{{Header}}
{{Title|
title=Lantern: Alternative Censorship Circumvention Tool
}}
{{#seo:
|description=Alternative Censorship Circumvention. Lantern over Tor. Combining {{project_name_long}} with Lantern. Connecting to Lantern before Tor (<code>User</code> &rarr; <code>Lantern</code> &rarr; <code>Tor</code> &rarr; <code>Internet</code>). ''Possible'' alternative to Tor bridges.
|image=Lanterns-111003640.jpg
}}
[[File:Lanternlogo.png|Lantern Logo|thumb]]
{{intro|
Alternative Censorship Circumvention. Lantern over Tor. Combining {{project_name_short}} with Lantern. Connecting to Lantern before Tor.

<code>User</code> &rarr; <code>Lantern</code> &rarr; <code>Tor</code> &rarr; <code>Internet</code>

''Possible'' alternative to Tor bridges.
}}
= Introduction =

[https://lantern.io/ Lantern] is a censorship circumvention tool which can provide an alternative to Tor [[bridges]]. The design is similar to a VPN and encrypts all of a user's data through their servers and then proxies blocked sites. Note that Lantern in isolation is not an anonymity tool because it is ''technically'' possible to spy on user activity under this model. Another downside is that bandwidth limits also exist for non-subscribers: <ref>https://getlantern.org/en_US/faq.html</ref>

<blockquote>
Lantern is designed to provide you with fast unfettered access to information online. Lantern is secure and encrypts your connection to blocked sites, but it is not an anonymity tool, so if you need or would like to be anonymous online, please use Tor. Otherwise, Lantern will give you faster access to blocked sites. ... To keep our free version running, we implemented a bandwidth limitation of 500 MB/ month. When the bandwidth limit is reached, the connection is slowed down and Free users are prompted to upgrade to Lantern Pro.
</blockquote>

After bandwidth limits are reached the connection slows down to approximately 20KB/s, making Lantern virtually unusable. In order to remove this restriction, users must pay for the 'Lantern Pro' service. <ref>In early-2019, this costs $32 (USD) for one year, or $48 (USD) for two years.</ref> The available options mean any payment is likely traceable, but this is not necessarily any more 'damaging' to privacy and/or anonymity than connecting to Lantern in the first place. <ref>This is because advanced adversaries can discover that a user connected to Lantern (via logs), and [[Hide Tor from your Internet Service Provider|pluggable transports]] are incapable of successfully hiding Tor use in all cases. Therefore, a payment trail simply acts as another confirmation mechanism and is not necessarily 'worse' under the circumstances.</ref> Interested readers can learn more at the [https://groups.google.com/g/lantern-users-en Lantern forums] and [https://lantern.io/faq Q&A].

= Warning =

madaidan has expressed [https://forums.whonix.org/t/lantern-alternative-censorship-circumvention-tool-warning/7763 serious concerns about the Lantern software], some of which were, however, addressed in the meantime; remaining issues:

* There is limited documentation available describing how Lantern functions. Although it states it unblocks websites, the documentation of this mechanism is outdated. Further, the developer FAQ is only available in Chinese.
* Lantern developers state they are based in Los Angeles, but their GitHub repositories, Twitter accounts and the Terms of Service have a lot of Chinese text.
* The primary GitHub repository has numerous stars and forks (even though it seems to be a small project) from possible bot accounts, as many have no activity. The GitHub account also has hundreds of repositories that are completely irrelevant to Lantern.

In summary, Lantern should be viewed as a last resort if the user has limited other options for censorship circumvention.

= Connecting to Lantern before Tor =
{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|40px]]
| text    = Testers only! [[Qubes|{{q_project_name_long}}]] only! <ref>[[Non-Qubes-Whonix|{{non_q_project_name_short}}]] is [[unsupported]] at present.</ref>
}}
It is possible to configure Tor to use Lantern as a proxy to establish the following tunnel: <code>User</code> &rarr; <code>Lantern</code> &rarr; <code>Tor</code> &rarr; <code>Internet</code>

Before applying the following instructions, it is recommended to first read:

* The [[#Warning|warning]] section above.
* [[Tunnels/Introduction|Combining Tunnels with Tor]].
* Current limitations discussed in [https://www.whonix.org/blog/connecting-to-lantern-before-tor this blog post / forum discussion].

{{Box|text=
'''1.''' Create a new standalone ProxyVM called <code>Lantern-Gateway</code> based on the <code>Debian-{{Stable project version based on Debian version short}}</code> template.

'''2.''' Unload all firewall rules in <code>Lantern-Gateway</code> ProxyVM.

{{Firewall_Unload_Home_Folder}}

'''3.''' Disable IP Forwarding in the <code>Lantern-Gateway</code> ProxyVM.

This should be disabled since it is not required.

