Network | Nikola Kvartovič

VPN

Wireguard

Get aconfig file, e.g. from Mullvad:

Choose your platform → Linux
Generate a WireGuard key → Generate key
Generate and download configuration → Download zip archive

Select a country & city near you. Only one server can be connected to at once.

Import the config file with NetworkManager, replace wg0 with your file name:

nmcli connection import type wireguard file wg0.conf

See Thomas Haller’s Blog.

Proxy

Tor

/pix/tech/tor-thumb.webp — Onion network routing.

Configure programs & apps to use Tor as the network proxy: socks5://127.0.0.1:9050.

torsocks/proxychains-ng can route programs without SOCKS/proxy support through Tor.

I2P

/pix/tech/i2p-thumb.webp — Garlic network routing.

I2Pd should be used, it’s written in C++ & works better.

Configure programs & apps to use I2Pd as the network proxy: socks5://127.0.0.1:4447.

proxychains-ng can route programs without SOCKS/proxy support through I2P. Replace the last line (defaults to Tor) in its config with this:

socks5 127.0.0.1 4447

Yggdrasil

Decentralized & end-to-end encrypted layer on top of IPv6. Doesn’t anonymize any traffic, & seems systemd only.

Terminal

Standard & commonly used curl proxy environment variables to be set in shell profile, here for Tor:

export http_proxy="socks5h://127.0.0.1:9050" # Must be lowercase.
export HTTPS_PROXY="$http_proxy"
export FTP_PROXY="$http_proxy"
export FTPS_PROXY="$http_proxy"
export ALL_PROXY="$http_proxy"
export NO_PROXY="127.0.0.1,::1,localhost"
export SOCKS5_PROXY="${http_proxy#*//}" # Lynx SOCKS proxy.

yay will try connecting to the proxy over the proxy, so here’s a function which may be put in the shell profile

yay() { env -u http_proxy -u HTTPS_PROXY yay "$@" ;}

Lynx will try to use the HTTP proxy unless it is unset, so here’s the same function for it:

lynx() { env -u http_proxy -u HTTPS_PROXY lynx "$@" ;}

Further, some additional variables for Syncthing:

export ALL_PROXY_NO_FALLBACK=1 # Set Syncthing not to connect if proxy fails.
export all_proxy="$http_proxy" # Syncthing requires this to be lowercase.

Remember to read the man page for programs to see its specific proxy configurations!

DNS

To change DNS with NetworkManager’s nmtui e.g. to Mullvad:

Edit a connection → Edit
- IPv4 CONFIGURATION
  - DNS servers: 194.242.2.2
  - ☑ Ignore automatically obtained DNS parameters
- IPv6 CONFIGURATION
  - DNS servers: 2a07:e340::2
  - ☑ Ignore automatically obtained DNS parameters

Or, to completely disable it, insert this into /etc/NetworkManager/conf.d/90-dns-none.conf:

[main]
dns=none

Then restart NetworkManager.

Iptables

To block all non-Tor/I2Pd traffic, set these iptables rules (as root):

# Clear current rules
iptables -F

# Allow Tor user. Repeat this & change 'tor' to 'i2pd' for I2Pd etc.
iptables -A OUTPUT -m owner --uid-owner tor -j ACCEPT

# Allow loopback connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Accept packets for established (allowed) connections
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

# Drop all packets for other users
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Save the rules
iptables-save >/etc/iptables/iptables.rules

# Apply the rules
iptables-restore /etc/iptables/iptables.rules

# IPv6
ln -sf /etc/iptables/iptables.rules /etc/iptables/ip6tables.rules
ip6tables-restore /etc/iptables/ip6tables.rules

For Artix-runit, install iptables-runit & set it to run at boot (both iptables & ip6tables) to automatically apply these.

