Home / ubuntu / Questions / 1083782
Accepted
hiigaran
Asked: 2018-10-15 15:23:15 +0800 CST

Toggleable system-wide Tor?

  • 772

I've set up Tor on my system with torsocks by adding 127.0.0.1:9050 to Ubuntu's network proxy settings (set to manual). I can confirm this works as intended by comparing IP addresses and using https://check.torproject.org/

However, while I wish to use a system-wide Tor connection at certain times, I also want to be able to run a normal connection for when security and privacy are not crucial.

In the Android variant (OrBot), you are able to connect to the Tor network, and maintain that connection, but you also have a "VPN Mode" toggle, which is what determines whether a standard or a Tor connection is being made.

This is essentially the functionality I am looking for; a way to quickly and conveniently toggle between Tor and standard connections with a single click or by setting a hotkey.

networking vpn proxy tor

2 Answers

  1. Best Answer

    Digging around, I've found one possible solution. This involves setting two hotkeys, and the usage of gsettings.

    After configuring your proxy settings, you will need to go to Settings > Devices > Keyboard and create one custom hotkey that initiates the following command:

    gsettings set org.gnome.system.proxy mode manual

    Then create a second one for:

    gsettings set org.gnome.system.proxy mode none

    As the proxy settings remain saved whether enabled or not, you can then assign an 'enable' key for the first command, and a 'disable' key for the second.

    Confirm the change by pressing your first hotkey and navigating to Settings > Network, then navigating away, pressing your second hotkey, and returning to the network settings. Assuming Tor is set up correctly, and passes https://check.torproject.org, this should be all that's needed.

    Perhaps not the most ideal solution, but it will do for now, unless someone comes up with a toggle on the activity bar or something.

    EDIT:

    A slight improvement on the above, is to use one hotkey that checks the current state of the proxy mode, then sets it to the opposite. Grab your text editor and create a new file with the following contents:

    case "$(gsettings get org.gnome.system.proxy mode)" in
"'none'") gsettings set org.gnome.system.proxy mode "'manual'" 
notify-send "Tor Enabled";;
"'manual'") gsettings set org.gnome.system.proxy mode  "'none'"
notify-send "Tor Disabled" ;;
esac

    This will also display a message showing the current state of your proxy settings.

    Save the script somewhere, then reference the file location when creating a custom hotkey.

    • 2

  2. You want to look into "transparent" vs. "isolating" proxies. Transparent proxies, like what you are trying to do, are strenuously discouraged as they leak packets. The Tor project has some discussion of the dangers, which include "Identity correlation through circuit sharing;" issues with the clipboard, particularly download managers and antivirus software; and perhaps other issues with software you are running.

    There are ways to do it, if you insist. See that first link, which involves extensive use of iptables, and/or look into redsocks, transocks, or lcat (redsocks is probably the best - see the discussion at the lcat link). The correct approach is an isolating proxy, eg. Whonix, which uses a pair of virtual machines as a means of isolation. One machine is the virtual OS, the other is a virtual router. The Qubes OS is built around this approach. Isolation can be engineered to insure there are no packet leaks, and so is much more secure. Instead of toggling the proxy on one OS, you switch between virtual OS's, or your host and a virtual OS. An alternative to Whonix is Subgraph OS, which locks down the network so all packets go through Tor. You could run that in a virtual machine, keeping your host machine as is. (But be aware that Subgraph is still alpha.)

    Another transparent proxy, by the way, which is in addition obfuscating, is shadowsocks. This is extensively used in China, much like VPN's are used. Rather than connecting to Tor, you need a server on the other end - shadwosocks provides both client and server software - but you don't need superuser status there, so it's easy to get a cheap shell account and set it up. You could also use redsocks for this approach, though it wouldn't be obfuscated. The best server software to go with it is dante-server, though that does need superuser status to install. (dante-server is an apt package in Ubuntu. There is a dante-client, but that's not transparent, so you would want redsocks.). One advantage of shadowsocks or dante/redsocks is that they will proxy UDP, while Tor is only TCP. But that's perhaps off topic.

    • 1