What's the best way to isolate applications as they enter the tor network?

Question

I would like to give each application it's own entry and exit IP.

Should I add SOCKSports to the default torrc file or create new tor instances?

$ tor-instance-create instance_name

Answer 1

you can utilize a circuit isolation by authenticating them at SOCKS proxy differently, as it is said at the manual :

SOCKSPort [address:]port|unix:path|auto [flags] [isolation flags] Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don’t want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. (Default: 9050)

NOTE: Although this option allows you to specify an IP address other than localhost, you should do so only with extreme caution. The SOCKS protocol is unencrypted and (as we use it) unauthenticated, so exposing it in this way could leak your information to anybody watching your network, and allow anybody to use your computer as an open proxy.

The isolation flags arguments give Tor rules for which streams received on this SOCKSPort are allowed to share circuits with one another. Recognized isolation flags are:

IsolateClientAddr Don’t share circuits with streams from a different client address. (On by default and strongly recommended; you can disable it with NoIsolateClientAddr.)

IsolateSOCKSAuth Don’t share circuits with streams for which different SOCKS authentication was provided. (On by default; you can disable it with NoIsolateSOCKSAuth.)

IsolateClientProtocol Don’t share circuits with streams using a different protocol. (SOCKS 4, SOCKS 5, TransPort connections, NATDPort connections, and DNSPort requests are all considered to be different protocols.)

IsolateDestPort Don’t share circuits with streams targeting a different destination port.

IsolateDestAddr Don’t share circuits with streams targeting a different destination address.

KeepAliveIsolateSOCKSAuth If IsolateSOCKSAuth is enabled, keep alive circuits that have streams with SOCKS authentication set indefinitely.

SessionGroup=INT If no other isolation rules would prevent it, allow streams on this port to share circuits with streams from every other port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one another. This option overrides that behavior.)