Hulios: An eBPF-powered, transparent Tor gateway for Linux released

Introduction to Hulios

Hulios is a new transparent Tor VPN gateway designed for Linux systems. It leverages eBPF technology to secure outbound network traffic by routing all TCP sockets and DNS queries through an embedded Arti (Tor client) instance and a localized Hickory-based DNS resolver. This approach aims to provide robust privacy and anonymity for network communications.

Technical Implementation and Security Features

Hulios operates at the kernel socket level, utilizing cgroup hooks and policy routing to establish leak-resistant boundaries. This method avoids modifying runtime resolv.conf configurations or depending on external firewall daemons. Key security features include a strict privilege-separated runtime model, where a root supervisor spawns an unprivileged worker child that drops privileges to 'nobody' and is isolated with a seccomp system call filter.

A fail-secure kill-switch ensures that if the daemon crashes or is forcibly shut down, blackholes remain active, blocking outgoing traffic to prevent IP leaks until manual recovery. Additionally, an LSM eBPF hook globally blocks raw AF_PACKET socket creation, preventing applications from bypassing standard IP routing rules.

System Requirements and Availability

Hulios requires Linux Kernel version 5.10 or higher, with specific kernel configurations (CONFIG_BPF_SYSCALL, CONFIG_BPF_LSM, and CONFIG_CGROUPS_V2) enabled. Build dependencies include clang and libelf. It has been tested and verified on Arch Linux and Debian 13 (Bookworm).

Hulios is available on the Arch User Repository as 'hulios-git' and can also be built from source using Rust. Commands that interact with kernel interfaces or policy routing require elevated privileges.