A NixOS module that enables the networking.tor option to transparently route
traffic through Tor using nftables.
inputs = {
networking-tor = {
url = "github:deade1e/networking-tor";
flake = false;
};
};imports = [
(builtins.fetchTarball {
url = "https://github.com/deade1e/networking-tor/archive/main.tar.gz";
sha256 = lib.fakeHash; # Replace with the actual hash
})
];{
networking.tor = {
client = {
enable = true; # Route all traffic generated on this machine through Tor
allowedDestinations = [
"104.16.0.0/13" # Bypass Tor for this destination
];
allowedInterfaces = [
"wg0" # Bypass Tor for packets going out this interface
];
allowedFwMarks = [
"0x100" # Bypass Tor for packets with this fwmark
];
};
router = {
enable = true; # Route traffic forwarded by other hosts through Tor
allowedDestinations = [
"104.16.0.0/13" # Bypass Tor for this destination
];
};
};
}Client mode (networking.tor.client.enable) routes all outbound traffic of
the local machine through Tor.
Router mode (networking.tor.router.enable) routes forwarded traffic
through Tor, turning the machine into a Tor gateway for other devices. Also
accepts allowedSources to exempt specific source subnets.
Both modes can be enabled simultaneously.
| Option | Type | Default | Description |
|---|---|---|---|
enable |
bool | false |
Enable client mode |
clearnet-proxy.enable |
bool | false |
Enable a Squid proxy for traffic that bypasses Tor |
clearnet-proxy.port |
int | 3128 |
Squid proxy port |
allowedDestinations |
list of str | [] |
Destination subnets that bypass Tor |
allowedInterfaces |
list of str | [] |
Outbound interfaces that bypass Tor |
allowedFwMarks |
list of str | [] |
Packet marks that bypass Tor |
| Option | Type | Default | Description |
|---|---|---|---|
enable |
bool | false |
Enable router mode |
allowedDestinations |
list of str | [] |
Destination subnets that bypass Tor |
allowedSources |
list of str | [] |
Source subnets that bypass Tor |
| Option | Type | Default | Description |
|---|---|---|---|
VirtualAddrNetworkIPv4 |
str | 10.64.0.0/10 |
Virtual address space for .onion resolution |
nat-priority |
int | -100 |
nftables NAT chain priority |
filter-priority |
int | 0 |
nftables filter chain priority |
networking.nftables.enableis set automatically- Router mode enables
net.ipv4.ip_forwardautomatically - Router mode opens TCP port
9040and UDP port9053in the firewall - DNS is redirected through Tor to prevent leaks
- Traffic from the
torandsquidsystem users is always exempted to prevent routing loops