I need to install a firewall on an old PC.

The requirements are:

• NAT
• DHCP server
• Proxy
• Anonymity

So that http and ftp access is anonymized.
Something like a "tor" appliance?

What would you recommend?

Tor can be made to provide service for a LAN.

Throw-in Privoxy, iptables, and dnsmasq or dhcpd and your requirements should be met.

NOTE: Please remember that using Tor for unencrypted traffic such as HTTP and FTP is extremely dangerous. A rogue exit-node can easily read, insert, and modify any unencrypted traffic between clients and servers without either party knowing that the link has been compromised.

Thanks for the suggestion.
I'll read it.

(Some background - I need set up test environment for an array of different servers and DHCP client devices.)

Many DHCP clients behind this firewall will be small embedded devices. Which means:

1. All 3rd party hardware. I have very little control over them.
2. Basically, they can be setup as DHCP clients. That is about it.
3. Once they have internet access, they will use http to access web pages.
4. They use this web access to decide if they need to update themselves.
5. They use http or ftp to download their own updates.
6. They update themselves.
7. Finally, reboot themselves to become DHCP clients again.

In other words, I cannot force these clients go to a socks proxy.
I can however, make sure that TOR is the only "server" on this LAN.

Given this scenario - Can TOR still provide (anonymized) service to this LAN?

The anonymized service is important because I have to preserve the identity and the origin of each of these embedded devices.
So that the servers in the test environment provide equal access to any request.

The clients just need to be set to use Privoxy as an HTTP proxy. SOCKS would only be used by Privoxy to communicate with Tor. You can even have the clients get transparently proxied if you place a transparent proxy in front of Privoxy (make sure you disable any DNS functionality in such a proxy).

As for your clients getting their updates via an insecure connection, you should be okay as long as all the downloaded files are digitally signed, so you can make sure they are authentic and untampered with. It's good that you can use either HTTP or FTP because Privoxy isn't FTP-compatible AFAIK.