diff --git a/Makefile b/Makefile deleted file mode 100644 index ae1473c..0000000 --- a/Makefile +++ /dev/null @@ -1,87 +0,0 @@ -# UN CLI Inception - Makefile -# Egress shielding setup for sandbox nodes - -PREFIX ?= /usr/local -MICROSOCKS_DIR = /opt/microsocks -REDSOCKS_PORT = 12345 -SOCKS_PORT = 1080 - -.PHONY: help egress-shield microsocks redsocks-config egress-iptables egress-services clean-egress - -help: - @echo "Egress Shielding:" - @echo " make egress-shield - Full setup (build + config + iptables + services)" - @echo " make microsocks - Build microsocks SOCKS5 proxy" - @echo " make redsocks-config - Generate /etc/redsocks.conf" - @echo " make egress-iptables - Set up iptables NAT rules" - @echo " make egress-services - Install and enable systemd services" - @echo " make clean-egress - Remove egress shielding" - -# Full setup -egress-shield: microsocks redsocks-config egress-services egress-iptables - @echo "Egress shielding active. All TCP exits through SOCKS proxy." - -# Build microsocks -microsocks: - @echo "Building microsocks..." - apt-get install -y git build-essential - rm -rf $(MICROSOCKS_DIR) - git clone --depth 1 https://github.com/rofl0r/microsocks $(MICROSOCKS_DIR) - $(MAKE) -C $(MICROSOCKS_DIR) - ln -sf $(MICROSOCKS_DIR)/microsocks $(PREFIX)/bin/microsocks - -# Generate redsocks config -redsocks-config: - @echo "Installing redsocks and config..." - apt-get install -y redsocks - cp services/redsocks.conf /etc/redsocks.conf - -# Set up iptables rules -egress-iptables: - @echo "Setting up iptables NAT rules..." - # Create chain if not exists - iptables -t nat -N REDSOCKS 2>/dev/null || true - # Flush existing rules - iptables -t nat -F REDSOCKS - # Skip local traffic - iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN - iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN - iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN - iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN - iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN - iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN - iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN - iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN - # Redirect all other TCP to redsocks - iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports $(REDSOCKS_PORT) - # Apply to OUTPUT chain - iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \ - iptables -t nat -A OUTPUT -p tcp -j REDSOCKS - @echo "iptables rules applied." - -# Install systemd services -egress-services: - @echo "Installing systemd services..." - cp services/microsocks.service /etc/systemd/system/ - cp services/redsocks.service /etc/systemd/system/ - cp services/egress-iptables.service /etc/systemd/system/ - systemctl daemon-reload - systemctl enable --now microsocks - systemctl enable --now redsocks - systemctl enable --now egress-iptables - @echo "Services installed and running." - -# Remove egress shielding -clean-egress: - @echo "Removing egress shielding..." - -systemctl disable --now microsocks redsocks egress-iptables 2>/dev/null - -rm -f /etc/systemd/system/microsocks.service - -rm -f /etc/systemd/system/redsocks.service - -rm -f /etc/systemd/system/egress-iptables.service - -systemctl daemon-reload - -iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null - -iptables -t nat -F REDSOCKS 2>/dev/null - -iptables -t nat -X REDSOCKS 2>/dev/null - -rm -rf $(MICROSOCKS_DIR) - -rm -f $(PREFIX)/bin/microsocks - @echo "Egress shielding removed." diff --git a/README.md b/README.md index ab1fdcc..6dfb073 100644 --- a/README.md +++ b/README.md @@ -256,16 +256,28 @@ Sandbox nodes route HTTP/HTTPS through tinyproxy, but raw TCP (SSH, etc.) goes o redsocks intercepts ALL outbound TCP and routes through the SOCKS proxy. No per-app configuration needed. ```bash -# Quick setup -make egress-shield +# Install +apt install redsocks +git clone https://github.com/rofl0r/microsocks && cd microsocks && make -# Or step by step -make microsocks # Build SOCKS5 proxy -make redsocks-config # Generate /etc/redsocks.conf -make egress-iptables # Set up iptables rules -make egress-services # Install and start systemd services +# Run microsocks (SOCKS5 proxy) +./microsocks -p 1080 + +# Configure redsocks to use it +cat > /etc/redsocks.conf </dev/null || true; \ - iptables -t nat -F REDSOCKS; \ - iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN; \ - iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN; \ - iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345; \ - iptables -t nat -C OUTPUT -p tcp -j REDSOCKS 2>/dev/null || \ - iptables -t nat -A OUTPUT -p tcp -j REDSOCKS' -ExecStop=/bin/bash -c '\ - iptables -t nat -D OUTPUT -p tcp -j REDSOCKS 2>/dev/null || true; \ - iptables -t nat -F REDSOCKS 2>/dev/null || true; \ - iptables -t nat -X REDSOCKS 2>/dev/null || true' - -[Install] -WantedBy=multi-user.target diff --git a/services/microsocks.service b/services/microsocks.service deleted file mode 100644 index 02fb3cb..0000000 --- a/services/microsocks.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=microsocks SOCKS5 proxy for egress shielding -After=network.target - -[Service] -Type=simple -ExecStart=/usr/local/bin/microsocks -i 127.0.0.1 -p 1080 -Restart=always -RestartSec=5 - -[Install] -WantedBy=multi-user.target diff --git a/services/redsocks.conf b/services/redsocks.conf deleted file mode 100644 index 61ed2b3..0000000 --- a/services/redsocks.conf +++ /dev/null @@ -1,20 +0,0 @@ -// Egress shielding redsocks configuration -// Redirects all TCP through local SOCKS5 proxy - -base { - log_debug = off; - log_info = on; - daemon = on; - redirector = iptables; -} - -redsocks { - // Listen for redirected connections - local_ip = 127.0.0.1; - local_port = 12345; - - // Forward to microsocks - ip = 127.0.0.1; - port = 1080; - type = socks5; -} diff --git a/services/redsocks.service b/services/redsocks.service deleted file mode 100644 index c0f0ae5..0000000 --- a/services/redsocks.service +++ /dev/null @@ -1,14 +0,0 @@ -[Unit] -Description=redsocks transparent TCP redirector -After=network.target microsocks.service -Requires=microsocks.service - -[Service] -Type=forking -ExecStart=/usr/sbin/redsocks -c /etc/redsocks.conf -ExecReload=/bin/kill -HUP $MAINPID -Restart=always -RestartSec=5 - -[Install] -WantedBy=multi-user.target