{{CodeSelect|code=
sudo sysctl -w net.ipv4.ip_forward=0
}}

'''4.''' Install a missing Lantern dependency. <ref><nowiki>https://github.com/getlantern/lantern/issues/4836</nowiki> - Lack of a dependency declaration when installing Lantern on Debian (broken link).</ref>

{{CodeSelect|code=
sudo apt install libappindicator3-1
}}

'''5.''' Download and install Lantern.

Check if the path to the downloadable deb file is still correct. Navigate to https://getlantern.org/ and check for Linux desktop downloads.

{{CodeSelect|code=
curl {{Curl_Secure}} https://s3.amazonaws.com/lantern/lantern-installer-beta-64-bit.deb --output ~/lantern-installer-beta-64-bit.deb
}}

Install Lantern. <ref>
* Proper Debian deb package: <nowiki>https://github.com/getlantern/lantern/issues/4837</nowiki>
* Debian APT repository with Lantern: <nowiki>https://github.com/getlantern/lantern/issues/4837</nowiki>
* Add Lantern to official Debian repositories: <nowiki>https://github.com/getlantern/lantern/issues/4837</nowiki>
* Debian Lantern [https://wiki.debian.org/RFP RFP (request for packaging)]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828932
</ref>

{{CodeSelect|code=
sudo dpkg -i ~/lantern-installer-beta-64-bit.deb
}}

'''6.''' Launch Lantern and configure HTTP proxy requests.

Start Lantern while listening on all, not just the internal network interfaces so it is reachable from <code>{{project_name_gateway_vm}}</code>.

Let Lantern listen for HTTP proxy requests.

{{CodeSelect|code=
lantern -addr 0.0.0.0:8787
}}

Or let Lantern listen for SOCKS5 proxy requests which is preferred.

{{CodeSelect|code=
lantern -socksaddr 0.0.0.0:8788
}}

'''7.''' Test Lantern's HTTP or SOCKS port is functional.

In <code>Lantern-Gateway</code>, check if Lantern's HTTP port is functional.

{{CodeSelect|code=
curl {{Curl_Secure}} --proxytunnel --proxy 127.0.0.1:8788 https://check.torproject.org
}}

Alternatively, in <code>Lantern-Gateway</code>, check if Lantern's SOCKS port is functional.

{{CodeSelect|code=
curl {{Curl_Secure}} --socks5-hostname socks5h://127.0.0.1:8788 https://check.torproject.org
}}

'''8.''' Change <code>{{project_name_gateway_vm}}</code> NetVM settings.

* Shut down <code>{{project_name_gateway_vm}}</code> if it is running.
* Set the <code>{{project_name_gateway_vm}}</code> NetVM to <code>Lantern-Gateway</code>.
* Restart <code>{{project_name_gateway_vm}}</code>.

'''9.''' Test if Tor can connect to Lantern's HTTP or SOCKS port.

In <code>{{project_name_gateway_vm}}</code>, test if Tor is able to connect to the HTTP proxy that Lantern is providing.

{{CodeSelect|code=
{{Curl_Plain}} {{Curl_Secure}} --proxytunnel --proxy 10.137.11.1:8788 https://check.torproject.org
}}

Alternatively, in <code>{{project_name_gateway_vm}}</code>, test if Tor is able to connect to the SOCKS proxy that Lantern is providing.

{{CodeSelect|code=
{{Curl_Plain}} {{Curl_Secure}} --socks5-hostname socks5h://10.137.11.1:8788 https://check.torproject.org
}}

'''10.''' Edit the Tor configuration file in <code>{{project_name_gateway_vm}}</code>.

{{Open_/usr/local/etc/torrc.d/50_user.conf}}

Depending on the proxy type configured at step 6, add the relevant setting below. <ref>SOCKS is considered to be better. According to this issue (broken link <nowiki>https://github.com/getlantern/lantern/issues/2075</nowiki>), Lantern already has SOCKS support. Open issues: <nowiki>https://github.com/getlantern/lantern/issues/4838</nowiki>

<pre>
Socks5Proxy 10.137.11.1:8788
</pre>
</ref> <ref>
Setup should now be easier (less need for IP changes) because Qubes has implemented [https://github.com/QubesOS/qubes-issues/issues/1477 optional static IP addresses].
</ref>

<code>10.137.11.1</code> is just an example and it must be replaced with the IP of the <code>Lantern-Gateway</code> ProxyVM. To discover the <code>Lantern-Gateway</code> ProxyVM IP, run the following command in <code>{{project_name_gateway_vm}}</code>:

{{CodeSelect|code=
qubesdb-read /qubes-gateway
}}

<pre>
HTTPSProxy 10.137.11.1:8787
</pre>

<pre>
Socks5Proxy 10.137.11.1:8788
</pre>

'''11.''' {{Reload_Tor}}

The procedure is complete and Tor will now use Lantern as a proxy.
}}

= Footnotes =
{{reflist|close=1}}

{{Footer}}

[[Category:Documentation]]