My problem is what if I do sniffing and later I want to extract urls/analyze with suricata, Im getitng them prepended :9040 to all urls, but I see what it really uses tor exit node, so I want to get rid on that :9040

  • example - http://ipinfo.io:9040/

I have read https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, and it was working till a bit ago, I have the identical setup on another pc and it works there

This sound like some dnat/masquerade problem, but I have next rules:

  • iptables -t nat -A POSTROUTING -o virbr0 -j MASQUERADE # I have tried add also rule as this but for input traffic, to have both
  • iptables -t nat -A PREROUTING -i virbr0 --source 192.168.1.X -p tcp --syn ! --dport X -j REDIRECT --to-ports 9040 # I have triedd change redirect to dnat --to-destination, and no change, the same result

  • Software

    • tor
    • ubuntu 16.04
    • iptables 1.6.0-2ubuntu3
    • ii libpcap-dev 1.7.4-2
    • un libpcap0.7-dev
    • ii libpcap0.8:amd64 1.7.4-2
    • ii libpcap0.8-dev 1.7.4-2
  • torrc:

    • TransPort
    • DNSPort
  • tcpdump sniffing i see connection as:

    • 192.168.1.x.49210 >

Any idea what can be wrong?

Thanks in advance

  • If the transparent proxy is working as intended, this seems like a question about iptables and libpcap and how they interact with each other and not directly about Tor?
    – cacahuatl
    Feb 19, 2018 at 12:22
  • kinda is what I was thinking, but i remember on some of my tests when I set ``` TransPort DNSPort ``` i had the same problem, but then i restored it and worked just fine till few days ago Feb 19, 2018 at 12:23

1 Answer 1


ok i have solved the problem.

it's related to docker update and change of the kernel network filter, more details here https://forums.fedoraforum.org/showthread.php?312824-Bridge-broken-after-docker-install&p=1785664#post1785664

setting them to 0 looks like solve my problem

net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0 net.bridge.bridge-nf-call-arptables=0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .