FOSSWire
Search/
Mobile & Hardened Systems

AntiNix-Panzer-Gateway introduces systemd-free Tor and I2P gateway for low-resource hardware

Brief written by the FOSSWire AI editor from Whonix Privacy & Anonymity OS How we write

1 min read

Key Takeaway

A new independent project provides a lightweight, hardened network gateway using antiX and eBPF to route traffic through Tor and I2P.

Summary

AntiNix-Panzer-Gateway is an independent, Whonix-inspired hobby project designed to function as a minimal Tor and I2P gateway. Built on the antiX Linux distribution with a Debian Trixie base, the system is specifically optimized for older or resource-constrained hardware, operating with as little as 512 MB of RAM.

The gateway replaces systemd with SysVinit or runit and utilizes IceWM for its interface. It focuses heavily on network isolation and kernel-level security to ensure that all workstation traffic is forced through anonymizing protocols without the overhead of a full-scale desktop environment.

Technical Architecture and Hardening

  • Network Isolation: Employs an xdp-filter shield on eth0 alongside a fail-closed nftables ruleset that utilizes 'forward drop' and avoids MASQUERADE NAT to prevent leaks.
  • UID-Based Access Control: Uses nftables 'meta skuid' to block desktop users (UID 1000) and root from direct WAN access, permitting only dedicated service users (debian-tor UID 107 and i2pd UID 105) to initiate outbound traffic.
  • Kernel Security: Implements hardening parameters including 'page_poison=1' and 'slub_debug=P', while also disabling USB mass-storage auto-mounting and integrating Lynis auditing.
  • Censorship Circumvention: Features an automated Snowflake fallback mechanism that triggers via dhcpcd hooks if a direct Tor bootstrap attempt is blocked, utilizing Mozilla and Freifunk STUN servers.
  • Anonymity Routing: Supports parallel routing via the i2pd C++ daemon, providing isolated HTTP (4444) and SOCKS5 (4447) proxies accessible only through the eth1 interface.

Why it matters

This project offers a specialized alternative for privacy enthusiasts and sysadmins looking to repurpose legacy hardware as dedicated network security appliances. By removing systemd and minimizing the memory footprint, it demonstrates how lightweight, non-systemd distributions can be used to build highly specialized, hardened security gateways.

Original reference: forums.whonix.org →