Tested on a Raspberry Pi 4B with
Raspbian Buster Lite 2020-02-13 updated on 2020-05-19.
Updates done with sudo apt update && sudo apt full-upgrade && sudo reboot.
The setup of a Tor proxy does not depend on the underlying network configuration. The proxy only needs an interface that can be used to send data to the Tor network, and an internet connection. So you can use any tutorial to setup the network, as long as that results in stable and error-free network connections. For systemd-networkd you should be able to use one of the following setups:
You can follow one of the above tutorials or setup your own installation and ensure it's stable. For this example I will use the wlan repeater with on-board wifi without a bridge as shown in the first link above as I think it is the most frequently used. In this example, the access point will be assigned a static ip address: 192.168.4.1 to interface ap0.
Once you have a stable network, then install the Tor daemon. It comes with complete systemd services.
rpi ~$ sudo -Es
rpi ~# apt install tor
rpi ~# systemctl stop tor.service
First create a default setup file to define what interface the tor proxy should use as its entry point. For this example it is:
rpi # mkdir /usr/local/etc/default
rpi # cat > /usr/local/etc/default/torproxy <<EOF
# interface to be used as entry point to the Tor network
TOR_IFNAME=ap0
TOR_IFADDR=192.168.4.1
EOF
Setup tor configuration:
rpi ~# [[ -f /etc/tor/torrc.orig ]] || mv /etc/tor/torrc /etc/tor/torrc.orig
rpi ~# cat > /etc/tor/torrc <<EOF
VirtualAddrNetworkIPv4 10.192.0.0/10
VirtualAddrNetworkIPv6 [FC00::]/7
AutomapHostsOnResolve 1
TransPort 127.0.0.1:9040
DNSPort 127.0.0.1:53
# endpoint selection
# uncomment and edit next lines if you want your exit nodes only in
# specific countries
#StrictNodes 1
#ExitNodes {de},{uk},{us}
EOF
Now configure the transparent proxy with iptables rules. We add this so that the tor service will be started and stopped with iptables. Edit the service with:
rpi ~# systemctl edit tor.service
Into the empty editor insert these statements, save them and quit the editor. Have attention to the - sign after the equal sign on some statements:
[Service]
EnvironmentFile=/usr/local/etc/default/torproxy
ExecStartPre=/bin/bash -c '/bin/sed -i "s/^TransPort .*:/TransPort $TOR_IFADDR:/" /etc/tor/torrc'
ExecStartPre=/bin/bash -c '/bin/sed -i "s/^DNSPort .*:/DNSPort $TOR_IFADDR:/" /etc/tor/torrc'
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i $TOR_IFNAME -p tcp --dport 22 -j REDIRECT --to-ports 22
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i $TOR_IFNAME -p udp --dport 53 -j REDIRECT --to-ports 53
ExecStartPost=/sbin/iptables -t nat -A PREROUTING -i $TOR_IFNAME -p tcp --syn -j REDIRECT --to-ports 9040
ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i $TOR_IFNAME -p tcp --dport 22 -j REDIRECT --to-ports 22
ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i $TOR_IFNAME -p udp --dport 53 -j REDIRECT --to-ports 53
ExecStopPost=-/sbin/iptables -t nat -D PREROUTING -i $TOR_IFNAME -p tcp --syn -j REDIRECT --to-ports 9040
Finish the setup and start the tor proxy with:
rpi ~# systemctl daemon-reload
rpi ~# exit
rpi ~$ sudo systemctl start tor.service
For testing your tor proxy you can connect with a mobile phone to your access point. Use an internet browser to connect to this site:
https://check.torproject.org
References:
[1] Change Your Raspberry Pi Into A TOR Router
