Option to route OpenVPN over Tor #41

New issue

Open

opened 2026-08-18 18:04:34 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-18 18:04:34 -04:00

Owner

Salvaged from the deleted TODO.md.

What it means: OpenVPN connects through a locally running Tor daemon's SOCKS
proxy (socks-proxy 127.0.0.1 9050 in the generated config), so the VPN
provider sees a Tor exit node instead of the home IP, and the Tor network
never sees plaintext destination traffic.

Known constraints to design around:

OpenVPN through a SOCKS proxy is TCP-only, so only a provider's TCP configs
qualify -- the option has to filter or rewrite the server selection the same
way stealth modes already do.
Requires a running local Tor daemon (new optional dependency).
The killswitch firewall must allow Tor's own traffic outside the tunnel.

Closest in-repo precedent: the existing OpenVPN-over-SSL/SSH stealth handling
for AirVPN and Windscribe, which already wraps OpenVPN in a local proxy
process (stunnel) and punches the matching firewall hole.

The other two TODO.md lines were triaged away: more providers is the constant
background extension the provider-import code already serves, and Windows
support is not feasible for the current architecture (iptables, D-Bus,
cgroups).

Salvaged from the deleted TODO.md. What it means: OpenVPN connects through a locally running Tor daemon's SOCKS proxy (`socks-proxy 127.0.0.1 9050` in the generated config), so the VPN provider sees a Tor exit node instead of the home IP, and the Tor network never sees plaintext destination traffic. Known constraints to design around: - OpenVPN through a SOCKS proxy is TCP-only, so only a provider's TCP configs qualify -- the option has to filter or rewrite the server selection the same way stealth modes already do. - Requires a running local Tor daemon (new optional dependency). - The killswitch firewall must allow Tor's own traffic outside the tunnel. Closest in-repo precedent: the existing OpenVPN-over-SSL/SSH stealth handling for AirVPN and Windscribe, which already wraps OpenVPN in a local proxy process (stunnel) and punches the matching firewall hole. The other two TODO.md lines were triaged away: more providers is the constant background extension the provider-import code already serves, and Windows support is not feasible for the current architecture (iptables, D-Bus, cgroups).

mysticalsoap added the

label

2026-08-18 18:04:34 -04:00

mysticalsoap referenced this issue

2026-08-18 18:04:34 -04:00

Retire TODO.md and correct the README's inherited claims #43