I'm new to TOR and I'm trying to anonymize Internet connections from an automated malware analysis lab. All my machines are in the same subnetwork, and I just specify my TOR machine as a gateway for infected machines.

Here is my basic torrc configuration :

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 53

I only have one network interface and I can't make it work when dealing with iptables. My basic idea was just to redirect any DNS connection from an infected machine to local port 53 (DNSPort), and any TCP connections from these machines to port 9040 (TransPort).

My first idea about iptables rules was something like :

iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -s <INFECTEDMACHINE> -p tcp -j REDIRECT --to-ports 9040

Since I have a rather basic knowledge of iptables, it doesn't work and I think this "obvious" way can't work with only one interface. By the way I'm probably missing something obvious.


  • Given that you're explicitly looking at isolating a malware sandbox, you might enjoy this write up from MalwareTech: malwaretech.com/2015/08/… – cacahuatl May 29 '17 at 14:51
  • Also sandbox tools like cuckoo already have functionality for this: docs.cuckoosandbox.org/en/latest/installation/host/routing/… – cacahuatl May 29 '17 at 14:53
  • Thank's for your reply. Since a part of my lab is dedicated to Cuckoo, this feature can be great. If installed, the Cuckoo host himself will become the TOR Gateway of analysis targets, am I right? – Makuro May 29 '17 at 20:24
  • Yup, it should be if you set the configurations on the host then it should torify the guests for you. – cacahuatl May 29 '17 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.