Skip to content
BranchesTags

Repository files navigation

SecureRoute

Version 1.2 — License: MIT

Anonymizing WiFi Router with Web GUI

Turns any Linux device (Raspberry Pi, VM, laptop) into a secure wireless access point that routes all connected client traffic through Tor, I2P, GSocket, WireGuard, or Reticulum. No direct internet access ever leaves the box — all traffic is anonymized before hitting the wire.

🔒 Security Status: All critical security issues have been addressed. See SECURITY_AUDIT.md for details.

Features

  • Web GUI — clean dark dashboard served locally on port 8080
  • 5 routing modes — switch between Tor, I2P, GSocket, WireGuard, or Reticulum without reconnecting
  • Strict firewall — iptables rules block all non-anonymized traffic; direct internet is impossible
  • Real-time status — connected clients, uptime, system stats, live log stream
  • Zero persistent data — no traffic logs, no DNS caches outside the routing daemon
  • Cross-platform — Raspberry Pi (ARM64/ARMv7), x86 VMs, laptops running Debian/Ubuntu/Raspbian

Architecture

[Client Device]
      │ WiFi (WPA2)
      ▼
[SecureRoute AP — wlan0]
      │ iptables transparent proxy rules
      ▼
┌─────────────────────────────────────────────┐
│          Routing Mode (one active)          │
│                                             │
│  TOR       → 3-hop onion routing            │
│  I2P       → garlic routing overlay         │
│  GSOCKET   → global relay tunnel            │
│  WIREGUARD → VPN tunnel via wg0             │
│  RETICULUM → cryptographic mesh network     │
└─────────────────────────────────────────────┘
      │
      ▼
[Internet — through anonymous layer only]

The web GUI (Flask, port 8080) is accessible from the management interface (eth0 or the host's own IP), not from the WiFi AP clients.

Hardware Requirements

Component Requirement
CPU ARMv7 / ARM64 / x86_64
RAM 512 MB minimum (1 GB+ recommended for I2P)
Storage 2 GB free
WiFi 802.11n adapter with AP mode support (iw list → AP in supported modes)
Wired NIC Ethernet for WAN (or second WiFi adapter)

Tested on:

  • Raspberry Pi 4 (Raspbian Bookworm)
  • Raspberry Pi 3B+ (Raspbian Bullseye)
  • Raspberry Pi 2 (Raspbian Bullseye) — WireGuard via DKMS
  • Ubuntu 22.04 VM (x86_64)
  • Debian 12 (Bookworm)

Quick Start

1. Install

git clone https://github.com/scabeard/Secure-Route secureroute
cd secureroute
sudo bash install.sh

2. Configure

Edit /etc/secureroute/config.json:

{
  "wifi": {
    "ssid": "MySecureAP",
    "password": "strongpassword",
    "channel": 6,
    "interface": "wlan0",
    "wan_interface": "eth0",
    "gateway": "10.42.0.1"
  }
}

Or configure via the web GUI at http://<device-ip>:8080.

3. Start

sudo systemctl start secureroute
# Open GUI
open http://<device-ip>:8080

Routing Modes

Tor

  • Transparent proxy via TransPort (9040)
  • DNS redirected to Tor's DNSPort (5353) — prevents DNS leaks
  • UDP blocked except DNS
  • Optional exit country via ExitNodes {US} in torrc
  • Requires: tor package + debian-tor user

I2P

  • Uses i2pd (C++ implementation, lighter than Java i2p)
  • HTTP proxy on port 4444, SOCKS on 4447
  • AP HTTP traffic redirected to i2p HTTP proxy
  • Good for i2p eepsites (.i2p addresses)
  • Requires: i2pd package

GSocket (HackerChoice)

  • Relay-based tunnel via gsocket.io global network
  • Shared secret authenticates the tunnel — no IPs, no persistent identifiers
  • Source: github.com/hackerschoice/gsocket
  • Requires: gs-netcat binary (installer handles this)
  • Set your GSocket secret in config before use

WireGuard

  • Modern, fast VPN protocol built into Linux kernel 5.6+
  • Routes all AP traffic through WireGuard wg0 interface
  • State-of-the-art cryptography (ChaCha20, Poly1305, Curve25519)
  • Lower latency and better performance than OpenVPN
  • Place your WireGuard config at /etc/secureroute/wg0.conf
  • Requires: wireguard-tools package (kernel module built-in on 5.6+)

Reticulum (NEW in v1.2)

