Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost connections). The goal is to restrict the users to localhost and *.onion addresses for which Tor creates a virtual address network 10.192.0.0/10 (using the VirtualAddrNetwork option on the torrc file).

Here is my current iptables-save:

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -d 10.192.0.0/10 -p tcp -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p tcp -m tcp -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p udp -m udp --dport 53 -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 53
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -m owner --uid-owner debian-tor -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -o lo -j DROP
-A OUTPUT -p icmp -j REJECT --reject-with icmp-port-unreachable
COMMIT

I tried adding this at the beginning of the *filter, before the rest of the rules, but all connections failed:

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT ! -d 10.192.0.0/10 -m owner ! --uid-owner debian-tor -j REJECT

Why does the second line in the code above block all the traffic? What are the proper rules for the following:

  • allow all incoming
  • allow all outgoing to localhost
  • allow all outgoing initiated by the debian-tor user
  • redirect all outgoing UDP 53 not initiated by debian-tor to localhost 53
  • redirect all outgoing TCP and UDP not initiated by debian-tor to localhost 9040
  • block everything else
share|improve this question
    
What are you running on port 9040? –  Michael Hampton Mar 13 '13 at 20:27
    
That is the port that the debian-tor process listens for incoming connections and forwards those connections through the Tor network. –  Albert Newman Mar 13 '13 at 21:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.