I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost connections). The goal is to restrict the users to localhost
and *.onion
addresses for which Tor creates a virtual address network 10.192.0.0/10 (using the VirtualAddrNetwork
option on the torrc file).
Here is my current iptables-save:
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -d 10.192.0.0/10 -p tcp -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p tcp -m tcp -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p udp -m udp --dport 53 -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 53
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -m owner --uid-owner debian-tor -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -o lo -j DROP
-A OUTPUT -p icmp -j REJECT --reject-with icmp-port-unreachable
COMMIT
I tried adding this at the beginning of the *filter
, before the rest of the rules, but all connections failed:
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT ! -d 10.192.0.0/10 -m owner ! --uid-owner debian-tor -j REJECT
Why does the second line in the code above block all the traffic? What are the proper rules for the following:
- allow all incoming
- allow all outgoing to localhost
- allow all outgoing initiated by the debian-tor user
- redirect all outgoing UDP 53 not initiated by debian-tor to localhost 53
- redirect all outgoing TCP and UDP not initiated by debian-tor to localhost 9040
- block everything else