mirror of
https://github.com/fphammerle/docker-tor-proxy.git
synced 2025-10-27 02:43:35 +01:00
Fabian Peter Hammerle
51 lines
2.2 KiB
Plaintext
51 lines
2.2 KiB
Plaintext
# https://www.torproject.org/docs/tor-manual.html.en
|
|
|
|
# hide healthchecks:
|
|
# > [notice] {CONTROL} New control connection opened from 127.0.0.1.
|
|
Log [~control]notice warn stdout
|
|
LogMessageDomains 1
|
|
|
|
# default: ~/.tor
|
|
DataDirectory /var/lib/tor
|
|
|
|
# https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
|
|
ControlPort localhost:9051
|
|
|
|
DNSPort 0.0.0.0:9053
|
|
|
|
# IsolateClientAddr & IsolateSOCKSAuth enabled by default
|
|
# https://web.archive.org/web/20230113155700/https://gitweb.torproject.org/tor.git/tree/doc/man/tor.1.txt?h=tor-0.4.7.13&id=7c1601fb6edd780ffef386936217ede9531c26e6#n1483
|
|
SocksPort 0.0.0.0:9050 IsolateClientAddr IsolateSOCKSAuth
|
|
# > reject application connections [...] that only provide an IP address [...]
|
|
# > not doing remote DNS
|
|
# with `SafeSocks 1`:
|
|
# $ for p in socks4 socks4a socks5 socks5h; do \
|
|
# echo -n "$p: ";
|
|
# curl -o /dev/null --no-progress-meter -x $p://127.0.0.1:9050 https://ipinfo.tw
|
|
# && echo success;
|
|
# done
|
|
# > socks4: curl: (97) Can't complete SOCKS4 connection to 0.0.0.0:0. (91), request rejected or failed.
|
|
# > socks4a: success
|
|
# > socks5: curl: (97) Can't complete SOCKS5 connection to ipinfo.tw. (2)
|
|
# > socks5h: success
|
|
# log:
|
|
# > [warn] {APP} Your application (using socks4 to port 443) is giving Tor only
|
|
# . an IP address. Applications that do DNS resolves themselves may leak
|
|
# . information. Consider using Socks4A [...]
|
|
# > [warn] {APP} Your application (using socks5 to port 443) is giving Tor [...]
|
|
SafeSocks {safe_socks}
|
|
SocksTimeout {socks_timeout_seconds}
|
|
|
|
# requires netfilter rules
|
|
# socks5 with auth-based circuit isolation (tor browser, torsocks --isolate) should be preferred
|
|
# cave: IsolateDestAddr & IsolateDestPort are not enabled
|
|
# https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy
|
|
# https://github.com/epidemics-scepticism/writing/blob/b6733379d653b30771d578ace04c262600345122/misconception.md#transparent-proxying-lacks-context
|
|
# https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
|
|
# https://gitweb.torproject.org/tor.git/tree/src/or/connection_edge.c?id=6285d9bdcf7f210c56abd25f75133e30d05a7473#n1423
|
|
# https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
|
|
TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
|
|
|
|
# try to
|
|
HardwareAccel 1
|