#!/bin/sh

# PROJECT: Jayanta
# UPDATES: 2026-02-08 11:37:35 JST
# WARNING: 無保証 / 自己責任 / 悪用厳禁
# LICENSE: The Unlicense (unlicense.org)

PATH='/usr/sbin:/usr/bin'; TOR="${1:-tor}"
[ "$(id -u)" -eq 0 ] || exit 1; type nft tor || exit 2
id "$TOR" || { echo 'sudo sh jayanta [debian-]tor[anon]'; exit 3; }
sysctl -w net.ipv6.conf.all.disable_ipv6=1 -w net.ipv6.conf.default.disable_ipv6=1 || { echo 'ERROR: SYSCTL'; exit 4; }

nft add table ip nat; nft add table ip filter; nft flush table ip nat; nft flush table ip filter
nft add chain ip nat output '{ type nat hook output priority dstnat; policy accept; }'
nft add chain ip filter input '{ type filter hook input priority filter; policy drop; }'
nft add chain ip filter output '{ type filter hook output priority filter; policy drop; }'
nft add chain ip filter forward '{ type filter hook forward priority filter; policy drop; }'
nft add set ip nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'

nft add rule ip nat output udp dport 53 counter redirect to 9053
nft add rule ip nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040
nft add rule ip nat output skuid "$TOR" counter return
nft add rule ip nat output oifname "lo" counter return
nft add rule ip nat output ip daddr @reserved counter return
nft add rule ip nat output tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040

nft add rule ip filter input ct state established accept
nft add rule ip filter input iifname "lo" accept
nft add rule ip filter output ct state invalid drop
nft add rule ip filter output ct state established accept
nft add rule ip filter output ip daddr 127.0.0.1 udp dport 9053 ct state new counter accept
nft add rule ip filter output ip daddr 127.0.0.1 tcp dport 9040 tcp flags syn / fin,syn,rst,ack ct state new counter accept
nft add rule ip filter output ip daddr 127.0.0.1 tcp dport 9050 tcp flags syn / fin,syn,rst,ack ct state new counter accept
nft add rule ip filter output tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "$TOR" ct state new counter accept
nft add rule ip filter output ip daddr 127.0.0.1 oifname "lo" counter accept; nft list ruleset

{
  echo "NewCircuitPeriod 30"
  echo "MaxCircuitDirtiness 30"
  echo "ReachableAddresses *:443"
  echo "User $TOR"
  echo "DataDirectory /var/lib/tor"
  echo "DNSPort 9053"
  echo "TransPort 9040"
  echo "SocksPort 9050"
  echo "AutomapHostsOnResolve 1"
  echo "AutomapHostsSuffixes .onion"
  echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
} > /etc/tor/torrc; cat /etc/tor/torrc; sv restart tor || service tor restart || rc-service tor restart
Edit

Pub: 23 Dec 2025 06:15 UTC

Edit: 08 Feb 2026 03:41 UTC

Views: 1437

Auto Theme: Dark