#!/bin/sh
# PROJECT: Jayanta
# UPDATES: 2026-04-11 17:15:02 JST
# LICENSE: The Unlicense (unlicense.org)
PATH='/usr/sbin:/usr/bin:/sbin:/bin'; TOR="${1:-tor}"; RAW="${2:-privoxy}"
[ "$(id -u)" -eq 0 ] || exit 1; type nft tor privoxy conntrack || exit 2
( id "$TOR" && id "$RAW" ) || { echo 'sudo sh jayanta [debian-]tor[anon] privoxy'; exit 3; }
sysctl -w net.ipv6.conf.all.disable_ipv6=1 -w net.ipv6.conf.default.disable_ipv6=1 || exit 4
nft add table ip nat; nft add table ip filter; nft flush table ip nat; nft flush table ip filter
nft add chain ip nat output '{ type nat hook output priority dstnat; policy accept; }'
for c in input output forward; do nft add chain ip filter $c "{ type filter hook $c priority filter; policy drop; }"; done; conntrack -F
nft add set ip nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'
nft add rule ip nat output udp dport 53 counter redirect to 9053
nft add rule ip nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040
nft add rule ip nat output skuid != "{ $TOR, $RAW }" oifname != "lo" ip daddr != @reserved tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040
nft add rule ip filter input ct state established accept
nft add rule ip filter input iifname "lo" accept
nft add rule ip filter output ct state vmap '{ invalid : drop, established : accept }'
nft add rule ip filter output ct state new counter meta l4proto . th dport vmap '{ udp . 9053 : accept, tcp . 9040 : accept, tcp . 9050 : accept }'
nft add rule ip filter output tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "{ $TOR, $RAW }" ct state new counter accept
nft add rule ip filter output ip daddr 127.0.0.1 oifname "lo" counter accept; nft list ruleset
{
echo "SafeSocks 1"
echo "ReachableAddresses *:443"
echo "User $TOR"
echo "DataDirectory /var/lib/tor"
echo "DNSPort 9053"
echo "AutomapHostsOnResolve 1"
echo "AutomapHostsSuffixes .onion"
echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
echo "TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
echo "SocksPort 9050 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
} > /etc/tor/torrc; cat /etc/tor/torrc; { sv restart tor || service tor restart || systemctl restart tor || rc-service tor restart; } >/dev/null 2>&1