CyberMind-FR
4a0ab9530f
## New Features - secubox-app-yggdrasil-discovery: Mesh peer discovery via gossip protocol - yggctl CLI: status, self, peers, announce, discover, bootstrap - Auto-peering with trust verification (master-link fingerprint) - Daemon for periodic announcements ## Bug Fixes - tor-shield: Fix opkg downloads failing when Tor active - DNS over Tor disabled by default - Auto-exclude public DNS servers from iptables rules - Excluded domains bypass list (openwrt.org, pool.ntp.org, etc.) - haproxy: Fix portal 503 "End of Internet" error - Corrected malformed vhost backend configuration - Regenerated HAProxy config from UCI - luci-app-nextcloud: Fix users list showing empty - RPC expect clause was extracting array, render expected object ## Updated - Bonus feed: All IPKs rebuilt - Documentation: HISTORY.md, WIP.md, TODO.md updated Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| files | ||
| Makefile | ||
| README.md | ||
SecuBox Tor Shield
Tor integration for OpenWrt providing transparent proxy, SOCKS proxy, DNS over Tor, kill switch, hidden services, and bridge support.
Installation
opkg install secubox-app-tor
Configuration
UCI config file: /etc/config/tor-shield
uci set tor-shield.main.enabled='1'
uci set tor-shield.main.mode='transparent'
uci set tor-shield.main.dns_over_tor='1'
uci set tor-shield.main.kill_switch='0'
uci commit tor-shield
Usage
torctl start # Start Tor service
torctl stop # Stop Tor service
torctl status # Show Tor status and circuits
torctl newnym # Request new Tor identity
torctl bridges # Manage bridge relays
torctl hidden add # Create a hidden service
torctl hidden list # List hidden services
torctl killswitch on # Enable kill switch (block non-Tor traffic)
torctl killswitch off # Disable kill switch
Modes
- Transparent proxy -- All LAN traffic routed through Tor via iptables
- SOCKS proxy -- SOCKS5 endpoint for per-app Tor usage
- DNS over Tor -- DNS queries resolved through Tor network
- Kill switch -- Blocks all non-Tor traffic if Tor goes down
Excluded Domains (System Services Bypass)
When Tor Shield is active, certain system services (opkg, NTP, ACME) need direct internet access. These domains bypass Tor DNS and routing:
- OpenWrt package repositories (
downloads.openwrt.org, mirrors) - NTP time servers (
pool.ntp.org,time.google.com) - Let's Encrypt ACME (
acme-v02.api.letsencrypt.org) - DNS provider APIs (Gandi, OVH, Cloudflare)
Configure additional exclusions in UCI:
uci add_list tor-shield.trans.excluded_domains='my.example.com'
uci commit tor-shield
/etc/init.d/tor-shield restart
The exclusions are implemented at two levels:
- dnsmasq bypass -- DNS queries for excluded domains go directly to upstream
- iptables RETURN -- Traffic to resolved IPs bypasses Tor transparent proxy
Dependencies
iptablescurljsonfiltersocat
License
Apache-2.0