getting a transparent tor proxy to work on openbsd 7,3

has anybody of you got a transparent tor proxy, meaning having all traffic reroute to the tor daemon on localhost, on openbsd 7.3? it used to work on earlier versions, but noe i cant get it working. my prefered way of doing would be just with built in utils without external except for tor itself

I'm not sure how to automatically route everything through tor but you can apply the Tails firewall config to prevent all non-tor traffic: https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/etc/ferm/ferm.conf

Read this # 1. Create another loopback interface. # Write to /etc/hostname.lo1: # # inet 127.0.0.2/32 # inet6 2001:db8::1/128 # # Initialize the interface: # # # sh /etc/netstart lo1 # # 2. Enable the Tor transparent proxy and DNS resolver. # Install Tor: # # # pkg_add tor # # Append to /etc/tor/torrc: # # AutomapHostsOnResolve 1 # VirtualAddrNetworkIPv4 10.192.0.0/10 # VirtualAddrNetworkIPv6 [fc00::]/7 # TransProxyType pf-divert # TransPort 9040 IsolateDestAddr IsolateDestPort # TransPort [::1]:9040 IsolateDestAddr IsolateDestPort # DNSPort 9053 IsolateDestAddr IsolateDestPort # DNSPort [::1]:9053 IsolateDestAddr IsolateDestPort # SocksPort 0 # # Enable Tor: # # # rcctl enable tor # # rcctl restart tor # Add this to your /etc/pf.conf # Block all traffic by default, until overriden below block # Always block direct connections to Tor's proxies to enforce whitelist block return out quick on lo0 proto tcp to port 9040 block return out quick on lo0 proto udp to port 9053 # Always allow loopback traffic (bypassing the rest of the ruleset), # except for DNS to allow redirecting localhost DNS lookups to Tor's DNS # Non-redirected localhost DNS lookups are blocked by default match out on lo0 proto { tcp udp } to port domain tag "LOCALDNS" pass quick on lo0 !tagged "LOCALDNS" # Allow IPv6 LAN control messages pass inet6 proto icmp6 to { ff02::/16 fe80::/10 } pass in inet6 proto icmp6 from fe80::/10 icmp6-type redir # Proxy TCP traffic through Tor match out proto tcp user $tor_users tag "TCP" pass out inet route-to 127.0.0.2 tagged "TCP" pass out inet6 route-to 2001:db8::1 tagged "TCP" pass in on lo1 inet proto tcp divert-to 127.0.0.1 port 9040 pass in on lo1 inet6 proto tcp divert-to ::1 port 9040 # Proxy DNS traffic through Tor match out proto udp to port domain user $tor_users tag "DNS" pass out inet rdr-to 127.0.0.1 port 9053 tagged "DNS" pass out inet6 rdr-to ::1 port 9053 tagged "DNS" # Allow tor(1) traffic pass out proto tcp user _tor # Allow sshd(8) connections on the LAN pass in on egress proto tcp from (egress:network) to port ssh user root pass out on egress proto tcp to (egress:network) port ssh user 1000 # Allow ntpd(8) time synchronization pass out proto { tcp udp } to port { ntp domain } user _ntp pass out proto tcp to port https user _ntp # Allow unwind(8) DNS lookups pass out proto { tcp udp } to port { domain domain-s } user _unwind

does it make sense to do this? wouldn't it just raise more suspicion from agencies?