Cross-Platform OPSEC Toolkit — 7-layer VPN/Tor/firewall stack for Linux, macOS, and WSL.
Named after the 1992 film about security researchers who uncover government conspiracies.
| Layer | What it does |
|---|---|
| 1. IPv6 Disable | Prevents IPv6 leaks |
| 2. VPN Connection | WireGuard with automatic interface detection |
| 3. VPN DNS Lock | Locks DNS to VPN servers, prevents leaks |
| 4. Tor Service | Optional anonymity layer (SOCKS proxy) |
| 5. MAC Spoofing | Random locally-administered MAC addresses |
| 6. Firewall | DROP-by-default policy, whitelist VPN/DNS/Tor only |
| 7. Logging Disable | Disables system logging for privacy |
# 1. Install
sudo bash install.sh
# 2. Add a VPN config (Mullvad quick setup — easiest)
sudo sneak mullvad
# 3. Activate all 7 layers
sudo sneak-on mullvad-us-nyc- Python 3.8+
- WireGuard
- Tor (optional)
- Root / Administrator access
sudo apt update
sudo apt install wireguard wireguard-tools iptables tor python3 python3-pip python3-venv
sudo bash install.shsudo pacman -S wireguard-tools iptables tor python python-pip
sudo bash install.sh# Install Homebrew if not already installed
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Run installer (handles wireguard-tools and tor automatically)
sudo bash install.shsudo apt update
sudo apt install wireguard wireguard-tools iptables tor python3 python3-pip python3-venv
sudo bash install.shNote: Tor and logging layers require systemd. To enable it in WSL, add the following to
/etc/wsl.confand restart WSL:[boot] systemd=trueWithout systemd, all other layers (VPN, firewall, IPv6 disable, MAC spoofing) work normally.
Windows support is implemented in platforms/windows.py (PowerShell-based). There is no automated installer for Windows — see the platform file for manual setup instructions. Use WSL for the best experience on Windows.
sudo sneak-on [location] # Activate all 7 layers
sudo sneak-off # Deactivate and restore system
sudo sneak-check # Check status of all layerssudo sneaksudo sneak start <location> # Start OPSEC
sudo sneak stop # Stop OPSEC
sudo sneak status # Check status
sudo sneak switch <location> # Switch VPN location (while active)
sudo sneak list # List available VPN configs
sudo sneak keygen # Generate WireGuard keypair
sudo sneak validate /path/to/config # Validate a config file
# VPN setup
sudo sneak mullvad # Mullvad quick setup
sudo sneak add # Interactive config builder
sudo sneak import --file /path/to/config.conf
sudo sneak import --pastesudo sneak mullvadPrompts for your Mullvad account number, lets you pick a server location, generates a WireGuard keypair, registers it with the Mullvad API, and saves the config — all in one flow.
If the API step fails (Mullvad periodically updates their API), download a config directly from mullvad.net/account/wireguard-config and import it with
sudo sneak import --file.
sudo sneak addStep-by-step prompts to build a WireGuard config from scratch. Generates a keypair automatically or accepts an existing private key.
# From file
sudo sneak import --file /path/to/mullvad-us.conf
# By pasting
sudo sneak import --paste
# Interactive
sudo sneak importAll configs are saved to /etc/wireguard/ (Linux/WSL) or /usr/local/etc/wireguard/ (macOS).
[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = 10.64.62.98/32
DNS = 100.64.0.7
[Peer]
PublicKey = PEER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0
Endpoint = 149.22.91.79:51820
PersistentKeepalive = 25pip install -e ".[dev]"
pytest tests/ -vsneakers/
├── core/
│ ├── config.py # WireGuard config validation, builder, importer, Mullvad setup
│ ├── keygen.py # WireGuard keypair generation
│ ├── opsec.py # OPSEC orchestration (7-layer stack)
│ └── cli.py # CLI argument parser and command handlers
├── platforms/
│ ├── base.py # Abstract base class
│ ├── linux.py # Linux (iptables, systemctl, sysctl)
│ ├── macos.py # macOS (pfctl, networksetup, brew services)
│ └── windows.py # Windows (PowerShell, Windows Firewall)
├── ui/
│ └── menu.py # Interactive TUI
└── tests/
├── test_config.py
└── test_keygen.py
- Config files: Always use 600 permissions (
chmod 600 /etc/wireguard/*.conf) - Private keys: Never logged or displayed in status output
- Firewall: DROP-by-default policy — only VPN traffic is explicitly whitelisted
- DNS: Locked with
chattr +ion Linux to prevent leaks - IPv6: Fully disabled to prevent bypass
Linux:
- iptables for firewall (DROP-by-default)
- DNS locked with
chattr +i(immutable) - Full MAC spoofing via
ip link - systemd/systemctl for Tor and logging
macOS:
- pfctl (Packet Filter) for firewall
networksetupfor DNS and IPv6- MAC spoofing via
ifconfig - Tor via
brew services
Windows:
- Windows Firewall via PowerShell
- MAC spoofing unreliable on Windows — skipped automatically
- Tor via Windows Services
- Requires Administrator privileges
After activating, verify your setup:
# Check external IP (should show VPN IP)
curl https://ifconfig.me
# Check DNS isn't leaking
dig google.com
# Check IPv6 is disabled (should be empty)
ip -6 addr show scope global
# Check firewall has DROP policy
sudo iptables -L -n | grep DROPThe commands must be run through the installed wrappers, not by running .py files directly:
sudo sneak [command] # correct
sudo sneak-on # correct
python sneak.py # incorrect — won't find core/If you've run sudo bash install.sh, the wrappers handle this automatically.
Check the config exists and is valid:
sudo sneak list
sudo sneak validate /etc/wireguard/<location>.confIf you get locked out while OPSEC is active:
# Reset firewall to ACCEPT
sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -F
# Stop WireGuard
sudo wg-quick down <location>
# Or use sneak-off
sudo sneak-offEnable systemd in /etc/wsl.conf:
[boot]
systemd=trueThen restart WSL (wsl --shutdown from PowerShell, then reopen).
MIT — see LICENSE.