onion

[tinc at eckner.net]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, 10 Oct 2022, Brooks Alex wrote:

> Hi. Tinc have proxy settings:
> Proxy = socks4 | socks5 | http | exec ... [experimental]
>             Use a proxy when making outgoing connections.  The following proxy types are currently supported:
>
>             socks5 address port [username password]
>                     Connect to the proxy using the SOCKS version 5 protocol.  If a username and password are given, basic user‐
>                     name/password authentication will be used, otherwise no authentication will be used.
>
> But when i try to pop connection via tor proxy i have problem:
> Error looking up *****.onion port ****:
> Could not set up a meta connection to zero
>
> As i understand tinc tries to resolve onion address by default dns server (not by tor proxy). Any idea? Client using win7.
>
> // Im sorry if message doubled.
> _______________________________________________
> tinc mailing list
> tinc at tinc-vpn.org
> https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
>

Hi,

I can't tell, whether tinc's dns resolver can be configured to use the 
socks tunnel itself. One solution without touching tinc is to run a dns 
server yourself, that forwards requests for .onion domains to tor. With 
bind, this would look something like:

zone "onion" IN {
     type forward;
     forward only;
     forwarders {
         127.0.0.1 port 9053;
     };
};

and in torrc, you would need something like:

DNSPort 127.0.0.1:9053

to actually serve dns requests on port 9053. Note, that I run this setup 
(but on linux), and note, that bind, tor and tinc can run on different 
machines or the same machine (adapt ip addresses accordingly, of course).

HTH,
Erich

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE3p92iMrPBP64GmxZCu7JB1Xae1oFAmNGRN8ACgkQCu7JB1Xa
e1pBkBAAriBScCFXzooDYoqOfPfOlKCY/ypmdrEsOzZ+GfIGqMr4tILK7zGmkFDU
f1RF3YsmwzGUYx3C5ltA0ilVRCzjmkVdP+3I811HxnL3rRmXvo0NiugCMo7lKLPN
MxNiH5y9d0EUoHpYhCMQ4ErbEQYD0r2vIPtE2gAyCFkN2QxT4GiZGz34ELrEjJ38
aO+uq2hDFu/Ki9gfGUWiUrzHQW5eHOshP9OwdIEq+PsLj3JykFBcpV73ecZtM/gy
zv8eqRFSuj2X5TZGB53tkqPXV83oKBxWV1UjM1XbL72EBeUGAmyJZPq/9frKPGVm
gEqZD3qNWRdKPtCZsz2DtEjl1UDIBoZ/ItNvfFD08zMt1VY3K2zCLCN1TW3tYg4Q
4JIFIivCs+ZByPGB63RchhNHoyt5RfDpqVkUiY5/swlBOEluxX8uUScuLQrYP13d
qP8WDvSo8yZK94PK95NRUp5/kewR6X8qOI1VA596LBdY9dGHBYLDs4gkKGqtwGWb
L4hRntVarj3uFoWn7Rel9cTvV7+TiRbJuGJdrE2cEz/N/o+NCTxg65MuKzuq3DNk
RddD078XU7WwOCmqzAP9OD/sAYAXmVr2+hJdc+MsCzT6OiXFoPy4qRcwnX9YfclG
halpiNF3TNn2gnJ6IbgUcgFbHyDyEWZ/mTfm2LOYHZDBKh30nFE=
=Jg6t
-----END PGP SIGNATURE-----