onyks-os/transparenttorproxyA Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and easy toggling of global proxy settings for privacy tasks.
Features • Requirements • Installation • Usage • How It Works • Verification • Contribute
No per-application setup needed - just sudo ttp start and every connection goes through Tor.
[!CAUTION] TTP is a tool designed to aid privacy by routing traffic through Tor. However, no tool can guarantee 100% anonymity. Your safety also depends on your behavior (e.g., using a regular browser vs. Tor Browser, signing into accounts, etc.). Always use TTP as part of a multi-layered security strategy.
[!WARNING] If you are a whistleblower or are engaging in high-risk activities, DO NOT use TTP. Instead, use officially audited and reliable tools like TailsOS or the Tor Browser directly. The authors and contributors of TTP assume no responsibility for your safety or the consequences of using this software.
Legacy transparent proxy scripts (TorGhost, Anonsurf) overwrite configuration files and build iptables rulesets that fail open: when they break, traffic leaves in cleartext. TTP is built the other way round - it fails closed, and keeps nothing on disk.
| Fail-closed by construction | An isolated inet ttp nftables table with a catch-all reject and policy drop on forwarding. On a crash, a watchdog trigger or an unclean exit, traffic is either routed through Tor or blocked - never released. |
| Nothing persists | Session state, torrc, lock file and logs live only in tmpfs (/run/ttp/, /run/tor/ttp/). A reboot leaves no residue and no stale lock - and no session either: see Known Behavior & Limitations. |
| No per-application setup | TCP and DNS are intercepted at the network layer. No SOCKS5 settings, no proxy environment variables, no application support required. |
| DNS without rewriting your system | A mount --bind overlay on /etc/resolv.conf rather than an edit, plus a volatile drop-in that neutralises systemd-resolved, backed by a kernel-level drop on any non-loopback resolver traffic. |
| The leak claim is measured | Every containment rule is tested in an isolated network namespace against the real generated ruleset, and each test first proves it can see a leak before asserting there is none. See Verification. |
--watchdog) - a watchdog governed by a
formal FSM (transitions) compares the live inet ttp table, rule for rule,
with the one the session applied, and watches Tor and the DNS overlay. It is
woken by nftables and inotify events rather than polling, so a flushed or
altered table reaches the killswitch in tens of milliseconds (31-48 ms
measured). A failed Tor is restarted once; a changed table or DNS overlay is
treated as tampering. Either way, if the session is not intact the watchdog
applies an emergency killswitch and holds it until ttp stop, re-applying it
if something removes or alters it.--bypass-user,
--bypass-group) with native nftables UID/GID matching, or run a single
command outside Tor with ttp bypass <cmd> via a cgroups v2 slice.ttp-tor.service
on non-standard ports, leaving an existing Tor instance untouched.Choose the method that best fits your needs. Native packages are strongly recommended for system stability, security, and clean uninstallation.
Installing via native packages ensures that all system dependencies (tor, nftables) and kernel-level optimizations (SELinux) are managed by your OS package manager.
Download the .deb or .rpm for the version you want from the latest release - the packages are release assets and are not checked into the repository - then install it:
sudo apt install ./transparent-tor-proxy_0.4.11_all.debsudo dnf install ./transparent-tor-proxy-0.4.11-1.fc44.noarch.rpmcd packaging && makepkg -siFor instructions on how to verify the integrity and authenticity of the release assets, see the Release Verification Guide.
If you are a developer or want to install from the repository:
git clone https://github.com/onyks-os/TransparentTorProxy.git
cd TransparentTorProxy
sudo ./scripts/install.sh