#!/bin/sh
# PROJECT: Jayanta v3
# UPDATES: 2026-04-30 15:23:55 JST
# LICENSE: The Unlicense (unlicense.org)
PATH='/usr/sbin:/usr/bin:/sbin:/bin'; TOR="${1:-tor}"; RAW="${2:-privoxy}"
[ "$(id -u)" -eq 0 ] || exit 1; type nft tor privoxy conntrack || exit 2
( id "$TOR" && id "$RAW" ) || { echo 'sudo sh jayanta [debian-]tor[anon] privoxy'; exit 3; }
sysctl net.ipv4.ip_forward=0 net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 || exit 4
nft add table ip nat; nft add table ip filter; nft flush table ip nat; nft flush table ip filter
nft add chain ip nat output '{ type nat hook output priority dstnat; policy accept; }'
for c in input output forward; do nft add chain ip filter $c "{ type filter hook $c priority filter; policy drop; }"; done; conntrack -F expect; conntrack -F
nft add set ip nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'
nft add rule ip nat output udp dport 53 redirect to 9053
nft add rule ip nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040
nft add rule ip nat output skuid != "{ $TOR, $RAW }" oifname != "lo" ip daddr != @reserved tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040
nft add rule ip filter input ct state established accept
nft add rule ip filter input iifname "lo" accept
nft add rule ip filter output ct state vmap '{ invalid : drop, established : accept }'
nft add rule ip filter output ct state new ip daddr 127.0.0.1 meta l4proto . th dport vmap '{ udp . 9053 : accept, tcp . 9040 : accept, tcp . 9050 : accept }'
nft add rule ip filter output ct state new tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "{ $TOR, $RAW }" accept
nft add rule ip filter output oifname "lo" ip daddr 127.0.0.1 accept; nft list ruleset
{
echo "SafeSocks 1"
echo "ReachableAddresses *:443"
echo "User $TOR"
echo "DataDirectory /var/lib/tor"
echo "DNSPort 9053"
echo "AutomapHostsOnResolve 1"
echo "AutomapHostsSuffixes .onion"
echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
echo "TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
echo "SocksPort 9050 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
} > /etc/tor/torrc; cat /etc/tor/torrc; { sv restart tor || service tor restart || systemctl restart tor || rc-service tor restart; } >/dev/null 2>&1