debian.ansible.tornet.network/tornet.yml

---
- name: Tornet Debian Linux Setup
  hosts: all
  tasks:
    
    - name: Packages for tor
      apt:
        name: 
          - tor
          - tor-geoipdb
          - privoxy
          - bridge-utils
          - ufw
          - dnsmasq
          - dnscrypt-proxy
        update_cache: no
        install_recommends: no

    - name: 'remove dnsmasq from startup'
      command: systemctl disable dnsmasq
      args:
        removes: /etc/systemd/system/multi-user.target.wants/dnsmasq.service

    - name: 'stop dnsmasq'
      command: systemctl stop dnsmasq
      args:
        removes: /run/dnsmasq/dnsmasq.pid

    - name: Tor Config
      blockinfile:
        path: /etc/tor/torrc
        create: yes
        mode: "0444"
        owner: root
        group: root
        insertbefore: BOF
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          # individual Tor-Config
          BridgeRelay 0
          SOCKSPort 0.0.0.0:9050
          SOCKSPort [::]:9050
          ExitPolicy reject *:*
          ControlPort 0.0.0.0:9051
          ControlPort [::]:9051
          HashedControlPassword 16:F7222A0CBC254E536056DCBBD27A7D051D68BCF1E9020681C0A3656B84
          # Seting up TOR transparent proxy for tor-router
          #VirtualAddrNetwork 10.192.0.0/10
          AutomapHostsOnResolve 1
          TransPort 0.0.0.0:9040
          TransPort [::]:9040
          DNSPort 0.0.0.0:5353
          DNSPort [::]:5353
          # Falls outgping geblockt wird und nur 80/443 geht
          FascistFirewall 1
        backup: yes
      notify:
      - Restart tor

    - name: Privoxy Config
      blockinfile:
        path: /etc/privoxy/config
        create: yes
        mode: "0444"
        owner: root
        group: root
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          listen-address 0.0.0.0:3128
          listen-address [::1]:3128
          # Privoxy-Tor-Connection
          forward-socks5t / localhost:9050 .
        backup: yes
      notify:
      - Restart privoxy

    - name: Tor bridge
      blockinfile:
        path: /etc/network/interfaces.d/tornet0
        create: yes
        mode: "0444"
        owner: root
        group: root
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          auto tornet0
          iface tornet0 inet static
            bridge_ports none
            address 192.168.43.1
            broadcast 192.168.43.255
            netmask 255.255.255.0
      notify:
      - Restart tornet0

    - name: start tornet0 if not exists
      ansible.builtin.command: ifup tornet0
      args:
        creates: /proc/sys/net/ipv6/conf/tornet0/disable_ipv6

    - ansible.posix.sysctl:
        name: net.ipv6.conf.tornet0.disable_ipv6
        value: '1'
        state: present

    - name: ufw firewall rules for transparent tor proxy in tornet0
      blockinfile:
        path: /etc/ufw/before.rules
        create: yes
        mode: "0440"
        owner: root
        group: root
        marker: "# {mark} ANSIBLE MANAGED BLOCK for tornet0"
        insertbefore: BOF
        block: |
          *nat
          :POSTROUTING ACCEPT - [0:0]
          # Route network 192.168.43.0/24 (tornet0) to transparent Tor-Proxy (udp not supported by Tor)
          # Activate "normal" routing for non-Internet Networks
          -A POSTROUTING -s 192.168.43.0/24 -j MASQUERADE
          -A PREROUTING -i tornet0 -d 127.0.0.0/8 -j RETURN
          -A PREROUTING -i tornet0 -d 10.0.0.0/8 -j RETURN
          -A PREROUTING -i tornet0 -d 192.168.0.0/16 -j RETURN
          -A PREROUTING -i tornet0 -d 172.16.0.0/12 -j RETURN
          -A PREROUTING -i tornet0 -d 0.0.0.0/8 -j RETURN
          -A PREROUTING -i tornet0 -d 100.64.0.0/10 -j RETURN
          -A PREROUTING -i tornet0 -d 169.254.0.0/16 -j RETURN
          -A PREROUTING -i tornet0 -d 192.0.0.0/24 -j RETURN
          -A PREROUTING -i tornet0 -d 192.0.2.0/24 -j RETURN
          -A PREROUTING -i tornet0 -d 192.88.99.0/24 -j RETURN
          -A PREROUTING -i tornet0 -d 198.18.0.0/15 -j RETURN
          -A PREROUTING -i tornet0 -d 198.51.100.0/24 -j RETURN
          -A PREROUTING -i tornet0 -d 203.0.113.0/24 -j RETURN
          -A PREROUTING -i tornet0 -d 224.0.0.0/4 -j RETURN
          -A PREROUTING -i tornet0 -d 240.0.0.0/4 -j RETURN
          -A PREROUTING -i tornet0 -d 255.255.255.255/32 -j RETURN
          # Redirect all TCP-Connections to transparent Tor-Proxy
          -A PREROUTING -i tornet0 -s 192.168.43.0/24 -p tcp --syn -j REDIRECT --to-ports 9040
          # Redirect DNS to TorDNS
          -A PREROUTING -i tornet0 -s 192.168.43.0/24 -d 192.168.43.1 -p udp --dport 53 -j REDIRECT --to-ports 5353
          # Redirect all non TCP-Connections into nirvana because Tor only speaks TCP
          -A PREROUTING -i tornet0 -s 192.168.43.0/24 ! -p tcp -j DNAT --to 127.0.0.1:1
          COMMIT
      notify:
      - Restart ufw

