I'm new to TOR and I'm trying to anonymize Internet connections from an automated malware analysis lab. All my machines are in the same subnetwork, and I just specify my TOR machine as a gateway for infected machines.

Here is my basic torrc configuration :

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

I only have one network interface and I can't make it work when dealing with iptables. My basic idea was just to redirect any DNS connection from an infected machine to local port 53 (DNSPort), and any TCP connections from these machines to port 9040 (TransPort).

My first idea about iptables rules was something like :

iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p tcp -j REDIRECT --to-ports 9040

Since I have a rather basic knowledge of iptables, it doesn't work and I think this "obvious" way can't work with only one interface. By the way I'm probably missing something obvious.


  • Given that you're explicitly looking at isolating a malware sandbox, you might enjoy this write up from MalwareTech: malwaretech.com/2015/08/…
    – cacahuatl
    May 29, 2017 at 14:51
  • Also sandbox tools like cuckoo already have functionality for this: docs.cuckoosandbox.org/en/latest/installation/host/routing/…
    – cacahuatl
    May 29, 2017 at 14:53
  • Thank's for your reply. Since a part of my lab is dedicated to Cuckoo, this feature can be great. If installed, the Cuckoo host himself will become the TOR Gateway of analysis targets, am I right?
    – Makuro
    May 29, 2017 at 20:24
  • Yup, it should be if you set the configurations on the host then it should torify the guests for you.
    – cacahuatl
    May 29, 2017 at 22:21


You must log in to answer this question.

Browse other questions tagged .