  • Cryptographic mesh network stack — no centralized infrastructure needed
  • End-to-end encryption with forward secrecy for all communications
  • Works over any medium: WiFi, TCP/IP, LoRa radio, serial, packet radio
  • Self-configuring mesh routing — nodes discover each other automatically
  • Low bandwidth requirements — suitable for Raspberry Pi Zero and constrained devices
  • Optional transport mode to relay packets for other nodes
  • Uses rnsd daemon with configurable TCP/UDP interfaces
  • Requires: rns Python package (installed via pip)
  • See docs/RETICULUM_GUIDE.md for detailed setup

Setting up WireGuard

  1. Copy the template:

    sudo cp /etc/secureroute/wg0.conf.template /etc/secureroute/wg0.conf

  2. Edit with your VPN provider's details:

    sudo nano /etc/secureroute/wg0.conf

  3. Fill in:

    • Your private key (from VPN provider or generate with wg genkey)
    • Server's public key
    • Server endpoint (IP:port)
    • Your assigned IP address

Example config:

[Interface]
PrivateKey = YOUR_PRIVATE_KEY_HERE
Address = 10.66.66.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY_HERE
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

File Structure

secureroute/
├── secureroute.py          # Flask backend, daemon manager, iptables
├── gui/
│   └── index.html          # Web dashboard (single-file SPA)
├── config/                 # Runtime config (auto-created)
│   ├── config.json
│   ├── hostapd.conf
│   ├── dnsmasq.conf
│   └── torrc
├── install.sh              # Installer
└── README.md

API Reference

The backend exposes a simple REST API (useful for scripting):

Endpoint Method Description
/api/status GET Full router status + clients
/api/mode POST {"mode":"tor"} Switch routing mode
/api/ap POST {"action":"start"} Toggle access point
/api/config GET/POST Read/write configuration
/api/logs GET ?n=50 Last N log lines
/api/system GET CPU, RAM, disk, kernel
/api/check-deps GET Dependency scan

Security

SecureRoute has been designed with security in mind:

Authentication

  • Basic HTTP authentication protects all sensitive API endpoints
  • Rate limiting prevents brute force attacks (5 attempts, 5-minute lockout)
  • Constant-time password comparison prevents timing attacks

Configuration Security

  • Sensitive values can be set via environment variables (never stored on disk): 
    export SECUREROUTE_ADMIN_PASSWORD=$(openssl rand -base64 32)
export SECUREROUTE_WIFI_PASSWORD=$(openssl rand -base64 24)
export SECUREROUTE_GSOCKET_SECRET=$(openssl rand -hex 32)
  • Config file permissions set to 600 (owner read/write only)
  • Sensitive values masked in API responses

Network Security

  • Strict firewall rules — iptables block all non-anonymized traffic
  • DNS leak prevention — all DNS queries routed through Tor/I2P
  • UDP blocking (Tor mode) — prevents WebRTC IP leaks
  • CORS configurable — restrict API access to specific origins

Default Credentials

  • Default WiFi password is changeme123 — change it immediately after installation
  • No default admin password — must be configured before enabling authentication

Security Audit

See SECURITY_AUDIT.md for a comprehensive security review.

Additional Security Notes

  • GUI is only accessible on the LAN/management interface; AP clients cannot reach it
  • GSocket secret should be a long random string: openssl rand -hex 32
  • For WireGuard: use a provider that doesn't log, or self-host your own server
  • The AP never bridges directly to the WAN — all traffic goes through the routing layer

Troubleshooting

WiFi adapter not showing AP mode:

iw list | grep -A 10 "Supported interface modes"
# Must show: * AP

hostapd fails to start:

# Check rfkill
rfkill unblock wifi
rfkill unblock all

# Check interface name
ip link show
# Update config if it's wlan1 instead of wlan0

Tor not bootstrapping:

# Check Tor log
tail -f /var/log/tor/notices.log
# Ensure system time is correct (critical for Tor)
timedatectl status

WireGuard not connecting:

# Check if module is loaded
lsmod | grep wireguard

# Manually test config
sudo wg-quick up /etc/secureroute/wg0.conf

# Check interface status
sudo wg show

# View logs
sudo journalctl -u secureroute -f

Check service status:

sudo systemctl status secureroute
sudo journalctl -u secureroute -f

License

MIT — use responsibly. This tool is for legitimate privacy, security research, and military/covert operations requiring anonymized network access.

About

Turns any Linux device (Raspberry Pi, VM, laptop) into a secure wireless access point that routes **all connected client traffic** through Tor, I2P, GSocket, WireGuard, or Reticulum. No direct internet access ever leaves the box — all traffic is anonymized before hitting the wire.

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages