diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..ae1473c --- /dev/null +++ b/Makefile @@ -0,0 +1,87 @@ +# UN CLI Inception - Makefile +# Egress shielding setup for sandbox nodes + +PREFIX ?= /usr/local +MICROSOCKS_DIR = /opt/microsocks +REDSOCKS_PORT = 12345 +SOCKS_PORT = 1080 + +.PHONY: help egress-shield microsocks redsocks-config egress-iptables egress-services clean-egress + +help: + @echo "Egress Shielding:" + @echo " make egress-shield - Full setup (build + config + iptables + services)" + @echo " make microsocks - Build microsocks SOCKS5 proxy" + @echo " make redsocks-config - Generate /etc/redsocks.conf" + @echo " make egress-iptables - Set up iptables NAT rules" + @echo " make egress-services - Install and enable systemd services" + @echo " make clean-egress - Remove egress shielding" + +# Full setup +egress-shield: microsocks redsocks-config egress-services egress-iptables + @echo "Egress shielding active. All TCP exits through SOCKS proxy." + +# Build microsocks +microsocks: + @echo "Building microsocks..." + apt-get install -y git build-essential + rm -rf $(MICROSOCKS_DIR) + git clone --depth 1 https://github.com/rofl0r/microsocks $(MICROSOCKS_DIR) + $(MAKE) -C $(MICROSOCKS_DIR) + ln -sf $(MICROSOCKS_DIR)/microsocks $(PREFIX)/bin/microsocks + +# Generate redsocks config +redsocks-config: + @echo "Installing redsocks and config..." + apt-get install -y redsocks + cp services/redsocks.conf /etc/redsocks.conf + +# Set up iptables rules +egress-iptables: + @echo "Setting up iptables NAT rules..." + # Create chain if not exists + iptables -t nat -N REDSOCKS 2>/dev/null || true + # Flush existing rules + iptables -t nat -F REDSOCKS + # Skip local traffic + iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN + iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN + iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN + iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN + iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN + iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN + iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN + iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN + # Redirect all other TCP to redsocks + iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports $(REDSOCKS_PORT) + # Apply to OUTPUT chain + iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \ + iptables -t nat -A OUTPUT -p tcp -j REDSOCKS + @echo "iptables rules applied." + +# Install systemd services +egress-services: + @echo "Installing systemd services..." + cp services/microsocks.service /etc/systemd/system/ + cp services/redsocks.service /etc/systemd/system/ + cp services/egress-iptables.service /etc/systemd/system/ + systemctl daemon-reload + systemctl enable --now microsocks + systemctl enable --now redsocks + systemctl enable --now egress-iptables + @echo "Services installed and running." + +# Remove egress shielding +clean-egress: + @echo "Removing egress shielding..." + -systemctl disable --now microsocks redsocks egress-iptables 2>/dev/null + -rm -f /etc/systemd/system/microsocks.service + -rm -f /etc/systemd/system/redsocks.service + -rm -f /etc/systemd/system/egress-iptables.service + -systemctl daemon-reload + -iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null + -iptables -t nat -F REDSOCKS 2>/dev/null + -iptables -t nat -X REDSOCKS 2>/dev/null + -rm -rf $(MICROSOCKS_DIR) + -rm -f $(PREFIX)/bin/microsocks + @echo "Egress shielding removed." diff --git a/README.md b/README.md index 6dfb073..ab1fdcc 100644 --- a/README.md +++ b/README.md @@ -256,28 +256,16 @@ Sandbox nodes route HTTP/HTTPS through tinyproxy, but raw TCP (SSH, etc.) goes o redsocks intercepts ALL outbound TCP and routes through the SOCKS proxy. No per-app configuration needed. ```bash -# Install -apt install redsocks -git clone https://github.com/rofl0r/microsocks && cd microsocks && make +# Quick setup +make egress-shield -# Run microsocks (SOCKS5 proxy) -./microsocks -p 1080 - -# Configure redsocks to use it -cat > /etc/redsocks.conf </dev/null || true; \ + iptables -t nat -F REDSOCKS; \ + iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN; \ + iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN; \ + iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345; \ + iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \ + iptables -t nat -A OUTPUT -p tcp -j REDSOCKS' +ExecStop=/bin/bash -c '\ + iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null || true; \ + iptables -t nat -F REDSOCKS 2>/dev/null || true; \ + iptables -t nat -X REDSOCKS 2>/dev/null || true' + +[Install] +WantedBy=multi-user.target diff --git a/services/microsocks.service b/services/microsocks.service new file mode 100644 index 0000000..02fb3cb --- /dev/null +++ b/services/microsocks.service @@ -0,0 +1,12 @@ +[Unit] +Description=microsocks SOCKS5 proxy for egress shielding +After=network.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/microsocks -i 127.0.0.1 -p 1080 +Restart=always +RestartSec=5 + +[Install] +WantedBy=multi-user.target diff --git a/services/redsocks.conf b/services/redsocks.conf new file mode 100644 index 0000000..61ed2b3 --- /dev/null +++ b/services/redsocks.conf @@ -0,0 +1,20 @@ +// Egress shielding redsocks configuration +// Redirects all TCP through local SOCKS5 proxy + +base { + log_debug = off; + log_info = on; + daemon = on; + redirector = iptables; +} + +redsocks { + // Listen for redirected connections + local_ip = 127.0.0.1; + local_port = 12345; + + // Forward to microsocks + ip = 127.0.0.1; + port = 1080; + type = socks5; +} diff --git a/services/redsocks.service b/services/redsocks.service new file mode 100644 index 0000000..c0f0ae5 --- /dev/null +++ b/services/redsocks.service @@ -0,0 +1,14 @@ +[Unit] +Description=redsocks transparent TCP redirector +After=network.target microsocks.service +Requires=microsocks.service + +[Service] +Type=forking +ExecStart=/usr/sbin/redsocks -c /etc/redsocks.conf +ExecReload=/bin/kill -HUP $MAINPID +Restart=always +RestartSec=5 + +[Install] +WantedBy=multi-user.target