Go ghost.

_{Not just your browser. Your whole system, gone from sight.}

---

👻 GhostNode

A CLI tool that pushes your whole Linux system through Tor. Not just your browser, everything: TCP, DNS, all of it, redirected with nftables. Has an optional kill switch and can rotate your exit node too.

💭 Why this exists

I built something like this a year ago and it was very bad. That old project is the whole reason I learned Rust. I wanted a tool that actually worked, and I did not trust myself to write it safely in the language I was using back then.

GhostNode took about 3 months to build. I built this alone. I think everyone should have the right to privacy, not just people who already know enough tech to get it for themselves. That is really why this exists and why it is free.

It is still young. If you hit bugs or something about your setup breaks it, that is expected right now, not a sign the project is dead.

⚙️ What it actually does

Running ghostnode connect does this:

• Sends all your TCP traffic through Tor's TransPort and all DNS lookups through Tor's DNSPort, using nftables rules
• Turns off IPv6 while you are connected, since IPv6 does not go through Tor and would leak your real address if left on
• Locks you to one active network interface (LAN before Wi-Fi), so traffic cannot sneak out through a second interface you forgot was up
• Checks your connection against check.torproject.org once Tor finishes starting up

On top of that, three optional flags:

🛑 --killswitch turns on a background watcher. It checks for DNS leaks, missing nftables rules, IPv6 turning itself back on, Tor crashing, new interfaces that show up after you connected, more than one default route, and your real IP leaking through the Tor circuit. If it catches any of that, it kills Tor, locks the firewall down completely (nftables first, iptables and ip6tables as backup in case nftables did not apply clean), and stops. It will not fix itself. You run ghostnode disconnect once you trust the network again.

🔄 --node switches to a new Tor circuit every 10 minutes and prints the new exit IP, so you can actually see it change.

🌉 --bridge asks you for two obfs4 bridge lines and turns on UseBridges, for networks where Tor itself is blocked or watched.

Running ghostnode disconnect undoes all of it: flushes the firewall, sets iptables back to ACCEPT, turns IPv6 back on, restores your old /etc/resolv.conf and /etc/tor/torrc from backup (or writes safe defaults if there is no backup), and stops Tor.

Every config file GhostNode touches gets backed up to /var/lib/ghostnode/backup before anything gets changed.

🎥 Demo

Connecting with the kill switch on

Bridge mode walkthrough

📋 Requirements

You need a systemd based Linux system, plus nftables, iptables, iproute2, curl, and tor. obfs4proxy is only needed if you plan on using --bridge. Root is required for almost everything, connect and disconnect both stop if you are not root.

manager.sh installs all of that for you and figures out if you are on apt, dnf, or pacman. One thing to know: on Arch, obfs4proxy is AUR only, so you will need to grab that one yourself.

📦 Installing

git clone https://github.com/nyzorrr/ghostnode.git
cd ghostnode
sudo ./manager.sh install

You will be asked whether to build from source or use the prebuilt binary sitting next to the script. Building needs a self_compile/ folder with a working Cargo.toml next to manager.sh.

To remove it later:

sudo ./manager.sh uninstall

This leaves tor, nftables, iptables, curl, and obfs4proxy alone. Those are system packages, GhostNode did not install them for itself, so it will not remove them either.

🖥️ Usage

ghostnode <COMMAND> [OPTIONS]

COMMANDS:
    connect       Connect to Tor
    disconnect    Disconnect from Tor
    help          Show this help message
    version       Show the current version

connect OPTIONS:
    -k, --killswitch    Enable killswitch on leak detection
    -n, --node          Rotate tor exit node every 10 minutes
    -b, --bridge        Use obfs4 bridges
    -d, --debug         Enable debug output

disconnect OPTIONS:
    -d, --debug         Enable debug output

A few real examples:

sudo ghostnode connect --killswitch
sudo ghostnode connect -k -n
sudo ghostnode connect --bridge
sudo ghostnode disconnect

⚠️ Read this before you rely on it

A few honest points, since this tool touches your firewall and DNS as root.

If connect fails partway through (nftables rejects something, Tor does not finish starting in time, whatever), your system can end up half set up. Check systemctl status tor and journalctl -u tor before you assume you are covered.

The kill switch does not fix itself once it goes off. Your traffic stays blocked until you run disconnect by hand. That is on purpose, if it quietly let traffic through again after tripping, it would not really be a kill switch.

Nobody but me has checked this code for security holes yet. If your safety depends on this working right, read the source yourself first, especially apply_nftables and detect_leaks in main.rs.

The single interface rule will disconnect whatever LAN or Wi-Fi interface it decides is extra, without asking first. If you are managing a machine remotely over that exact interface, you will lock yourself out.

💡 Ideas and contributing

This is still early and I want to make it better. If you have an idea, found a bug, or think something is missing, come tell me on Discord instead of just thinking it. I read everything there and actually try to build what people ask for.

💬 Discord: discord.gg/N8aeQXHdt

💸 Supporting the project

GhostNode is free and stays free either way, this is not a paywall. But if it is useful to you and you want to throw something at development, it is appreciated:

• BTC: bc1qmgnz54x4epaeuvz558z4d7n3a3dqk3vldsgcnt
• XMR: 43eLK3JjmkDiWAuP9b5N8sahtzQQByaVSEPbZvVTctXAYJ1cHGXbVL3f8PSREnmnSsY4rMkhx14UA8vxc5sfz4ZhDfxKkg5
• ETH: 0x8CF98DeF5d716E10697E5905caff34b405dcd4fF
• SOL: DFwWy5EMB5QRd1FTV81ft5WYyH6uHecRvPsXkLNRyh1s

📜 License

GPLv3. See LICENSE.

---

_{Stay ghost.}