torification.sh

#!/bin/bash

action=$1

if [ "$action" == "" ]
then
   echo -e "\e[1mUsage:\e[0m"
   echo -e "  To TORIFY whole system run: torification enable"
   echo -e "  To UNTORIFY run: torification disable"
   echo -e "  To check STATUS run: torification status"
fi

cat <<EOF > /tmp/tor-fw.rules
*nat
:PREROUTING ACCEPT [6:2126]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [17:6239]
:POSTROUTING ACCEPT [6:408]

-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -o lo -j RETURN
--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN
-A OUTPUT -m owner --uid-owner "debian-tor" -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
--ipv6 -A INPUT -j REJECT
--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m owner --uid-owner "debian-tor" -j ACCEPT
--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
--ipv6 -A OUTPUT -j REJECT
COMMIT
EOF

checkIP(){
    IP=$(curl -s https://ifconfig.me)
}

checkTor(){
    connected_to_tor=false
    check_torproject_org=$(curl -s https://check.torproject.org/ | cat | grep -m 1 Congratulations | xargs)
    if [ "$check_torproject_org" == "Congratulations. This browser is configured to use Tor." ]
    then
        connected_to_tor=true
    fi
}

if [ "$action" == "enable" ]
then
    sudo iptables-restore < /tmp/tor-fw.rules
    checkIP
    echo -e "\e[1m\e[32mYou connected to TOR network \nTOR IP: $IP"
    rm -rf /tmp/tor-fw.rules
fi

if [ "$action" == "status" ]
then
    checkTor
    if [ "$connected_to_tor" == true ]
    then
        checkIP
        echo -e "\e[1m\e[32mYou are connected to TOR network \nTOR IP: $IP"
    else
        echo -e "\e[31mYou are not connected to TOR"
    fi
fi

if [ "$action" == "disable" ]
then
    sudo iptables -P INPUT ACCEPT
    sudo iptables -P FORWARD ACCEPT
    sudo iptables -P OUTPUT ACCEPT
    sudo iptables -F
    sudo iptables -X
    sudo iptables -t nat -F
    sudo iptables -t nat -X
    sudo iptables -t mangle -F
    sudo iptables -t mangle -X
    sudo iptables -t raw -F
    sudo iptables -t raw -X
    echo -e "\e[31mYou disconnected form TOR network"
fi