// docs

Network and Tor

RedderOS follows one rule: Tor or nothing. All TCP goes out through Tor, DNS is resolved through Tor and anything else is dropped. If Tor has not started or cannot connect, there is no network: the system fails closed, never open.

What happens to each type of traffic

Traffic	What the firewall does
TCP from any program	Redirected to Tor's TransPort (`127.0.0.1:9040`).
DNS (UDP 53, to any server)	Redirected to Tor's DNSPort (`127.0.0.1:5353`).
Other UDP	Dropped and recorded in the kernel log as `redderos-leak-blocked`.
ICMP (`ping`)	Dropped.
IPv6	Disabled in the kernel (`ipv6.disable=1`) and dropped by the firewall.
Incoming traffic	Dropped, except replies to our own connections and DHCP.
Forwarding between interfaces	Dropped.

Only the debian-tor user, which Tor runs as, can open new connections to the internet. The one exception is DHCP, to obtain an IP address.

Because the redirection is transparent, programs do not need any proxy configuration. The firewall lives in /etc/nftables.conf and is loaded before any application.

Tor

Tor listens only on 127.0.0.1:

Port	Use
`9050`	SocksPort for programs that speak SOCKS (Tor Browser, `torsocks`).
`9040`	TransPort: receives the TCP redirected by the firewall.
`5353`	DNSPort: resolves names through Tor.

Other settings in /etc/tor/torrc:

Circuit isolation: through the SocksPort, each destination (address and port) uses a different circuit.
.onion addresses: resolved to internal virtual addresses, so they also work with programs that do not speak SOCKS.
No IPv6 towards the Tor network, and disk writes kept to a minimum.
Logs only in the journal, which lives in RAM.

Tor Browser

The desktop shortcut uses torbrowser-launcher. The first time, it downloads Tor Browser (over Tor) and verifies its signature; the download takes a while and, in an amnesic session, is repeated on every boot. In a profile it stays saved.

Tor Browser is configured to use the system Tor instead of launching its own: that way Tor does not run inside Tor, and the browser's network settings are hidden.

Identity on the local network

Random MAC address on every boot, for every interface.
Generic hostname redderos, the same on every computer, and an empty machine-id.
Fingerprint-free DHCP: it does not send the hostname or stable identifiers, and it ignores the DNS, NTP, hostname and domains offered by the router.
No LLMNR, mDNS or IPv6 link-local addresses.

Check the MAC address with redder-status.

Censored networks: bridges

If the network blocks Tor, you can use bridges. Boot with Temporary administrator, edit /etc/tor/torrc and uncomment the lines provided, adding your bridges:

text

UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
Bridge obfs4 <dirección>:<puerto> <huella> cert=… iat-mode=0

Then restart Tor:

sudo systemctl restart tor

obfs4proxy comes preinstalled. Since everything lives in RAM, the change to torrc is lost at shutdown: you have to repeat it on every boot.

The time

The system does not use NTP (it would be traffic outside Tor). Tor needs a reasonably accurate time to connect: if the computer's clock is far off, correct it in the BIOS/UEFI.