Service improvements

files/tor-router

@@ -1,48 +1,78 @@
 #!/bin/bash
-# Executable file to create rules for transparent proxy
-# Destinations you do not want routed through Tor
-NON_TOR="192.168.1.0/24 192.168.0.0/24"
-# the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added.
-if command -v pacman > /dev/null; then
-  TOR_UID=$(id -u tor)
-elif command -v apt > /dev/null; then
-  TOR_UID=$(id -u debian-tor)
-elif command -v dnf > /dev/null; then
-  TOR_UID=$(id -u toranon)
-else
-  echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues"
-  exit
-fi
+
+RULES="/var/tmp/tor-router.save"
 
 # Tor's TransPort
 TRANS_PORT="9040"
 
-if ! command -v tor > /dev/null; then
-  echo "You need to install the tor package."
-  exit
-elif ! systemctl is-active tor.service > /dev/null; then
-  echo "The tor service is not active, please start the tor service before running the script."
-  exit
-elif ! command -v iptables > /dev/null; then
-  echo "You need to install the iptables package."
-  exit
-else
-  iptables -F
-  iptables -t nat -F
-  iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
-  iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353
+case "$1" in
+    start)
+	if test -f "$RULES"; then
+	    echo "$RULES exists. Either delete it, or stop tor-router first."
+	    exit
+	else
+	    iptables-save > $RULES
+	    # Executable file to create rules for transparent proxy
+	    # Destinations you do not want routed through Tor
+	    NON_TOR="192.168.1.0/24 192.168.0.0/24"
+	    # the UID Tor runs as, actually only support for Debian, ArchLinux and Fedora as been added.
+	    if command -v pacman > /dev/null; then
+		TOR_UID=$(id -u tor)
+	    elif command -v apt > /dev/null; then
+		TOR_UID=$(id -u debian-tor)
+	    elif command -v dnf > /dev/null; then
+		TOR_UID=$(id -u toranon)
+	    else
+		echo "Unknown distro, please create report the issue to https://github.com/edu4rdshl/tor-router/issues"
+		exit
+	    fi
+
+	    if ! command -v tor > /dev/null; then
+		echo "You need to install the tor package."
+		exit
+	    elif ! systemctl is-active tor.service > /dev/null; then
+		echo "The tor service is not active, please start the tor service before running the script."
+		exit
+	    elif ! command -v iptables > /dev/null; then
+		echo "You need to install the iptables package."
+		exit
+	    else
+		iptables -F
+		iptables -t nat -F
+		iptables -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN
+		iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 5353
 
-  for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do
-    iptables -t nat -A OUTPUT -d $NET -j RETURN
-  done
+		for NET in $NON_TOR 127.0.0.0/9 127.128.0.0/10; do
+		    iptables -t nat -A OUTPUT -d $NET -j RETURN
+		done
 
-  iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT
-  iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+		iptables -t nat -A OUTPUT -p tcp --syn -j REDIRECT --to-ports $TRANS_PORT
+		iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
-  for NET in $NON_TOR 127.0.0.0/8; do
-    iptables -A OUTPUT -d $NET -j ACCEPT
-  done
+		for NET in $NON_TOR 127.0.0.0/8; do
+		    iptables -A OUTPUT -d $NET -j ACCEPT
+		done
 
-  iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
-  iptables -A OUTPUT -j ACCEPT
-fi
+		iptables -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
+		iptables -A OUTPUT -j ACCEPT
+	    fi
+	fi
+	;;
+    stop)
+	if ! -f "$RULES"; then
+	    echo "$RULES does not exist. Not doing anything."
+	    exit
+	else
+	    iptables -t nat -F
+	    iptables-restore < $RULES
+	    rm $RULES
+	fi
+	;;
+    restart)
+	stop
+	sleep 2
+	start
+	;;
+    *)
+	echo "Usage: $0 {start|stop|restart}"
+esac

files/tor-router.service

@@ -4,9 +4,9 @@
 
 [Service]
  Type=simple
- ExecStart=/usr/bin/tor-router
+ ExecStart=/usr/bin/tor-router start
  RemainAfterExit=yes
- ExecStop=/usr/bin/iptables -F OUTPUT
+ ExecStop=/usr/bin/tor-router stop
  TimeoutStopSec=180
  KillMode=process
  KillSignal=SIGINT