    - name: Allow Routing
      community.general.ufw:
        rule: allow
        route: yes
        interface_in: tornet0

    - name: Allow all access to tcp port 53/udp (dns)
      community.general.ufw:
        rule: allow
        port: '53'
        proto: udp
        interface: tornet0
        direction: in

    - name: Allow access to dhcp server
      community.general.ufw:
        rule: allow
        port: '67'
        proto: udp
        interface: tornet0
        direction: in

    - name: Allow access to NTP server
      community.general.ufw:
        rule: allow
        port: '123'
        proto: udp
        interface: tornet0
        direction: in

    - name: Allow access to tor
      community.general.ufw:
        rule: allow
        port: '9040'
        proto: tcp
        interface: tornet0
        direction: in

    - name: dnsmasq DNS and DHCP for tornet0
      blockinfile:
        path: /etc/dnsmasq-tornet0.conf
        create: yes
        mode: "0444"
        owner: root
        group: root
        insertbefore: BOF
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          port=53
          interface=tornet0
          listen-address=192.168.43.1
          bind-interfaces
          except-interface=lo
          domain-needed
          bogus-priv
          dhcp-range=192.168.43.100,192.168.43.200,255.255.255.0,12h
          dhcp-option=option:ntp-server,192.168.43.1
          log-queries
          log-dhcp
      notify:
      - Restart dnsmasq-tornet0

    - name: dnsmasq DNS and DHCP for tornet0 systemd
      blockinfile:
        path: /etc/systemd/system/dnsmasq-tornet0.service
        create: yes
        mode: "0444"
        owner: root
        group: root
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          [Unit]
          Description=dnsmasq tornet0 DNS and DHCP
          After=network.target

          [Service]
          Type=forking
          ExecStart=/usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq-tornet0.pid -u dnsmasq -r /run/dnsmasq/resolv.conf -C /etc/dnsmasq-tornet0.conf --local-service
          PIDFile=/run/dnsmasq/dnsmasq-tornet0.pid
          KillMode=process
          Restart=on-failure

          [Install]
          WantedBy=multi-user.target
      notify:
      - Restart dnsmasq-tornet0

    - name: 'add dnsmasq-tornet0 to startup'
      command: systemctl enable dnsmasq-tornet0
      args:
        creates: /etc/systemd/system/multi-user.target.wants/dnsmasq-tornet0.service

    - name: 'start dnsmasq-tornet0'
      command: systemctl start dnsmasq-tornet0
      args:
        creates: /run/dnsmasq/dnsmasq-tornet0.pid

#### Prepare DNSCRYPT PROXY FOR DoHoT (DNS over HTTPS over Tor)
    - name: create blocked-names.txt
      command: touch /etc/dnscrypt-proxy/blocked-names.txt
      args:
        creates: /etc/dnscrypt-proxy/blocked-names.txt

    - name: dnscrypt-proxy configfile
      copy:
        dest: /etc/dnscrypt-proxy/dnscrypt-proxy.toml
        mode: "0444"
        owner: root
        group: root
        content: |
          # Documentation https://github.com/DNSCrypt/dnscrypt-proxy/wiki
          
