Tune tor

Author: alopatindev

alpine/alpine-root/etc/coredns/Corefile

@@ -1,3 +1,20 @@
+onion {
+  loop
+
+  bind 127.0.0.1 ::1
+
+  #log
+  #errors
+
+  forward onion dns://127.0.0.1:9053 {
+    prefer_udp
+    policy sequential
+    health_check 1s
+    failfast_all_unhealthy_upstreams
+    failover SERVFAIL REFUSED
+  }
+}
+
 . {
   loop
 
@@ -9,18 +26,29 @@
   cache {
     prefetch 4096 20s
     serve_stale 48h
+    servfail 1s
   }
 
+  # disable ipv6
+  #template IN AAAA {
+  #  rcode NOERROR
+  #}
+
   forward . dns://127.0.0.1:5350 {
     force_tcp
     policy sequential
-    health_check 10s
+    health_check 1s
     failfast_all_unhealthy_upstreams
+    failover SERVFAIL REFUSED
   }
 
+  # unbound
   #forward . dns://127.0.0.1:5353 {
   #  prefer_udp
   #  policy sequential
+  #  health_check 1s
+  #  failfast_all_unhealthy_upstreams
+  #  failover SERVFAIL REFUSED
   #}
 
   #forward . tls://9.9.9.11 {

alpine/alpine-root/etc/local.d/02-iptables.start

@@ -20,6 +20,11 @@
   done
 }
 
+[ -f /usr/bin/tor ] && {
+  iptables -t nat -A OUTPUT -p tcp -d $(grep VirtualAddrNetworkIPv4 /etc/tor/torrc | awk '{print $2}') -j REDIRECT --to-ports 9052
+  ip6tables -t nat -A OUTPUT -p tcp -d $(grep VirtualAddrNetworkIPv6 /etc/tor/torrc | awk '{print $2}' | sed 's!\[!!;s!\]!!') -j REDIRECT --to-ports 9052
+}
+
 # for ISPs that block traffic to standard DNS port
 for i in 9.9.9.9 149.112.112.112 9.9.9.11 149.112.112.11 9.9.9.10 149.112.112.10 ; do
   iptables -t nat -A OUTPUT -p tcp -d "$i" --dport 53 -j DNAT --to-destination "$i:9953"

alpine/alpine-root/etc/tor/torrc

@@ -12,12 +12,15 @@ Sandbox 1
 
 LongLivedPorts 21,22,53,80,706,1863,5050,5190,5222,5223,6523,6667,6697,8300
 
-SocksPort 127.0.0.1:9050 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth NoDNSRequest OnionTrafficOnly
-SocksPort 127.0.0.1:9051 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth NoDNSRequest
-TransPort 127.0.0.1:9052 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth
-TransPort [::1]:9052 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth
-DNSPort 127.0.0.1:9053 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth NoIPv4Traffic NoIPv6Traffic
+HTTPTunnelPort 127.0.0.1:8050 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth OnionTrafficOnly
+SocksPort 127.0.0.1:9050 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth OnionTrafficOnly
+
+HTTPTunnelPort 127.0.0.1:8051 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth
+SocksPort 127.0.0.1:9051 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth
 
+TransPort 127.0.0.1:9052 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth OnionTrafficOnly
+TransPort [::1]:9052 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth OnionTrafficOnly
+DNSPort 127.0.0.1:9053 IsolateClientAddr IsolateSOCKSAuth IsolateClientProtocol IsolateDestAddr KeepAliveIsolateSOCKSAuth NoIPv4Traffic NoIPv6Traffic
 VirtualAddrNetworkIPv4 127.192.0.0/16
 VirtualAddrNetworkIPv6 [FE80::]/16
 AutomapHostsOnResolve 1