Network | Nikola Kvartovič

VPN

Wireguard

Get aconfig file, e.g. from Mullvad:

Choose your platform → Linux
Generate a WireGuard key → Generate key
Generate and download configuration → Download zip archive

Select a country & city near you. Only one server can be connected to at once.

Import the config file with NetworkManager, replace wg0 with your file name:

nmcli connection import type wireguard file wg0.conf

Also see Thomas Haller’s Blog.

DNS

To change DNS with NetworkManager’s nmtui:

Edit a connection → Edit
- IPv4 CONFIGURATION
  - DNS servers: 9.9.9.9, 149.112.112.112 (Quad9)
  - ☑ Ignore automatically obtained DNS parameters
- IPv6 CONFIGURATION
  - DNS servers: 2620:fe::fe, 2620:fe::9 (Quad9)
  - ☑ Ignore automatically obtained DNS parameters

Or, to completely disable it, insert this into /etc/NetworkManager/conf.d/90-dns-none.conf:

[main]
dns=none

Then restart NetworkManager.

Proxies

🧅 Tor – Anonymization proxy, onion routing.
🧄 I2Pd – Anonymization proxy, garlic routing.
🌱 Yggdrasil – Non-anonymization network overlay.

Configure programs & apps to use a network proxy:

Tor – socks5://127.0.0.1:9050.
I2Pd – socks5://127.0.0.1:4447.

Use torsocks or proxychains-ng to route programs without SOCKS/proxy support through Tor/I2Pd.

By default proxychains-ng routes through Tor, so for I2P change the port on the last line in its config.

/pix/yggdrasil-thumb.webp — Yggdrasil network.

Standard & commonly used curl proxy environment variables to be set in the shell profile, here for Tor:

export http_proxy="socks5h://127.0.0.1:9050" # Must be lowercase.
export HTTPS_PROXY="$http_proxy"
export FTP_PROXY="$http_proxy"
export FTPS_PROXY="$http_proxy"
export ALL_PROXY="$http_proxy"
export NO_PROXY="127.0.0.1,::1,localhost"

mpv doesn’t have SOCKS support, but passes it to yt-dlp, so here’s a function which can be put in the shell profile or aliasrc (replace torsocks with proxychains if needed):

mpv() { torsocks mpv -ytdl-raw-options=proxy= "$@" ;}

Iptables

To block all non-Tor/I2Pd traffic, set these iptables rules (as root):

# Clear current rules
iptables -F

# Allow Tor user. Repeat this but replace 'tor' with 'i2pd' for I2Pd &c.
iptables -A OUTPUT -m owner --uid-owner tor -j ACCEPT

# (Optional) Allow a port on LAN, e.g. 22 (ssh)
iptables -A OUTPUT -d 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

# Allow loopback connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Accept packets for established (allowed) connections
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

# Drop all packets for other users
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Save & apply the rules
iptables-save >/etc/iptables/iptables.rules
iptables-restore /etc/iptables/iptables.rules

# IPv6
ln -sf /etc/iptables/iptables.rules /etc/iptables/ip6tables.rules
ip6tables-restore /etc/iptables/ip6tables.rules

For Artix-runit, install iptables-runit & set it to run at boot (both iptables & ip6tables) to automatically apply these.

NTP

With this set-up & Tor, NTP won’t work (it uses UDP on port 123). But I2Pd can synchronize system time. Append these lines to /etc/i2pd/i2pd.conf:

[nettime]
## Enable NTP sync. (default: false)
enabled = true
## Comma-separated list of NTP server. (default: pool.ntp.org)
# ntpservers = pool.ntp.org
## NTP time sync interval in hours. (default: 72)
# ntpsyncinterval = 72
## Sync clock from transport peers (default: true)
# frompeers = true

Mutt Wizard

mbsync (used by mutt-wizard) doesn’t have proxy support, but can be routed with torsocks/proxychains. Add to your shell profile or aliasrc:

for command in mw mailsync ; do
    alias $command="torsocks $command"
done; unset command

For I2Pd, pass -f to proxychains with a config file.

To use a .onion address, edit these lines in ~/.config/mbsync/config:

Host hidden_service.onion
TLSType none

msmtp has proxy support, append these lines to the account section in ~/.config/msmtp/config:

tls_starttls off
proxy_host 127.0.0.1
proxy_port 9050

For I2Pd, replace 9050 with 4447.

