How can I block all traffic *except* Tor?

Question

On a Linux system, is there a way to block all in and outbound traffic unless it passes through the Tor network. This includes any form of IP communication, not just TCP connections. For example I want UDP to be completely blocked since it cannot pass through Tor. I want this systems Internet usage to be entirely anonymous, and I don't want any applications leaking.

I realize this might be complicated because Tor itself needs to communicate with relay nodes somehow.

Answer 1

Easy enough with iptables. It can have rules which match specific users, and you should have already set up tor to run under its own user ID.

A sample (and incomplete) configuration. In this example, the username is toranon (the default on Red Hat derived systems):

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -I INPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I INPUT 2 -i lo -j ACCEPT

iptables -I OUTPUT 1 -m owner --uid-owner toranon -j ACCEPT

Keep in mind that this blocks everything not initiated by tor or confined to the local host, and so that includes things like DHCP...