I had a look at the iptables rules from Tails OS

Briefly speaking, what is the purpose of the lan iptables rules?

Chain lan (3 references)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere             tcp dpt:domain reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpt:domain reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             owner UID match postgres reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere  

1 Answer 1


They allow access to local network resources but deny DNS and the i2p service, to prevent accidental leaks.

From ferm.conf:

        # Local network connections should not go through Tor but DNS shall be
        # rejected. I2P is explicitly blocked from communicating with the LAN.
        # (Note that we exclude the VirtualAddrNetwork used for .onion:s here.)
        daddr ( @subchain "lan" {
            proto tcp dport domain REJECT;
            proto udp dport domain REJECT;
            mod owner uid-owner i2psvc REJECT;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .