DNSCrypt + Tor Transparent Proxy (resolver-proxy) #2691
-
|
Setting up a Tor Transparent Proxy is a relatively straightforward way to route all internet traffic through the Tor network However, this setup has some vulnerabilities, particularly with regards to DNS. One issue is that the DNSPort cannot achieve stream isolation due to its limitations. This means that DNS servers remain the same across different circuits. I've done several tests to confirm this. To overcome this, DNS requests need to be routed through the Tor socks proxy. Using solely DNSCrypt would also be an issue, since you would effectively exit the crowd. I've attempted to combine DNSCrypt with other options to solve this issue, but so far, I couldn't prevent DNSCrypt from resolving DNS requests before redirecting them. DNSCrypt has the proxy = 'socks5://127.0.0.1:9050' option, which runs as an alternative to DNSCrypt Anon Relays, and more specifically for DoH setups, so it comes with socks compatibility. To use a proper (and safe) Tor Transproxy, it would be incredibly helpful to introduce a resolver-proxy = 'socks5://127.0.0.1:9050' option, which would route queries through the Tor proxy after passing through its protocol servers. Query -> Anonymized Relay -> DNS Server -> Tor Proxy Knowing how DNSCrypt uses UDP and TCP, it could be better to introduce a resolver-force-tcp option, as well. This would drop UDP traffic only before reaching the proxy. Note: I'm fully aware that blocklists will no longer work like this, but I still believe it's an important feature to add. |
Beta Was this translation helpful? Give feedback.
Replies: 6 comments 13 replies
-
|
The expression "Proxy DNS when using SOCKS v5" is misleading, although it is from Firefox - upstream of Tor browser. While the anonymity in dnscrypt-proxy is for the DNS providers. We achieve unidentified by the same provider to avoid being tracked and analyzed. |
Beta Was this translation helpful? Give feedback.
-
|
In a Tor Transparent Proxy setup, removing the browser and letting DNSCrypt do the hostname lookup itself allows the user to hide in the Tor network. Any functionality provided by the Tor Browser can be replicated using the Tor implementation if needed. Nevertheless, my suggestion here is the final step in creating a safe Tor Transparent Proxy for my requirements, which should properly isolate the DNS servers between destinations. DNSCrypt should provide anonymity not just for DNS providers, but also in this scenario. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, @jedisct1! As a frequent contributor to this repository, could you share how viable my suggestion is? I'm open to any question you might have about it. |
Beta Was this translation helpful? Give feedback.
-
|
I don't understand what problem you are trying to solve. |
Beta Was this translation helpful? Give feedback.
-
|
When using a Tor Transparent Proxy, all internet traffic is routed through the Tor network, which helps to anonymize our activities. However, there's a weakness in how DNS requests are handled. The DNSPort in Tor can't achieve "stream isolation", meaning that all DNS requests go to the same DNS servers, no matter which Tor circuit we’re using. This could potentially allow our activities to be tracked across different destinations using those servers. To address this issue, I'd like DNSCrypt to handle forwarding the queries to Tor's SocksPort. This would allow Tor to provide stream isolation using the "IsolateSocksAuth" flag, adding an extra layer of protection. This is how it would look like for the DNSCrypt protocol: Is there anything else you'd like me to explain? |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the detailed write-up, but there seems to be some misunderstanding regarding how DNS and Tor interact in the setup you're describing. As pointed out by @lifenjoiner , the concept of "Proxy DNS when using SOCKS v5" is often misunderstood. This option doesn’t mean that DNS requests are routed through Tor in the way you're imagining. Instead, it allows the proxy to resolve the domain name directly—meaning that no DNS query is performed by the client itself. The Tor exit node handles both the DNS query and the subsequent connection to the target IP, which mitigates the risk of DNS leaks within the Tor network. Tor’s focus is on hiding the origin of the traffic and mimicking standard network behavior to maintain anonymity. As a result, DNS leaks are inherently minimized by its design. Introducing DNSCrypt into this setup, while useful for DNS provider anonymity, may not provide the kind of stream isolation you are aiming for in this context. DNSCrypt anonymizes queries relative to the DNS provider, but its primary use case is outside of the Tor network, where it helps obscure your activity from centralized DNS services. It seems like you're trying to apply two distinct privacy mechanisms—Tor and DNSCrypt—in ways that don't necessarily align with each other's intended goals. Tor already protects against the kind of DNS leakage you're worried about by handling DNS resolution at the exit node, making DNSCrypt unnecessary in this case. I hope this clarifies the confusion and helps realign the setup to better meet your privacy goals. If you’re still concerned about DNS leakage, reviewing Tor’s configuration options (e.g., IsolateSocksAuth) might provide more clarity on how Tor manages stream isolation for DNS and overall traffic. |
Beta Was this translation helpful? Give feedback.
-
|
You're describing a functionality that a Tor Transparent Proxy doesn't inherently have, since it relies on resolving DNS using the DNSPort, of which weakness I outlined in my previous posts. This is not Tor Browser we're talking about, so it doesn't rely on the SocksPort, by design. Regarding the idea that different methods can have conflicting goals, I've given this a lot of thought before starting this discussion. While there's some truth to it, I believe there's also a bit of a misconception. For instance, DNSCrypt is designed to encrypt DNS requests, whereas Tor resolves them, albeit not always correctly. However, this also means that DNSCrypt could potentially be used to anonymize DNS activity within the Tor network by forwarding to the SocksPort, effectively replacing the flawed DNSPort mechanism. @Gedsh, the creator of the InviZible Android app could provide some insight into this, since he created his app around a DNSCrypt+Tor setup. If not, I'd at least like to warn him about this, as the app is widely used by a large community of users and is affected by the same problem. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your follow-up, but there still seems to be a fundamental misunderstanding about how a Tor Transparent Proxy and DNS resolution work together. When you set up a Tor Transparent Proxy, all traffic, including DNS, is routed through the Tor network. Unlike the Tor Browser, which uses the SocksPort directly to handle DNS and connection requests, the Transparent Proxy setup uses the DNSPort to resolve DNS requests. However, this does not introduce the kind of vulnerability you're concerned about. The key point is that in a Transparent Proxy, DNS leaks are already mitigated by Tor's design because DNS queries go through the exit node. While you’re correct that the DNSPort doesn’t offer "stream isolation" by default, the real-world risk this poses is low, as the DNS queries are still anonymized by Tor itself. You’re essentially trying to fix a problem that doesn’t exist in this context. Tor has been designed to handle these concerns without needing additional layers like DNSCrypt. As for using DNSCrypt to forward to the SocksPort in a Transparent Proxy, that setup introduces unnecessary complexity and potential points of failure without adding any tangible security benefit. DNSCrypt is great for encrypting DNS queries in non-Tor environments, where DNS servers might track or profile users, but once traffic is inside the Tor network, DNS resolution happens at the exit node, removing the need for DNSCrypt entirely. Regarding the InviZible app, while it does combine DNSCrypt and Tor, it’s worth noting that it’s focused on a mobile environment, where different network behaviors and constraints might apply. However, that use case doesn’t necessarily translate to a standard Tor Transparent Proxy setup, and Gedsh’s solution is tailored for a different context. In a typical Transparent Proxy, the standard Tor approach is robust enough to protect against DNS leaks. I’d recommend reviewing Tor’s documentation on DNS handling in Transparent Proxy setups to clarify how it already addresses DNS leak concerns. There’s no need to reinvent the wheel or stack tools that serve different purposes when Tor is already designed to handle DNS resolution safely within its network. |
Beta Was this translation helpful? Give feedback.
-
This is cited from my response in #2685. It doesn't even account for how many exit nodes are run on Google servers or how many cloudflared websites the user goes to We're facing sophisticated algorithms that can easily correlate traffic patterns to de-anonymize users. Thus is the world we currently live in, so we can't allow for any vulnerability. The DNSPort is fundamentally flawed in this context because it lacks knowledge of the destinations. Unlike the SocksPort, which has a clear understanding of the traffic it's handling, the DNSPort blindly uses the same dns server across multiple circuits. By implying DNS leaks, I'm not referring to the regular "it leaked my real ISP server" context. Whereas Tor Browser (SocksPort) correctly isolates DNS on a per-destination level, thus having different servers on Destination A compared to Destination B, the DNSPort can't do that, by design.
It is comprised of the same functionality used on a desktop setup. While some behaviors might be different, it still uses the DNSPort. In any regard, I'm eagerly waiting to hear the creator's response to this. He contributed to this repository at some point too. I strongly encourage everyone reading this to take any Tor Transparent Proxy which uses the DNSPort and go through the following steps:
If someone can completely mitigate this, I will promptly close this discussion. Otherwise, I'll keep it a bit longer. After all, I could not find any setup that solves this, yet the DNSPort is still unknowingly used by a large community. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your detailed response. I understand your concerns about sophisticated traffic analysis and the use of cloud services like Google and Cloudflare to de-anonymize users. However, I believe there’s still some misunderstanding about how the DNSPort and SocksPort function in a Tor Transparent Proxy.
In a Tor Transparent Proxy setup, all DNS queries are routed through Tor, meaning the queries are resolved by the exit node. Even if the same DNS servers appear across different circuits, they don’t reveal your IP or directly correlate your traffic across destinations. The Tor network itself anonymizes the traffic before it ever reaches the DNS resolver.
Even if DNS queries hit the same server, the traffic patterns themselves are obfuscated by Tor. More importantly, running multiple circuits through the same DNS server does not reveal identifying information as long as the exit node is the one performing the resolution, since the DNS query itself is not tied back to the user.
While it's understandable that seeing the same DNS server across different tests could raise concerns, it's important to distinguish between exit node behavior and DNS server isolation. Tor's security model is designed to protect users from de-anonymization by ensuring that DNS resolution happens at the exit node, not before.
Conclusion The DNSPort doesn’t isolate DNS streams, but this doesn’t expose you to DNS leaks as long as traffic is anonymized by Tor. Thanks again for raising these concerns—discussions like this are crucial for continuing to improve the privacy and security of Tor and its users. |
Beta Was this translation helpful? Give feedback.
-
|
I appreciate your willingness to take part in this discussion. While not solving the repeated DNS servers across circuits per se, I still believe it's an adequate answer. However, this strongly implies that Tor Transparent Proxies are generally unsafe in this regard. It would be great to promote this discussion from now on, since the community at large is still unaware of such findings. |
Beta Was this translation helpful? Give feedback.
-
@jedisct1 is absolutely right. Android uses a centralised approach for handling DNS https://source.android.com/docs/core/ota/modular-system/dns-resolver So there is no way to separate DNS traffic from different apps. All DNS queries on android have uid0 or uid1051 depending on the android version. In this case, there is no way to use IsolateSocksAuth properly system-wide. You should only use the Tor browser if your threat model is sensitive to the lack of DNS stream isolation. |
Beta Was this translation helpful? Give feedback.
-
|
I generally share your views on the Tor Browser; however, it does have its problems. Unless you conduct regular audits yourself, especially due to its automatic updates, it's like you're using a black box. Regardless, it's important to warn your community, preferably through your app, about the limitations of the DNSPort. Encourage them to use the SocksPort settings on a per-app basis, where applicable. Additionally, do you know why the default settings of Orbot completely separate DNS traffic? Is it using the SocksPort for DNS requests? |
Beta Was this translation helpful? Give feedback.
-
In the case of android, this is primarily a system limitation, not a Tor issue. Android is not designed to handle such sensitive threat models. You need a more controlled environment specifically designed for this purpose, such as Tails or Whonix.
Orbot does not have stream separation for different apps at all. guardianproject/orbot#71 Make sure your tests are correct. |
Beta Was this translation helpful? Give feedback.
-
|
Whonix and Tails might be using some wrapper logic to do it, while I'm actively looking for a DIY nftables solution. Tails, for one, uses different socks ports for each app, if I remember right. In any case, I doubt they use the DNSPort.
Yes, it seems the servers repeat as well when using Orbot. I haven't carefully checked the first time, I presume. |
Beta Was this translation helpful? Give feedback.
-
|
No FUD. Proof please! Eating noodles with a fork is terrible, but that doesn't mean the fork or the noodles are terrible. |
Beta Was this translation helpful? Give feedback.
-
|
USING TOR AS A TRANSPARENT PROXY IS HIGHLY DISCOURAGED! |
Beta Was this translation helpful? Give feedback.
-
|
Your reasoning is nothing but a crude appeal to consequences fallacy and I discourage anyone to encourage this behavior. Moreover, your position is self-contradictory, as you aknowledge that "Things may change after years", yet you're promoting an incredibly outdated article. Not only that, but albeit me using the term "Transparent Proxy", this feature would have endorsed the principle of "Isolating Proxy", a less known term in the Tor landscape, which conveys a safer configuration. Additionally, the author's warning against attempting this configuration without proper knowledge is clear: "DO NOT ATTEMPT IT UNLESS YOU KNOW WHAT YOU ARE DOING". Cherry-picking the article and presenting it as an endorsement of unsafe behavior is a misinterpretation of the author's intent, and also a blatant attempt at contextomy. A bit of critical thinking reveals that, despite the author's caution against "Transparent Proxies", likely to prevent ignorant users from trying without adequate knowledge, they nonetheless provide examples of configurations. I could go nitpicking it on and on and provide my share of articles, but they wouldn't provide any practicality to the matter at hand. What started as a "feature request" has evolved into a simple conversation on the matter, with people who possess greater knowledge than me when it comes down to handling DNS. |
Beta Was this translation helpful? Give feedback.
-
|
OK, let's be frankly.
+
-->
I doubt you know exactly what you are doing! That's why I emphasize the danger. I'm not just answering your questions, I'm also showing the most important things for most people. Also, I've provided the sources. Just read the details. Anyway, I've said all I have to say. |
Beta Was this translation helpful? Give feedback.
Thank you for your detailed response. I understand your concerns about sophisticated traffic analysis and the use of cloud services like Google and Cloudflare to de-anonymize users. However, I believe there’s still some misunderstanding about how the DNSPort and SocksPort function in a Tor Transparent Proxy.
The primary issue you’ve raised is that the DNSPort doesn’t perform stream isolation like the SocksPort, and therefore might leak information across multiple circuits. While it’s true that the DNSPort doesn’t inherently isolate streams on a per-destination level, this does not lead to DNS leaks in the conventional sense.
In a Tor Transparent Proxy setup,…