NTP

With this set-up & Tor, NTP won’t work (it uses UDP on port 123). If you’re running I2Pd though, it can synchronize system time, append these lines to /etc/i2pd/i2pd.conf:

[nettime]
## Enable NTP sync. (default: false)
enabled = true
## Comma-separated list of NTP server. (default: pool.ntp.org)
# ntpservers = pool.ntp.org
## NTP time sync interval in hours. (default: 72)
# ntpsyncinterval = 72
## Sync clock from transport peers (default: true)
# frompeers = true

Syncthing

Syncthing’s network options are:

Actions → Settings → Connections
- Enable NAT traversal – UDP
- Local Discovery – LAN
- Global Discovery – Discover devices over internet
- Enable Relaying – Relay traffic over internet

Sync Protocol Listen Addresses defaults to tcp://0.0.0.0:22000, quic://0.0.0.0:22000 (UDP), & dynamic+https://relays.syncthing.net/endpoint. Set it to just tcp, & the relay if using it.

Tor

This will connect to devices with Syncthing over Tor onions.

Create a hidden service for Syncthing by inserting these lines into /etc/tor/torrc (where the other HiddenService lines are):

HiddenServiceDir /var/lib/tor/hidden_service_syncthing/
HiddenServicePort 22000 127.0.0.1:22000

Reload Tor, its onion address will be in /var/lib/tor/hidden_service_syncthing/hostname.

In Syncthing, set the device’s address to the onion (change hidden_service to your onion):

Remote Devices → Edit → Advanced
- Addresses: tcp://hidden_service.onion:22000

If on Android (with Orbot), create a hidden service:

... More → Hosted Onion Services → +
- Name: hidden_service_syncthing
- Local Port: 22000
- Onion Port: 22000

Then restart Orbot & go back & tap the service to copy the address.

Package Mirrors

Artix Linux

In /etc/pacman.conf, under [options], uncomment & edit this line:

XferCommand = /usr/bin/curl -x socks5h://127.0.0.1:9050 -L -C - -f -o %o %u

Further down, under # Misc options, insert this line below #DisableSandboxSyscalls:

DisableDownloadTimeout

For I2P, replace socks5h://127.0.0.1:9050 with socks5h://127.0.0.1:4447.

Remove all servers in /etc/pacman.d/mirrorlist & put:

Server = http://dotsrccccbidkzg7oc7oj4ugxrlfbt64qebyunxbrgqhxiwj3nl6vcad.onion/artix-linux/repos/$repo/os/$arch
Server = http://artixhnbzrty77wcrnv4a5ylx7ujro7w5ueopb6un6uxmc36lhnz2oid.onion/artix-linux/$repo/os/$arch
Server = http://artix2mxaxme7kbswcil3l3q5vrhvol7fzipjo47xtxmhgb75chipgid.onion/artix-linux/$repo/os/$arch

For I2P, instead insert:

Server = http://artixmirror.i2p/artix-linux/$repo/os/$arch
Server = http://artixmirror2.i2p/artix-linux/$repo/os/$arch

If these aren’t in your address book, here’s the .b32 addresses:

Server = http://zjhzlv5f3lsrockbgsrwhblvxclmerdp7u574m3moehxy6c45x7a.b32.i2p/artix-linux/$repo/os/$arch
Server = http://artix2akdnitgmh26k7d47ahlkj7wqaenwfuti54g5bren7iiimq.b32.i2p/artix-linux/$repo/os/$arch

Arch Linux

This supposes you’re running Artix with artix-archlinux-support installed, e.g. by LARBS.

Remove all servers in /etc/pacman.d/mirrorlist-arch & put:

Server = http://dotsrccccbidkzg7oc7oj4ugxrlfbt64qebyunxbrgqhxiwj3nl6vcad.onion/archlinux/$repo/os/$arch
Server = http://artixhnbzrty77wcrnv4a5ylx7ujro7w5ueopb6un6uxmc36lhnz2oid.onion/arch-linux/$repo/os/$arch

For I2P, instead insert:

Server = http://artixmirror.i2p/arch-linux/$repo/os/$arch

If this isn’t in your address book, here’s the .b32 address:

Server = http://zjhzlv5f3lsrockbgsrwhblvxclmerdp7u574m3moehxy6c45x7a.b32.i2p/arch-linux/$repo/os/$arch