1

I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost connections). The goal is to restrict the users to localhost and *.onion addresses for which Tor creates a virtual address network 10.192.0.0/10 (using the VirtualAddrNetwork option on the torrc file).

Here is my current iptables-save:

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -d 10.192.0.0/10 -p tcp -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p tcp -m tcp -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 9040
-A OUTPUT ! -o lo -p udp -m udp --dport 53 -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 53
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -m owner --uid-owner debian-tor -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9040 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -o lo -j DROP
-A OUTPUT -p icmp -j REJECT --reject-with icmp-port-unreachable
COMMIT

I tried adding this at the beginning of the *filter, before the rest of the rules, but all connections failed:

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT ! -d 10.192.0.0/10 -m owner ! --uid-owner debian-tor -j REJECT

Why does the second line in the code above block all the traffic? What are the proper rules for the following:

  • allow all incoming
  • allow all outgoing to localhost
  • allow all outgoing initiated by the debian-tor user
  • redirect all outgoing UDP 53 not initiated by debian-tor to localhost 53
  • redirect all outgoing TCP and UDP not initiated by debian-tor to localhost 9040
  • block everything else
2
  • What are you running on port 9040? Mar 13, 2013 at 20:27
  • That is the port that the debian-tor process listens for incoming connections and forwards those connections through the Tor network. Mar 13, 2013 at 21:07

0

You must log in to answer this question.

Browse other questions tagged .