![]() |
Table of Content |
JonDo Interface ![]() |
JonDo and JonDoDaemon do not offer a transparent proxy port nor DNS port. To redirect the traffic with firewall rules to JonDo you have to use a transparent proxy tool like tranSOCKS_ev and a local DNS server like HTTPSDNS daemon. Both tools can use JonDo like a upstream proxy for traffic anonymisation. tranSOCKS_ev works only with JonDonym premium services, HTTPSDNS daemon can use free mix cascades too.
The following tutorial is not for beginners.
tranSOCKS_ev provides a transparent proxy port and forward incoming traffic to a SOCKS5 proxy like JonDo. It is developed at tiggersWelt.net. You can download an extented source archive transocks_ev.tar.bz2 (OpenPGP signature) from our server.
For compilation of transocks_ev.c the libraries libevent and developer files are requiered. Please install it with the package manager of your distribution. > sudo aptitude install libevent-dev
Unpack the archiv, compile the software and install it by running: > make && sudo make install
Create a new user for running tranSOCKS_ev: > sudo adduser --system --disabled-password --group transocks_daemon
Start tranSOCKS_ev proxy
> sudo -u transocks_daemon transocks_ev -H 127.0.0.1 -p 4008 -S 127.0.0.1 -s 4001parameter | description |
---|---|
-H IP | The local IP-Address where tranSOCKS_ev should bind to |
-p port | The local port where tranSOCKS_ev should listen for incoming connections |
-s port | The port of your SOCKS5 server (JonDo listen port) |
-S IP | The IP address of your SOCKS5 server (IP of JonDo) |
-f | Keep the application in foreground |
The archive contains a sys-V-init script for Debian GNU/Linux to start the daemon at boot time (it works for Ubuntu and Linux Mint too). Copy the script to /etc/init.d/ and add it to the boot sequence:
> sudo cp init.d/transocks.debian /etc/init.d/transocks
> sudo insserv transocks
You can modify listen port and IP address of tranSOCKS_ev and upstream SOCKS5 proxy (JonDo) by edit the variables in the start script.
HTTPSDNS daemon is a small local DNS server. It redirects DNS queries over the HTTPS protocol to a HTTPSDNS server and uses JonDo proxy client for anonymisation of traffic. You can download the archive httpsdnsd.tar.bz2 (OpenPGP signature) from our server.
HTTPSDNS daemon is written in Perl. The following Perl Modules are requiered by the HTTPS-DNS daemon:
Log::Log4perl,
Net::Server::Daemonize,
Net::SSLeay,
XML::Simple,
Net::DNS,
Net::DNS::Nameserver
You may install the requiered modules from CPAN by:
> sudo perl -MCPAN -e shell
Or you may use the package manager of your distribution to install the modules: > sudo aptitude install libnet-ssleay-perl libnet-server-perl libnet-dns-perl libxml-simple-perl liblog-log4perl-perl
To install HTTPSDNS daemon unpack the archive and run the install script: > sudo install.sh
Create a new user for running HTTPSDNS daemon: > sudo adduser --system --disabled-password --group httpsdns_daemon
It is possible to modify the behaviour of the daemon by command line arguments. For full description of all command line parameter have a look at the man page.
parameter | description | default value |
---|---|---|
--host | The local IP-Address where httpsdnsd should bind to. | 127.0.0.1 |
--port | The local port where httpsdnsd should listen for incoming connections. | 4053 |
--https_proxy_port | The port of of upstream proxy (JonDo listen port). | 4001 |
--https_proxy_host | The IP address of upstream proxy (IP of JonDo). | 127.0.0.1 |
--runasdaemon | Daemonize httpsdnsd | |
--daemon-user | UID for the daemon | httpsdns_daemon |
--daemon-group | GID for the daemon | httpsdns_daemon |
The archive contains a sys-V-init script for Debian GNU/Linux to start the daemon at boot time (it works for Ubuntu and Linux Mint too). Copy the script to /etc/init.d/ and add it to the boot sequence:
> sudo cp init.d/httpsdnsd.debian /etc/init.d/httpsdnsd
> sudo insserv httpsdnsd
You can modify listen port and IP address of HTTPSDNS daemon and upstream proxy (JonDo) by edit the variables in the start script.
To improve the performance of DNS resolution you may use a DNS caching daemon like pdnsd or bind. The subdirectory "misc" contains sample configurations for both DNS servers. We recommed the light-weight daemon pdnsd, bind is overkill. Install pdnsd with the package manager of your distribution and copy the sample configuration to "/usr/share/pdnsd".
> sudo aptitude install pdnsd
> sudo cp misc/pdnsd-httpsdns.conf /usr/share/pdnsd/
Edit the line AUTO_MODE in the file "/etc/default/pdnsd" and choose the httpsdns configuration. AUTO_MODE=httpsdns
After restart of pdnsd the daemon is listen at port 2053. In case of cache missmatch it will ask the httpsdns daemon listen at port 4053 for DNS resolution. Adapt the firewall rules below and replace "4053" by "2053".
If tranSOCKS_ev and HTTPSDNS daemon were running you can add rules to your firewall to redirect the traffic of a user or a group to JonDo or JonDoDaemon. The following example for iptables redirects all outgoing TCP traffic of the user with UID anonuser over transocks_ev to JonDo, DNS traffic to HTTPSDNS daemon and rejects all other traffic of this user. You may use --gid-owner to redirect the traffic by group.
iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonuser -m udp --dport 53 -j REDIRECT --to-ports 4053
iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner anonuser -m tcp --dport 53 -j REDIRECT --to-ports 4053
iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner anonuser -m tcp -j REDIRECT --to-ports 4008
iptables -t filter -A OUTPUT -p udp -m owner --uid-owner anonuser -m udp --dport 4053 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -m owner --uid-owner anonuser -m tcp --dport 4053 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -m owner --uid-owner anonuser -m tcp --dport 4008 -j ACCEPT
iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner anonuser -j REJECT
Hint: JonDo proxy client must not running with UID anonuser or may not running on the same computer!
![]() |
Table of Content |
JonDo Interface ![]() |