diff options
| -rw-r--r-- | iptables.tor.rules | 35 | ||||
| -rw-r--r-- | system-configuration.scm | 6 |
2 files changed, 41 insertions, 0 deletions
diff --git a/iptables.tor.rules b/iptables.tor.rules new file mode 100644 index 0000000..d0a7454 --- /dev/null +++ b/iptables.tor.rules @@ -0,0 +1,35 @@ +*nat +:PREROUTING ACCEPT [6:2126] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [17:6239] +:POSTROUTING ACCEPT [6:408] + +-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +-A OUTPUT -o lo -j RETURN +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN +-A OUTPUT -m owner --uid-owner "tor" -j RETURN +-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +COMMIT + +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT DROP [0:0] + +-A INPUT -i lo -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset +--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable +--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable +--ipv6 -A INPUT -j REJECT +--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT +--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT +-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A OUTPUT -m owner --uid-owner "tor" -j ACCEPT +--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable +--ipv6 -A OUTPUT -j REJECT +COMMIT diff --git a/system-configuration.scm b/system-configuration.scm index 38f9c39..213d60e 100644 --- a/system-configuration.scm +++ b/system-configuration.scm @@ -45,6 +45,12 @@ ( append ( list ( service cups-service-type ) + ( service iptables-service-type + ( iptables-configuration + ( ipv4-rules + ( local-file "iptables.tor.rules" ) ) + ( ipv6-rules + ( local-file "iptables.tor.rules" ) ) ) ) ( service openssh-service-type ) ( service gnome-desktop-service-type ) ( service tor-service-type |