INET_IFACE=eth0 #our internet interface $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 9050 -j DROP $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 9040 -j DROP $IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 53 -j DROP $IPTABLES -A INPUT -i $INET_IFACE -p UDP --dport 53 -j DROP # Block incoming traffic for this ports from outside. # Tor already ignore non-local connections by default. ####
$IPTABLES -t nat -A OUTPUT -o lo -j RETURN $IPTABLES -t nat -A OUTPUT -d 127.0.0.1 -j RETURN # Pass direct connection to localhost services. # We can trying use privoxy at first before redirecticting unfiltered traffic to Tor. #### TOR_UID=debian-tor #see tor uid in file: #tor:x:XXX:YYY::/var/lib/tor) $IPTABLES -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j RETURN $IPTABLES -t nat -A OUTPUT -p tcp -m owner --uid-owner tornet_user -m tcp --syn \ -j REDIRECT --to-ports 9040 $IPTABLES -t nat -A OUTPUT -p udp -m owner --uid-owner tornet_user -m udp --dport 53 \ -j REDIRECT --to-ports 53 $IPTABLES -t nat -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT # Transparent redirection of the traffic to Tor for tornet_user #### # $IPTABLES -t nat -A OUTPUT -m owner --uid-owner tornet_user -j DROP # This rule will not working anymore in new iptables. #### $IPTABLES -t nat -A OUTPUT -m owner --uid-owner tornet_user -j DNAT \ --to-destination 127.0.0.1 # Use DNAT instead of nat # Any traffic from tornet user if not redirected to tor, redirected to localhost. # If no services in localhost can accept this traffic than this packets dying quietly in our localhost. I test this rules with sniffer and cannot see any DNS leakage and everithing is works fine. Any possible vulnerabilities here?
