From fec64a1ded2c6d6ef37bc7397cc63d274552b420 Mon Sep 17 00:00:00 2001 From: Marek Paśnikowski Date: Sun, 14 Jan 2024 11:17:07 +0100 Subject: Force All Internet Traffic Through Tor * iptables.tor.rules: Import firewall rules from Arch Wiki describing Transparent Torification ... * system-configuration (iptables-configuration): ... and use them here. --- iptables.tor.rules | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 iptables.tor.rules (limited to 'iptables.tor.rules') diff --git a/iptables.tor.rules b/iptables.tor.rules new file mode 100644 index 0000000..d0a7454 --- /dev/null +++ b/iptables.tor.rules @@ -0,0 +1,35 @@ +*nat +:PREROUTING ACCEPT [6:2126] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [17:6239] +:POSTROUTING ACCEPT [6:408] + +-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +-A OUTPUT -o lo -j RETURN +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN +-A OUTPUT -m owner --uid-owner "tor" -j RETURN +-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353 +-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040 +COMMIT + +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT DROP [0:0] + +-A INPUT -i lo -j ACCEPT +-A INPUT -p icmp -j ACCEPT +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +--ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset +--ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable +--ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable +--ipv6 -A INPUT -j REJECT +--ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT +--ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT +--ipv6 -A OUTPUT -d ::1/8 -j ACCEPT +-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A OUTPUT -m owner --uid-owner "tor" -j ACCEPT +--ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable +--ipv6 -A OUTPUT -j REJECT +COMMIT -- cgit v1.2.3