# 悪用厳禁！

# RPI (Wi-Fi) <> Ethernet <> PC
# CGI (192.168.4.1:8080) => RPI (HTTP)
# TOR (192.168.4.1:9050) => WEB (SOCK)
# TOR (192.168.4.1:9090) => WEB (HTTP)
# RAW (192.168.4.1:8118) => WEB (HTTP)
# WARP(192.168.4.1:8888) => WEB (HTTP)
# DEFAULT(Tor透過プロキシ) => WEB (ALL)

# WARPでの注意！
# 真: O: ISP => WARP => WEB
# 偽: X: ISP => WARP => TOR  => WEB
# 偽: X: ISP => TOR  => WARP => WEB

# Raspberry Pi Imager v2
# APP OPTIONS: DISABLE-ALL
set SSH
set WIFI
set CITY
set HOSTNAME
set TIMEZONE
set KEYBOARD
set USERNAME
set PASSWORD
not RPI-CONNECT

# login ssh
sudo arp-scan --localnet
ssh [USERNAME]@[IP]

# static ip
sudo nmtui
delete eth0
enable eth0
  ip: 192.168.4.1/24
enable wlan0
  ip: [IP]
  dns: 127.0.0.1
  gateway: [IP_GATEWAY]
disable ipv6
[x] Automatically connect
[x] Available to all users

Tmp /etc/resolv.conf
  nameserver 1.1.1.1

Radio
  WWAN: Disabled (SIM)

If Change Name eth0, wlan0
  sudo rm /etc/netplan/*

# update os
sudo apt update
sudo apt upgrade

# install neovim
sudo apt install neovim

# ---

# Router

# install router
sudo apt install dnsmasq iptables iptables-persistent

# disable avahi-daemon
sudo systemctl disable avahi-daemon

# /etc/hosts.allow
sudo mv /etc/hosts.allow /etc/hosts.allow.orig
sshd:[HOST_IP]
sshd:[HOST_IP]
sshd:[HOST_IP]

# /etc/hosts.deny
sudo mv /etc/hosts.deny /etc/hosts.deny.orig
ALL:ALL

# /etc/ssh/sshd_config.d/99-allow-users.conf
AllowUsers [USERNAME]@[IP] [USERNAME]@[IP] [USERNAME]@[IP]

# service sshd
sudo systemctl restart sshd && sudo systemctl status sshd

# /etc/dnsmasq.conf
sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
interface=eth0
dhcp-range=192.168.4.10,192.168.4.50,255.255.255.0,24h
dhcp-option=3,192.168.4.1
dhcp-option=6,192.168.4.1

# service dnsmasq
sudo systemctl restart dnsmasq && sudo systemctl status dnsmasq

# iptables
sudo iptables -t nat -F
sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# save iptables
sudo netfilter-persistent save

# /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

# reload sysctl
sudo sysctl -p

# install syslog
sudo apt install rsyslog

# ---

# Onion Pie (Pi Eth)

# install tor
sudo apt install tor

# /etc/tor/torrc
sudo mv /etc/tor/torrc /etc/tor/torrc.orig
NewCircuitPeriod 30
MaxCircuitDirtiness 30

FascistFirewall 1
ReachableAddresses *:443

User debian-tor
DataDirectory /var/lib/tor

DNSPort 192.168.4.1:9053
TransPort 192.168.4.1:9040
SocksPort 192.168.4.1:9050
HTTPTunnelPort 192.168.4.1:9090

AutomapHostsOnResolve 1
AutomapHostsSuffixes .onion
VirtualAddrNetworkIPv4 10.192.0.0/10

# service tor
sudo systemctl restart tor && sudo systemctl status tor

# install fail2ban
sudo apt install fail2ban

# /etc/fail2ban/jail.d/defaults-pi.conf
[sshd]
enabled  = true
port     = 22
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
findtime = 600
bantime  = -1
backend  = systemd

# service fail2ban
sudo systemctl restart fail2ban && sudo systemctl status fail2ban

# status fail2ban
sudo fail2ban-client status sshd

# all unban fail2ban
sudo fail2ban-client unban --all

# CONNECT-ETH (RPI <> PC) ---

# RAW (privoxy)

# install privoxy
sudo apt install privoxy

# edit /etc/privoxy/config
listen-address  192.168.4.1:8118
#listen-address  [::1]:8118

# service privoxy
sudo systemctl restart privoxy && sudo systemctl status privoxy

# RAW (tinyproxy)

# install tinyproxy
sudo apt install tinyproxy

# add edit /etc/tinyproxy/tinyproxy.conf
Port 8888
LogLevel Critical
Listen 192.168.4.1
Allow 192.168.4.0/24

# service tinyproxy
sudo systemctl restart tinyproxy && sudo systemctl status tinyproxy

# WARP (tinyproxy)

# install warp
sudo mkdir -p /usr/share/keyrings
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
echo "deb [arch=arm64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list
sudo apt update && sudo apt install cloudflare-warp

# config warp
sudo warp-cli registration new
sudo warp-cli mode proxy
sudo warp-cli proxy port 1080
sudo warp-cli connect

# add /etc/tinyproxy/tinyproxy.conf
Upstream socks5 127.0.0.1:1080

# disable log
sudo systemctl edit warp-svc
[Service]
StandardOutput=null

# reload systemd
sudo systemctl daemon-reload

# service warp
sudo systemctl restart warp-svc tinyproxy && sudo systemctl status warp-svc tinyproxy

# ---

# Gateway Nginx Server (Tor Restart Server)

# install server
sudo apt install nginx fcgiwrap apache2-utils

# auth basic
sudo htpasswd -c /etc/nginx/.htpasswd admin

# config nginx
sudo nvim /etc/nginx/sites-available/default
server {
    listen 8080;
    root /var/www/html;
    index index.htm index.html;

    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;

    server_name 192.168.4.1;
    allow 192.168.4.0/24;
    deny all;

    location /config {
        include fastcgi_params;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
        fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/config.cgi;
    }

    location /restart {
        include fastcgi_params;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
        fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/restart.cgi;
    }

    location /shutdown {
        include fastcgi_params;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
        fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/shutdown.cgi;
    }
}

# mkdir cgi
sudo mkdir /usr/lib/cgi-bin/

# config cgi
sudo nvim /usr/lib/cgi-bin/config.cgi
#!/bin/sh
echo "Content-type: text/plain"
echo ""

echo "main"
sudo iptables -nvL; sudo iptables -t nat -nvL; sudo ip6tables -nvL; sudo tail /var/log/syslog

echo
echo "deny"
cat /etc/hosts.deny

echo
echo "allow"
cat /etc/hosts.allow

echo
echo "sshd"
cat /etc/ssh/sshd_config.d/99-allow-users.conf

echo
echo "sysctl"
cat /etc/sysctl.conf

echo
echo "resolv"
cat /etc/resolv.conf

echo
echo "dnsmasq"
cat /etc/dnsmasq.conf

echo
echo "rc"
cat /etc/rc.local

echo
echo "tor"
cat /etc/tor/torrc

echo
echo "nginx"
cat /etc/nginx/sites-available/default

echo
echo "fail2ban"
cat /etc/fail2ban/jail.d/defaults-pi.conf

echo
echo "privoxy"
cat /etc/privoxy/config | grep -e "^listen-address "

echo
echo "tinyproxy"
cat /etc/tinyproxy/tinyproxy.conf | grep -e "^Port " -e "^LogLevel " -e "^Listen " -e "^Allow " -e "^Upstream "

echo
echo "config"
cat /usr/lib/cgi-bin/config.cgi

echo
echo "restart"
cat /usr/lib/cgi-bin/restart.cgi

echo
echo "shutdown"
cat /usr/lib/cgi-bin/shutdown.cgi

# exec config cgi
sudo chmod 0755 /usr/lib/cgi-bin/config.cgi

# restart cgi
sudo nvim /usr/lib/cgi-bin/restart.cgi
#!/bin/sh
echo "Content-type: text/plain"
echo ""

sudo systemctl restart tor warp-svc privoxy tinyproxy
echo "Tor WARP Privoxy Tinyproxy restarted"

# exec restart cgi
sudo chmod 0755 /usr/lib/cgi-bin/restart.cgi

# shutdown cgi
sudo nvim /usr/lib/cgi-bin/shutdown.cgi
#!/bin/sh
echo "Content-type: text/plain"
echo ""

sudo shutdown -h now
echo "See ya."

# exec shutdown cgi
sudo chmod 0755 /usr/lib/cgi-bin/shutdown.cgi

# allow visudo
sudo visudo
www-data ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart tor warp-svc privoxy tinyproxy
www-data ALL=(ALL) NOPASSWD: /usr/bin/tail /var/log/syslog
www-data ALL=(ALL) NOPASSWD: /usr/sbin/iptables -nvL
www-data ALL=(ALL) NOPASSWD: /usr/sbin/iptables -t nat -nvL
www-data ALL=(ALL) NOPASSWD: /usr/sbin/ip6tables -nvL
www-data ALL=(ALL) NOPASSWD: /usr/sbin/shutdown -h now

