diff options
author | Marek Paśnikowski <marek@marekpasnikowski.pl> | 2024-01-14 11:17:07 +0100 |
---|---|---|
committer | Marek Paśnikowski <marek@marekpasnikowski.pl> | 2024-01-14 11:17:07 +0100 |
commit | fec64a1ded2c6d6ef37bc7397cc63d274552b420 (patch) | |
tree | 467f803dc202b0f22530a3c906dea0cfe0a99737 /iptables.tor.rules | |
parent | 5977366a1e830869cf0e68c72efff83372a107d2 (diff) |
Force All Internet Traffic Through Tor
* iptables.tor.rules: Import firewall rules from Arch Wiki
describing Transparent Torification ...
* system-configuration (iptables-configuration): ... and use them here.
Diffstat (limited to 'iptables.tor.rules')
-rw-r--r-- | iptables.tor.rules | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/iptables.tor.rules b/iptables.tor.rules new file mode 100644 index 0000000..d0a7454 --- /dev/null +++ b/iptables.tor.rules @@ -0,0 +1,35 @@ +*nat +:PREROUTING ACCEPT [6:2126] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [17:6239] +:POSTROUTING ACCEPT [6:408] + +-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +-A OUTPUT -o lo -j RETURN +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN +-A OUTPUT -m owner --uid-owner "tor" -j RETURN +-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +COMMIT + +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT DROP [0:0] + +-A INPUT -i lo -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset +--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable +--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable +--ipv6 -A INPUT -j REJECT +--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT +--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT +-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A OUTPUT -m owner --uid-owner "tor" -j ACCEPT +--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable +--ipv6 -A OUTPUT -j REJECT +COMMIT |