diff options
Diffstat (limited to 'iptables.tor.rules')
| -rw-r--r-- | iptables.tor.rules | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/iptables.tor.rules b/iptables.tor.rules new file mode 100644 index 0000000..d0a7454 --- /dev/null +++ b/iptables.tor.rules @@ -0,0 +1,35 @@ +*nat +:PREROUTING ACCEPT [6:2126] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [17:6239] +:POSTROUTING ACCEPT [6:408] + +-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +-A OUTPUT -o lo -j RETURN +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN +-A OUTPUT -m owner --uid-owner "tor" -j RETURN +-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +COMMIT + +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT DROP [0:0] + +-A INPUT -i lo -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset +--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable +--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable +--ipv6 -A INPUT -j REJECT +--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT +--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT +-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A OUTPUT -m owner --uid-owner "tor" -j ACCEPT +--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable +--ipv6 -A OUTPUT -j REJECT +COMMIT |