Syncthing

Syncthing’s network options are:

Actions → Settings → Connections
- Enable NAT traversal – UDP
- Local Discovery – LAN
- Global Discovery – Discover devices over internet
- Enable Relaying – Relay traffic over internet

Shell variables for (replace $http_proxy if needed):

export all_proxy="$http_proxy" # Must be lowercase.
export ALL_PROXY_NO_FALLBACK=1 # Don't make connections if proxy fails.
export NO_PROXY="$NO_PROXY,192.168.1.0/24" # No proxy for LAN devices.

Iptables rules to allow Local Discovery:

# LAN connections
iptables -A OUTPUT -d 192.168.0.0/24 -p tcp --dport 22000 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22000 -j ACCEPT
# LAN broadcasts
iptables -A OUTPUT -d 192.168.0.0/24 -p udp --dport 21027 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p udp --dport 21027 -j ACCEPT

Devices can connect over Tor hidden services. First create a hidden service for Syncthing, insert these lines in /etc/tor/torrc (where the other HiddenService lines are):

HiddenServiceDir /var/lib/tor/hidden_service_syncthing/
HiddenServicePort 22000 127.0.0.1:22000

Reload Tor, its onion address will be in: /var/lib/tor/hidden_service_syncthing/hostname

In Syncthing, set the device’s address to the onion (change hidden_service to your onion):

Remote Devices → Edit → Advanced
- Addresses: tcp://hidden_service.onion:22000
- Compression: All Data

If on Android (with Orbot), to create a hidden service:

… More → Hosted Onion Services → +
- Name: hidden_service_syncthing
- Local Port: 22000
- Onion Port: 22000

Restart Orbot & go back & tap the service to copy the onion address.

Artix Linux

In /etc/pacman.conf, under [options], uncomment & edit this line:

XferCommand = /usr/bin/curl -x socks5h://127.0.0.1:9050 -L -C - -f -o %o %u

For I2Pd, replace socks5h://127.0.0.1:9050 with socks5h://127.0.0.1:4447.

Further down under # Misc options insert this line below #DisableSandboxSyscalls:

DisableDownloadTimeout

Remove all servers in /etc/pacman.d/mirrorlist, then put:

Server = http://dotsrccccbidkzg7oc7oj4ugxrlfbt64qebyunxbrgqhxiwj3nl6vcad.onion/artix-linux/repos/$repo/os/$arch
Server = http://artixhnbzrty77wcrnv4a5ylx7ujro7w5ueopb6un6uxmc36lhnz2oid.onion/artix-linux/$repo/os/$arch
Server = http://artix2mxaxme7kbswcil3l3q5vrhvol7fzipjo47xtxmhgb75chipgid.onion/artix-linux/$repo/os/$arch

For I2P, instead put:

Server = http://artixmirror.i2p/artix-linux/$repo/os/$arch
Server = http://artixmirror2.i2p/artix-linux/$repo/os/$arch

If these aren’t in your address book, here are the .b32 addresses:

Server = http://zjhzlv5f3lsrockbgsrwhblvxclmerdp7u574m3moehxy6c45x7a.b32.i2p/artix-linux/$repo/os/$arch
Server = http://artix2akdnitgmh26k7d47ahlkj7wqaenwfuti54g5bren7iiimq.b32.i2p/artix-linux/$repo/os/$arch

Arch Linux

This is for running Artix with artix-archlinux-support installed.

Remove all servers in /etc/pacman.d/mirrorlist-arch, then put:

Server = http://dotsrccccbidkzg7oc7oj4ugxrlfbt64qebyunxbrgqhxiwj3nl6vcad.onion/archlinux/$repo/os/$arch
Server = http://artixhnbzrty77wcrnv4a5ylx7ujro7w5ueopb6un6uxmc36lhnz2oid.onion/arch-linux/$repo/os/$arch

For I2Pd, instead put:

Server = http://artixmirror.i2p/arch-linux/$repo/os/$arch

If this isn’t in your address book, here is the .b32 address:

Server = http://zjhzlv5f3lsrockbgsrwhblvxclmerdp7u574m3moehxy6c45x7a.b32.i2p/arch-linux/$repo/os/$arch

Phones

Both Tor (Orbot), I2Pd, & Yggdrasil are available from F-Droid.

If you’ve installed Orbot, set F-Droid to use its onion mirrors:

Settings → Proxy → ☑ Use Tor

Orbot is also available on iOS.