I checked in the Tails documentation and I saw nothing about the firewall. Is there a firewall like iptables in Tails?
Thanks
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this communityHave a look at the Network Filter documentation.
.... This is solved by blocking all outbound Internet traffic except Tor (and I2P when enabled), and explicitly configuring all applications to use one of these.
config/chroot local-includes/etc/ferm/ferm.conf
(usesferm
to build an iptables ruleset)
This command should work to take a look at the firewall
sudo iptables -L -v
Also I add an interface specific drop command before the loopback command to prevent an attack that I think may be possible against the loopback. These packets are called martian packets.
https://en.wikipedia.org/wiki/Martian_packet
Full output
amnesia@amnesia:~$ sudo iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere state ESTABLISHED
0 0 ACCEPT all -- lo any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere state ESTABLISHED
0 0 ACCEPT icmp -- any lo anywhere anywhere state RELATED
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match root
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match proxy
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9050 flags:FIN,SYN,RST,ACK/SYN owner UID match nobody
0 0 ACCEPT tcp -- any lo anywhere localhost tcp flags:FIN,SYN,RST,ACK/SYN multiport dports 9050,9061,9062,9150 owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match htp
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-iuk-get-target-file
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9062 flags:FIN,SYN,RST,ACK/SYN owner UID match tails-upgrade-frontend
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9051 owner UID match tor-launcher
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9051 owner UID match root
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9052 owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:9040 owner UID match amnesia
0 0 ACCEPT udp -- any lo anywhere localhost udp dpt:domain owner UID match amnesia
0 0 ACCEPT udp -- any lo anywhere localhost udp dpt:mdns owner UID match amnesia
0 0 ACCEPT udp -- any lo anywhere 127.0.0.2 udp dpt:domain owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere 127.0.0.2 tcp dpt:domain flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:4101 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:ipp flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
0 0 ACCEPT tcp -- any lo anywhere localhost tcp dpt:6136 flags:FIN,SYN,RST,ACK/SYN owner UID match amnesia
0 0 ACCEPT tcp -- any !lo anywhere anywhere owner UID match clearnet
0 0 ACCEPT udp -- any !lo anywhere anywhere owner UID match clearnet udp dpt:domain
0 0 lan all -- any any anywhere 10.0.0.0/8
0 0 lan all -- any any anywhere 172.16.0.0/12
0 0 lan all -- any any anywhere 192.168.0.0/16
0 0 ACCEPT tcp -- any any anywhere anywhere owner UID match debian-tor tcp flags:FIN,SYN,RST,ACK/SYN state NEW
0 0 LOG all -- any any anywhere anywhere LOG level debug uid prefix "Dropped outbound packet: "
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain lan (3 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- any any anywhere anywhere tcp dpt:domain reject-with icmp-port-unreachable
0 0 REJECT udp -- any any anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
0 0 REJECT all -- any any anywhere anywhere owner UID match i2psvc reject-with icmp-port-unreachable
0 0 ACCEPT all -- any any anywhere anywhere