FBI lol (so it lucky) Other things, idea for this is to try hard avoiding any “visit”, not protecting with many cost the next steps After, say this to be clear: many netizens are using vpn here, it is not strictly a crime here. No authority will come only to see why is there vpn. This is what is best, to be sure only vpn is noticed To make big preparations as you say, can be dangerous. Maybe better to show “no spy here, dear”. If seeing advanced and sophisticated measures for hiding, is much worse assumed for this. Spying, or an organizer of problems. It is very big difference for that and is better with simple glinet router bought from internet, simply (unless you really are spy! But then Run!) wonderful ideas you offered are good for some, very interesting to study one day but here, with money (not much) and no big thing to hide, just want to have a new layer inside the other. The “threat model” not same one like this here and there Thank you! But I hope there is way to make this privacy all in a plain old little router, not special laptop, not dead man’s switch and encryption and those others (but cool) In primary, deniable is very good sometimes in some ways. not something to do in this case, there become new dangers with that, I like stay simple Hope this help! But seem that answer is no, mv1000 is not for the task ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [July 5, 2023, 6:14pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/4 "2023-07-05T18:14:18Z")
Fair enough. To more directly answer your question about ‘Tor-over-WG’: these GL devices run OpenWrt Linux underneath. Firmware version 4.2.1-release4 supports Tor, VPNs by WG or OpenVPN using OpenWrt 21.02, soon to be 22.x. The Tor option is in [Beta](https://wiki.froth.zone/wiki/Software_release_life_cycle?lang=en#Beta) status. ![2023-07-05 15_05_57-GL.iNet Admin Panel - Chromium](https://forum-static.gl-inet.com/original/2X/b/b669d681e74a5975b09f99fc489245f148bd21ba.png) ![2023-07-05 14_07_35-GL.iNet Admin Panel - Chromium](https://forum-static.gl-inet.com/original/2X/9/9ecc9445fec0e7a4ceb2193248d8c42b7500dd86.png) > [@Gluser1](#): > > Hope this help! But seem that answer is no, mv1000 is not for the task **It could be.** Burme (MV1000) uses [firmware 3.216](https://dl.gl-inet.com/?model=mv1000) (check to ensure it is the version number being used). That is based on OpenWrt 19.07. I don’t think this is the right forum for such a unique but understandable scenario. To get ‘Tor-over-WG’ I’d think you’d have to ask on [OpenWrt’s forums](https://forum.openwrt.org/) for help to set up such an advanced configuration. > **[Welcome to the OpenWrt Project](https://openwrt.org)** > > Welcome to the OpenWrt Project The OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you... ---
**Author:** ![Gluser1](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@Gluser1](https://forum.gl-inet.com/u/Gluser1)\ **Post date:** [July 5, 2023, 9:09pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/5 "2023-07-05T21:09:39Z")
yes it seems requiring custom solution, openwrt community maybe have ideas, 👍 Other post by gl-inet describe as “very complicated”, experiences for me point to simpler maybe clever ways. theory, is not hard. Bring up wg, set for route 0/0, remove. Then transparent proxying and relation iptables rules by gl-inet. Maybe when completing there will be a patch diff of 25 lines. no, seem too simple… the linux network namespace maybe can do a nice path of this, another path from policy routing with several tables. Maybe superior solution or maybe not harmony with gl-inet Making me think… Great way for keep the tor inside the wg, so many ways. Big worry is from the network scripts interrupt with “special” new change and cause full leak… No, you are in the right way suggest reading all from openwrt and gl-inet scripts, is probably only path wait for a return, I will post failed and suceeds solutions 🙂 🙏 ---
**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\ **Post date:** [July 5, 2023, 9:16pm UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/6 "2023-07-05T21:16:51Z")
Yeah; this is custom work to be sure. Just a heads up: OpenWrt is about to change over from `iptables` (21.02 & earlier) to `nftables` . That's probably going to severely impact what kind of firewall chains are required when you ask for help. Be sure to specify what version of OpenWrt you're running & don't be afraid to SSH into the device. You're most likely going to need to. The default IP for GL devices is `192.168.8.1`. (Also backup as you go. It'll be easier than resetting, starting over fr scratch if it becomes all too messy. See HOW-TO.) > **[\[OpenWrt Wiki\] SSH access for newcomers](https://openwrt.org/docs/guide-quick-start/sshadministration)** > **[MobaXterm free Xserver and tabbed SSH client for Windows](https://mobaxterm.mobatek.net/download-home-edition.html)** > > The ultimate toolbox for remote computing - includes X server, enhanced SSH client and much more! > [@HOW-TO: Script: List My OPKGs (to a file for backup)](https://forum.gl-inet.com/t/how-to-script-list-my-opkgs-to-a-file-for-backup/30963): > > Keywords: backup, opkg, plugins, list, howto, script, shell, luci, restore, ipk, tarball, conf Description List user's (your) installed packages, writing them to a text file that can be used to reinstall the binaries of what a user manually installed. The resulting .list file will be use to opkg install to pull from the feeds. That is done with two commands in one execution. The GL GUI doesn’t feature a backup function. Creating & restoring a backup achieve (.tar.gz, aka tarball) of all your … ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 4:22am UTC](https://forum.gl-inet.com/t/wireguard-and-tor-simultaneously/31129/7 "2025-10-29T04:22:55Z")