# service server
sudo systemctl restart nginx fcgiwrap && sudo systemctl status nginx fcgiwrap

# iptables v5.6
TOR_UID='debian-tor'; RAW_UID='privoxy'
WARP_IP='162.158.0.0/15'; RESERVED_IP='255.255.255.255/32 240.0.0.0/4 233.252.0.0/24 224.0.0.0/4 203.0.113.0/24 198.51.100.0/24 198.18.0.0/15 192.168.0.0/16 192.88.99.0/24 192.0.2.0/24 192.0.0.0/24 172.16.0.0/12 169.254.0.0/16 127.0.0.0/8 100.64.0.0/10 10.0.0.0/8 0.0.0.0/8'

sudo ip6tables -F
sudo ip6tables -A INPUT -j DROP
sudo ip6tables -P INPUT DROP
sudo ip6tables -A FORWARD -j DROP
sudo ip6tables -P FORWARD DROP
sudo ip6tables -A OUTPUT -j DROP
sudo ip6tables -P OUTPUT DROP
sudo ip6tables -nvL

sudo iptables -t nat -F
sudo iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to-destination='192.168.4.1:9053'
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ! -d 192.168.4.1 -m multiport --dport 80,443 --syn -j DNAT --to-destination='192.168.4.1:9040'

sudo iptables -t nat -A OUTPUT -m string --hex-string '|2112a442|' --algo bm -j RETURN
sudo iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination='192.168.4.1:9053'
sudo iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -m multiport --dports 80,443 --syn -j DNAT --to-destination='192.168.4.1:9040'
sudo iptables -t nat -A OUTPUT -m owner --uid-owner "$TOR_UID" -j RETURN
sudo iptables -t nat -A OUTPUT -m owner --uid-owner "$RAW_UID" -j RETURN
sudo iptables -t nat -A OUTPUT -d "$WARP_IP" -j RETURN
sudo iptables -t nat -A OUTPUT -o lo -j RETURN
for reserved_ip in $(echo "$RESERVED_IP"); do
  sudo iptables -t nat -A OUTPUT -d "$reserved_ip" -j RETURN
done
sudo iptables -t nat -A OUTPUT -p tcp -m multiport --dports 80,443 --syn -j DNAT --to-destination='192.168.4.1:9040'
sudo iptables -t nat -nvL

sudo iptables -F
sudo iptables -A INPUT -p icmp -j DROP
sudo iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --sport 68 --dport 67 -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --dport 9053 -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 9040 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 9050 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 9090 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 8080 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 8118 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 8888 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i wlan0 -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -j LOG
sudo iptables -A INPUT -j DROP
sudo iptables -P INPUT DROP

sudo iptables -A FORWARD -j DROP
sudo iptables -P FORWARD DROP

sudo iptables -A OUTPUT -p icmp -j DROP
sudo iptables -A OUTPUT -m string --hex-string '|2112a442|' --algo bm -j DROP
sudo iptables -A OUTPUT -m state --state INVALID -j DROP
sudo iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p udp --sport 67 --dport 68 -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -p udp -d 192.168.4.1 --dport 9053 -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -p tcp -d 192.168.4.1 --dport 9040 --syn -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -p tcp -d 192.168.4.1 --dport 9050 --syn -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -p tcp -d 127.0.0.1   --dport 1080 --syn -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -o wlan0 -p tcp --dport 443 --syn -m owner --uid-owner "$TOR_UID" -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -o wlan0 -p tcp --dport 443 --syn -m owner --uid-owner "$RAW_UID" -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -o wlan0 -d "$WARP_IP" -m state --state NEW -j ACCEPT
sudo iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT
sudo iptables -A OUTPUT -j LOG
sudo iptables -A OUTPUT -j DROP
sudo iptables -P OUTPUT DROP
sudo iptables -nvL

# save iptables
sudo netfilter-persistent save

# service persistent
sudo systemctl restart netfilter-persistent && sudo systemctl status netfilter-persistent

# /etc/rc.local
#!/bin/sh
sleep 60; sudo systemctl restart tor warp-svc privoxy tinyproxy

# exec /etc/rc.local
sudo chmod 0755 /etc/rc.local

# sync && reboot
sudo sync && sudo reboot

# show rpi config, restart, shutdown
firefox http://192.168.4.1:8080/config
firefox http://192.168.4.1:8080/restart
firefox http://192.168.4.1:8080/shutdown

# Wi-FiのSSIDとPASSを以下に書き込み起動する
# (元々のSSIDとPASSはファイルごとバックアップしてね)
wpa_passphrase SSID PASS > wlan.txt
/rootfs/etc/netplan/
/rootfs/etc/NetworkManager/system-connections/

# torbrowser: about:config > restart
# proxy: network.proxy.socks_port: 9050
# proxy: network.proxy.socks: 192.168.4.1
# http3: network.http.http3.enable: false
# launcher: extensions.torlauncher.start_tor: false

# no exec raspi[-]config !
# raspi[-]config