#!/bin/sh
chattr -i /etc/resolv.conf
{
echo nameserver 127.0.0.1
} > /etc/resolv.conf
chattr +i /etc/resolv.conf
{
echo DNSPort 127.0.0.1:9053
echo AutomapHostsOnResolve 1
echo AutomapHostsSuffixes .onion
echo
echo TransPort 127.0.0.1:9040
echo VirtualAddrNetwork 10.192.0.0/10
} > /etc/tor/torrc
{
echo high-priority = yes
echo nice-level = -10
echo
echo realtime-scheduling = yes
echo realtime-priority = 6
echo
echo default-sample-format = float32le
echo default-sample-rate = 192000
echo alternate-sample-rate = 192000
} > /etc/pulse/daemon.conf
chmod 0644 /etc/pulse/daemon.conf
chown root:root /etc/pulse/daemon.conf
chattr -i /etc/hosts.allow
{
echo
} > /etc/hosts.allow
chattr +i /etc/hosts.allow
chattr -i /etc/hosts.deny
{
echo ALL:ALL
} > /etc/hosts.deny
chattr +i /etc/hosts.deny
{
echo 127.0.0.1 localhost
echo 127.0.1.1 d
} > /etc/hosts
{
echo \#!/bin/sh
echo
echo iptables -F
echo iptables -P INPUT DROP\; iptables -P FORWARD DROP\; iptables -P OUTPUT DROP
echo
echo iptables -A INPUT -m state --state INVALID -j DROP
echo iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
echo iptables -A INPUT -i lo -j ACCEPT
echo iptables -A INPUT -j DROP
echo
echo iptables -A FORWARD -j DROP
echo
echo iptables -A OUTPUT -m state --state INVALID -j DROP
echo iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
echo
echo iptables -A OUTPUT -p udp -d 127.0.0.1 --dport 9053 -j ACCEPT
echo iptables -A OUTPUT -o lo -j ACCEPT
echo
echo iptables -A OUTPUT -p tcp --dport 443 --syn -m state --state NEW -j ACCEPT
echo iptables -A OUTPUT -j DROP
echo
echo iptables -t nat -F
echo iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination='127.0.0.1:9053'
echo
echo ip6tables -F
echo ip6tables -P INPUT DROP\; ip6tables -P FORWARD DROP\; ip6tables -P OUTPUT DROP
echo
echo ip6tables -A INPUT -j DROP
echo
echo ip6tables -A FORWARD -j DROP
echo
echo ip6tables -A OUTPUT -j DROP
echo
echo sysctl -w net.ipv6.conf.all.disable_ipv6=1
echo sysctl -w net.ipv6.conf.default.disable_ipv6=1
} > /etc/network/if-pre-up.d/firewall
chmod 0755 /etc/network/if-pre-up.d/firewall
chown root:root /etc/network/if-pre-up.d/firewall
{
echo deb
http://deb.debian.org/debian/ buster-backports main
echo deb-src
http://deb.debian.org/debian/ buster-backports main
} > /etc/apt/sources.list.d/backports.list
echo apt update
echo apt install -t buster-backports mpv tor
echo apt install k3b htop xfburn neovim liferea gparted engrampa fcitx-mozc fonts-ipafont arc-theme papirus-icon-theme breeze-cursor-theme firefox-esr-l10n-ja