          # listen on all interfaces
          listen_addresses = ['127.0.0.55:5354']
          
          # DoH server list
          server_names = ['doh.mullvad.net-194.242.2.2', 'doh.ffmuc.net-185.150.99.255', 'doh.ffmuc.net-5.1.66.255', 'dns.digitale-gesellschaft.ch-185.95.218.42', 'dns.digitale-gesellschaft.ch-185.95.218.43', 'anycast.uncensoreddns.org-91.239.100.100']
          
          # server names to avoid even if they match all criteria
          # disabled_server_names = []
          
          ## what kinds of server do we want to resolve from?
          doh_servers = true
          ipv4_servers = false
          ipv6_servers = false
          dnscrypt_servers = false
          
          # do we support IPv6 accressing?
          block_ipv6 = false
          
          # don't let weird queries & typos leak upstream
          block_unqualified = true
          block_undelegated = true
          
          # TTL for synthetic responses sent when a request has been blocked
          reject_ttl = 600
          
          # request DoH servers which offer DNSSEC / tamperproofing
          require_dnssec = true
          
          # we are using tor, so we should not care about logging
          require_nolog = false
          
          # request DoH servers that advertise themselves as unfiltered
          require_nofilter = true
          
          # use tor
          force_tcp = true
          proxy = 'socks5://127.0.0.1:9050'
          
          # how long (ms) a DNS query will wait for a response; reasonable max 10s
          timeout = 10000
          
          # keepalive for HTTP (HTTPS, HTTP/2) queries, in seconds; default: 30
          keepalive = 30
          
          # loadbalancing; p2 strategy, and continuous farming of the list
          lb_strategy = 'p2'
          lb_estimator = true
          
          # logging: approx 1 month of weekly logs, capped-out/force-rotated at 64Mb
          log_level = 2
          use_syslog = false
          log_files_max_size = 64
          log_files_max_age = 7
          log_files_max_backups = 4
          
          # delay, in minutes, after which certificates are reloaded; this also
          # drives the latency logger, so we poll/log every hour
          cert_refresh_delay = 60
          
          # less linkability / more privacy at slight performance impact;
          # see the notes in the above-cited documentation
          tls_disable_session_tickets = true
          tls_cipher_suite = [52392, 49199]
          
          # for healthcheck, heartbeat and bootstrap, dnscrypt-proxy MUST be
          # able to probe the internet, so we must configure our firewall so
          # that it is the only one which can use port 53 to the internet;
          # dnscrypt-proxy claims that it will only use these services in very
          # limited circumstances. Regards option naming, see:
          # https://github.com/DNSCrypt/dnscrypt-proxy/commit/c500287498a05b07c3af8effa23a0ba4c42f00f1
          fallback_resolvers = ['46.182.19.48:53']
          netprobe_address = '46.182.19.48:53'
          netprobe_timeout = 60
          ignore_system_dns = true
          
          # explicit caching
          cache = true       
          cache_size = 4096
          cache_min_ttl = 2400
          cache_max_ttl = 86400
          cache_neg_min_ttl = 60
          cache_neg_max_ttl = 600
          
          # I am not configuring this resolver as a local DoH listener, to do so
          # requires a TLS certificate and that's a world of pain
          
          [query_log]
          file = '/var/log/dnscrypt-proxy/query.log'
          # ignored_qtypes = ['DNSKEY', 'NS']
          
          [nx_log]
          file = '/var/log/dnscrypt-proxy/nx.log'
          
          [blocked_names]
          blocked_names_file = 'blocked-names.txt'
          log_file = '/var/log/dnscrypt-proxy/blocked-names.log'
                    
          [blocked_ips]
          # blocked_ips_file = 'blocked-ips.txt'
          # log_file = '/var/log/dnscrypt-proxy/blocked-ips.log'
          
          [allowed_names]
          # allowed_names_file = 'allowed-names.txt'
          # log_file = '/var/log/dnscrypt-proxy/allowed-names.log'
                    
          [allowed_ips]
          # allowed_ips_file = 'allowed-ips.txt'
          # log_file = '/var/log/dnscrypt-proxy/allowed-ips.log'
          
