После запуска системы запускаем обновления. Затем отправляем весь трафик через Tor, запустив этот скрипт (оставляем только дырку для Waydroid, в который для торификации установите Invizible Pro и в настройках VPN включите блокировку трафика при отключении приложения):

#!/bin/bash

set -e

TOR_UID=108

# Step 1: Install Tor
echo "[*] Installing Tor..."
sudo apt update
sudo apt install -y tor

# Step 2: Configure Tor
echo "[*] Configuring Tor..."
sudo tee /etc/tor/torrc >/dev/null <<'EOF'
TransPort 127.0.0.1:9040
DNSPort 127.0.0.1:9053
AutomapHostsOnResolve 1
VirtualAddrNetworkIPv4 10.192.0.0/10
EOF

# Step 3: Restart and enable Tor
echo "[*] Restarting and enabling Tor service..."
sudo systemctl restart tor
sudo systemctl enable tor

# Step 4: Verify Tor is listening
echo "[*] Checking Tor listening ports..."
sudo ss -tulpn | grep tor

# Step 5: Configure nftables
echo "[*] Writing nftables configuration..."
sudo tee /etc/nftables.conf >/dev/null <<EOF
#!/usr/sbin/nft -f

flush ruleset

define uid = ${TOR_UID}

define waydroid_net = 192.168.240.0/24

define unrouteables = {
127.0.0.0/8,
10.0.0.0/8,
172.16.0.0/12,
192.168.0.0/16,
0.0.0.0/8,
100.64.0.0/10,
169.254.0.0/16,
192.0.0.0/24,
192.0.2.0/24,
192.88.99.0/24,
198.18.0.0/15,
198.51.100.0/24,
203.0.113.0/24,
224.0.0.0/4,
240.0.0.0/4
}

table ip nat {
set unrouteables {
type ipv4_addr
flags interval
elements = \$unrouteables
}

chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
}

chain postrouting {
type nat hook postrouting priority srcnat; policy accept;

oifname != "waydroid0" ip saddr \$waydroid_net counter masquerade
}

chain output {
type nat hook output priority dstnat; policy accept;

ct state established,related accept

ip daddr \$waydroid_net return
ip saddr \$waydroid_net return

meta l4proto tcp ip daddr 10.192.0.0/10 redirect to :9040

ip daddr 127.0.0.1 udp dport 53 redirect to :9053

meta skuid \$uid return

oifname "lo" return

ip daddr @unrouteables return

meta l4proto tcp redirect to :9040
}
}

table ip filter {
set unrouteables {
type ipv4_addr
flags interval
elements = \$unrouteables
}

chain input {
type filter hook input priority filter; policy drop;

ct state established,related accept
iifname "lo" accept

iifname "waydroid0" udp dport { 53, 67 } accept
iifname "waydroid0" tcp dport { 53, 67 } accept

counter log prefix "TOR-INPUT-DROP: " drop
}

chain forward {
type filter hook forward priority filter; policy drop;

ct state established,related accept

iifname "waydroid0" oifname != "waydroid0" accept
iifname != "waydroid0" oifname "waydroid0" ct state established,related accept
}

chain output {
type filter hook output priority filter; policy drop;

ct state established,related accept

oifname "lo" accept

ip daddr \$waydroid_net accept
oifname "waydroid0" accept

meta skuid \$uid accept

ip daddr @unrouteables accept

meta l4proto tcp accept

udp dport 53 accept

counter log prefix "TOR-KILLSWITCH: " drop
}
}
EOF

# Step 6: Validate and apply nftables
echo "[*] Validating nftables configuration..."
sudo nft -c -f /etc/nftables.conf

echo "[*] Applying nftables rules..."
sudo nft -f /etc/nftables.conf

# Step 7: Enable and start nftables
echo "[*] Enabling nftables service..."
sudo systemctl enable nftables
sudo systemctl start nftables

# Step 8: Show active ruleset
echo "[*] Current nftables ruleset:"
sudo nft list ruleset

# Step 9: Verify Tor connectivity
echo "[*] Checking Tor connectivity..."
curl -s https://check.torproject.org | grep -i "congratulations\|sorry"