anonsurf

Anonymize the entire system under TOR using a transparent iptables proxy, and wipe the RAM on shutdown with pandora.

anonsurf routes all system traffic through TOR via iptables and also lets you start/stop i2p. pandora overwrites the RAM on shutdown as a cold boot attack mitigation.

This is an Arch Linux native package:

• systemd service management (systemctl)
• Tor runs under the unprivileged tor user; iptables rules match on its UID
• /etc/tor/torrc is swapped at runtime (start/stop) and always restored — your regular Tor configuration is never permanently modified
• /etc/resolv.conf is handled symlink-safe (works with systemd-resolved)
• packaged as a PKGBUILD for makepkg

Original Project from here, ported to Arch Linux.

Installation

./installer.sh

The installer pulls the official-repo dependencies (tor, iptables, curl, psmisc, procps-ng), AUR dependencies, then builds and installs this package. Run it as a normal user with sudo (makepkg refuses to run as root).

Optional flags:

• --with-i2p — also install i2p-bin from the AUR for starti2p/stopi2p
• --with-bleachbit — also install bleachbit for cache cleaning

Or build it manually:

makepkg -si

Optional dependencies (AUR):

Usage

anonsurf

anonsurf {start|stop|restart|change|status|debug}

• start — Route the whole system through Tor via iptables. Waits for Tor to finish bootstrapping before reporting success.
• stop — Restore the original iptables, DNS, IPv6 and Tor settings.
• restart — Combines stop and start.
• change — Signal Tor (SIGHUP) to pick a new circuit/identity.
• status — Check whether AnonSurf is working properly.
• myip — Show your current (Tor) exit IP address (risky).
• debug — Dump diagnostics (iptables rules, Tor state, sockets, resolv.conf).

I2P related features:

anonsurf starti2p   # start i2p services
anonsurf stopi2p    # stop i2p services

NOTE: run it as root (sudo anonsurf start). While anonymous, only the tor user may reach the network directly.

pandora

Pandora is enabled as a systemd unit (pandora.service) and automatically wipes the RAM on shutdown. It can also be run manually:

pandora bomb

NOTE: this clears the entire system cache, including active SSH tunnels or sessions. To stop the auto-wipe on shutdown: systemctl disable pandora.service

Troubleshooting

• The anonsurf Tor profile listens on TransPort 9040, SocksPort 9050 and DNSPort 53 — see /etc/tor/torrc.anon. If Tor cannot bind port 53 (a privileged port) as the tor user, the shipped systemd drop-in (tor.service.d/netcap.conf) grants CAP_NET_BIND_SERVICE.
• IPv6 is disabled during the anonymous session via /etc/sysctl.d/98-anonsurf.conf and re-enabled on stop.
• If something does not work while anonymous, run sudo anonsurf debug and check that Tor has bootstrapped (Bootstrapped 100%) and is listening on ports 53, 9040 and 9050.

License

GPLv3 — see LICENSE.