Конфиг всего этого дела для NixOS{ config, pkgs, ... }:
{
# create bridge with lan 192.168.0.0/24 behind tor
# ipv6 filtering not implemented yet, so disable it
boot.kernel.sysctl = {
"net.ipv6.conf.all.disable_ipv6" = true;
"net.ipv6.conf.all.autoconf" = false;
};
networking.bridges.br-tor.interfaces = [];
networking.interfaces.br-tor.useDHCP = false;
networking.nat.enable = true;
networking.nat.internalInterfaces = [ "vb-torUplink" ];
networking.firewall.enable = true;
containers.torRouter = {
autoStart = true;
config =
{ config, pkgs, ... }:
{
networking.defaultGateway.address = "10.100.1.1";
services.dhcpd4 = {
enable = true;
interfaces = [ "eth0" ];
extraConfig = ''
option routers 192.168.0.1;
option domain-name-servers 192.168.0.1;
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.10 192.168.0.200;
}
'';
};
services.tor = {
enable = true;
client.enable = true;
client.transparentProxy.enable = true;
client.transparentProxy.isolationOptions = [ "IsolateClientAddr" ];
client.transparentProxy.listenAddress = "192.168.0.1:9040";
client.dns.enable = true;
client.dns.isolationOptions = [ "IsolateClientAddr" ];
client.dns.listenAddress = "192.168.0.1:53";
controlSocket.enable = true;
extraConfig = ''
VirtualAddrNetworkIPv4 10.128.0.0/16
ExcludeNodes {ru}
'';
};
networking.firewall.extraCommands = ''
ipt() {
iptables "$@" || echo "Failed: iptables $@"
}
chain() {
# table chain rule rule ...
table="$1"
chain="$2"
iptables -t "$table" -N "$chain" 2>/dev/null || ipt -t "$table" -F "$chain"
shift 2
while [[ -n "$1" ]]; do
ipt -t "$table" -A "$chain" $1
shift
done
}
chain filter TOR \
"-p tcp --dport 9040 -j ACCEPT" \
"-d 192.168.0.1 -p udp --dport 53 -j ACCEPT" \
"-d 192.168.0.1 -p udp --dport 67 -j ACCEPT" \
"-j REJECT --reject-with icmp-net-prohibited"
chain filter INPUT \
"-i lo -j ACCEPT" \
"-i eth0 -j TOR" \
"-i vb-torUplink -m state --state ESTABLISHED,RELATED -j ACCEPT" \
"-j REJECT --reject-with icmp-admin-prohibited"
ipt -t filter -P FORWARD DROP
chain nat TOR \
"-p tcp ! -d 192.168.0.1 -j REDIRECT --to-port 9040"
chain nat PREROUTING \
"-i eth0 -j TOR"
'';
}; # /containers.torRouter.config
privateNetwork = true;
hostBridge = "br-tor";
localAddress = "192.168.0.1/24";
extraVeths.vb-torUplink = {
hostAddress = "10.100.1.1";
localAddress = "10.100.1.2";
};
};
containers.ib = {
bindMounts = {
"/tmp/.X11-unix" = { hostPath = "/tmp/.X11-unix"; };
"/dev/dri" = { hostPath = "/dev/dri"; isReadOnly = false; };
};
allowedDevices = [
{modifier = "rw"; node="/dev/dri/card0";}
];
config =
{ config, pkgs, ... }:
{
networking.interfaces.eth0.useDHCP = true;
hardware.opengl.enable = true;
environment.systemPackages = with pkgs; [ xorg.xauth dnsutils ffmpeg mpv firefox ];
};
autoStart = true;
privateNetwork = true;
hostBridge = "br-tor";
};
}
Для работы X11 с хоста в контейнер нужно импортировать кук X11 с соответствующим хостнеймом:
touch .Xauthority
xauth add $(hostname)/unix:0 MIT-MAGIC-COOKIE-1 $cookie
Получить его на хосте можно командой xauth l.
Для работы звука можно прокинуть unix-сокет pulseaudio:
pulseaudio --disallow-module-loading -L module-alsa-sink -L module-native-protocol-unix auth-anonymous=1 --exit-idle-time=64000 &
sudo machinectl bind --mkdir ib /run/user/1000/pulse
, который в контейнере указать переменной среды:
export PULSE_SERVER=/run/user/1000/pulse/native
