add permanent ip_forwarding
run tor dns proxy and socat as nobody