Privacy & Anonymity

Tor & the Network

The most fundamental thing a service learns about you is your IP address — where you are and who your ISP is. Tor breaks that link by bouncing your traffic through a volunteer relay network, so the sites and servers you reach see a Tor exit node instead of you. Oniomarchy puts Tor on the bar, front and center, with two very different ways to use it and the safety machinery to use it properly.

The bar panel

Tor lives in a panel on your Quickshell bar (installed via the tormarchy plugin), so its state is always visible and one click away — no terminal, no editing configs. It gives you far more than a simple on/off toggle:

  • Whole-system routing — send every connection from the machine through Tor, not just the browser. This is the strong option: nothing on the machine talks to the internet directly.
  • A nftables kill switch with three modes — LAN-passthrough (local network still reachable), strict (only Tor, nothing else), and a SOCKS-only opt-in. The kill switch is the part that makes whole-system Tor trustworthy: if Tor drops, your traffic doesn’t silently fall back to your real IP — it stops.
  • Browser-only mode, using kernel-level isolation so only your browser goes through Tor while the rest of the machine stays direct. Lower overhead than routing everything, and exactly what you want when it’s only your web activity you’re protecting.
  • Exit-country selection — choose which country your traffic appears to come from.
  • New circuit — pull a fresh path through the network (and thus a new apparent IP) on demand.
  • Bridges for networks that block Tor outright, a boot-reconnect option, a doctor command that checks for leaks, and a panic command to tear everything down fast.

Whole-system versus browser-only

This is the key choice, and it maps directly onto the layers idea:

  • Whole-system is the higher-assurance option. Every tool, every process, every stray connection goes through Tor, and the kill switch guarantees there’s no leak around it. Use it when the requirement is that nothing on the machine reveals your real address. The cost is speed and the occasional service that refuses Tor exit nodes.
  • Browser-only is the lighter, more surgical option. Your scanning, your updates, and your other traffic stay fast and direct; only the browsing you want protected goes through Tor, isolated at the kernel level so the two can’t cross. Use it for OSINT and research where it’s your web footprint you care about.

torsocks — one command at a time

For the case where you want to push a single command through Tor without routing the whole system, Oniomarchy also installs torsocks:

# Route one command through Tor
torsocks curl https://check.torproject.org

# Run a recon tool through Tor
torsocks theHarvester -d target.com -b all

Several installed tools also have Tor support built in — sherlock’s --tor/--unique-tor, for instance — which is the cleanest option when a tool offers it.

Verify it

Never assume Tor is working — check. Use the panel’s doctor leak check, and confirm your apparent IP from the browser:

torsocks curl https://check.torproject.org/api/ip

If that doesn’t show a Tor exit, stop and fix it before doing anything that depends on being routed.