          # Static DoH DNS Servers from inspired by https://www.kuketz-blog.de/empfehlungsecke/#dns
          # Stamps from https://dnscrypt.info/stamps/
          [static]
          
          [static.'doh.mullvad.net-194.242.2.2']
          stamp = 'sdns://AgcAAAAAAAAACzE5NC4yNDIuMi4yAA9kb2gubXVsbHZhZC5uZXQKL2Rucy1xdWVyeQ'
          
          [static.'doh.ffmuc.net-185.150.99.255']
          stamp = 'sdns://AgcAAAAAAAAADjE4NS4xNTAuOTkuMjU1AA1kb2guZmZtdWMubmV0Ci9kbnMtcXVlcnk'
          
          [static.'doh.ffmuc.net-5.1.66.255']
          stamp = 'sdns://AgcAAAAAAAAACjUuMS42Ni4yNTUADWRvaC5mZm11Yy5uZXQKL2Rucy1xdWVyeQ'
           
          [static.'dns.digitale-gesellschaft.ch-185.95.218.42']
          stamp = 'sdns://AgcAAAAAAAAADTE4NS45NS4yMTguNDIAHGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gKL2Rucy1xdWVyeQ'
          
          [static.'dns.digitale-gesellschaft.ch-185.95.218.43']
          stamp = 'sdns://AgcAAAAAAAAADTE4NS45NS4yMTguNDMAHGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gKL2Rucy1xdWVyeQ'
          
          [static.'anycast.uncensoreddns.org-91.239.100.100']
          stamp = 'sdns://AgcAAAAAAAAADjkxLjIzOS4xMDAuMTAwABlhbnljYXN0LnVuY2Vuc29yZWRkbnMub3JnCi9kbnMtcXVlcnk'
          
      notify:
      - Restart dnscrypt-proxy

    - name: 'enable and start dnscrypt-proxy'
      command: systemctl enable dnscrypt-proxy --now
      args:
        creates: /etc/systemd/system/multi-user.target.wants/dnscrypt-proxy.service

    - name: /usr/local/sbin/autoupdate.d/dnscrypt-proxy-blocklist.update
      blockinfile:
        path: /usr/local/sbin/autoupdate.d/dnscrypt-proxy-blocklist.update
        mode: "0400"
        owner: root
        group: root
        create: yes
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          cd /etc/dnscrypt-proxy
          
          # get hosts blocklist from https://github.com/StevenBlack/hosts
          g_runcmd wget https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling/hosts -O - | grep "^0\.0\.0\.0 " | cut -d" " -f2 | grep "\." >${g_tmp}/blocked-names.txt
          numhosts=$(cat ${g_tmp}/blocked-names.txt | wc -l)
          if [ "$numhosts" -gt 200000 ]
          then
            cat ${g_tmp}/blocked-names.txt >blocked-names.txt
          else
            g_echo_error "Not enough lines in hosts blocklist from https://github.com/StevenBlack/hosts"
          fi
          
          [ -s blocked-names-local-additions.txt ] && cat blocked-names-local-additions.txt >>blocked-names.txt
          systemctl restart dnscrypt-proxy
          
          # Check for using DoHoT
          if [ -s /etc/dontusedohot ]
          then
            if [ -e /etc/systemd/resolved.conf.d/DoHoT.conf ] 
            then
              sudo rm -f /etc/systemd/resolved.conf.d/DoHoT.conf 
              sudo systemctl restart systemd-resolved.service
            fi
          else
            if [ -s /etc/dnscrypt-proxy/blocked-names.txt ]
            then
              echo "[Resolve]
          DNS=127.0.2.1
          Domains=~." | sudo tee /etc/systemd/resolved.conf.d/DoHoT.conf
              sudo systemctl restart systemd-resolved.service
            fi
          fi
         
          cd -
        backup: yes
        validate: /bin/bash -n %s



  handlers:

    - name: Restart tornet0
      ansible.builtin.shell: ifup tornet0

    - name: Restart tor
      service:
        name: tor
        state: restarted

    - name: Restart privoxy
      service:
        name: privoxy
        state: restarted

    - name: Restart ufw
      service:
        name: ufw
        state: restarted

    - name: Restart dnsmasq-tornet0
      service:
        name: dnsmasq-tornet0
        state: restarted

    - name: Restart dnscrypt-proxy
      service:
        name: dnscrypt-proxy
        state: restarted