3

Windows 7 has a firewall. I have tried blocking all the traffic from a box except that of Tor and Firefox (which uses Tor). It doesn't work. Does anyone have any experience with this?

  • 1
    If Firefox is configured to use Tor, all traffic from Firefox will be originating from Tor. You only need to unblock Tor (unblocking Firefox as well is allowing any proxy leaks present in Firefox out as well). – Sam Whited Apr 6 '14 at 20:56
3

There are way too many connections on a default Windows system and since Windows is closed source, you cannot fully trust it to not establish any other connections.

I have 2 simple ideas:

  1. The easiest and should be used regardless of any additional firewalls: Use PeerBlock. Simply create three lists, one for blocking all IPs with a single 0.0.0.0-255.255.255.255 range. The other two will be for allowing connections, one for a Tor relay list, the other for other whitelisted IPs that you prefer or which are required for internet connection.
  2. Use a physical or virtual router to whitelist Tor IPs while blocking everything else. I would suggest a cheap physical router that you can install an open source firmware. The other idea is to have a virtual router which I didn't try because it would still not be secure (closed-source Windows) and it would require more system resources. Here is a tutorial which could work: http://timita.org/wordpress/2011/07/29/protect-your-windows-laptop-with-pfsense-and-virtualbox-part-1-preamble/

In order to whitelist Tor IPs, there are some websites providing Tor relay lists. You may need to use other tools to convert these lists to be used on PeerBlock or on your router. Also, you may have to regularly update your lists, though it would work a long time without updates.

2

First, you should use the advanced firewall (start >run >wf.msc). There you should block everything with the general settings, block all incoming traffic without exception and all outbound traffic except specific rules. Then you should create two rules:

The first for tor.exe that allows all TCP out connections on any port (you can allow only port 443 which is the default port that tor.exe tries, but on restricted networks the tor.exe app will try many other ports, and anyway you have to trust the tor.exe process, if it's compromised then you're screwed anyway).

The second rule is firefox.exe TCP out with ports 9151 and 9150 AND destination address only 127.0.01, that rule basically says that firefox.exe is only allowed to connect to the tor.exe process which is availabe on 127.0.01:9150-1.

All the other Allow rules should be disabled, except the Core network-DHCP client if you're using a dynamic IP address. If should use static address (either by your ISP or your router config) then you can disable the DHCP rule on the firewall too.

Using these rules and monitoring network traffic with sysinternals process monitor seems to block virtually everything. Howether, of course it is always preferable to use Tails which is much more secured.

0

You can also use third party firewall like tools : ZoneAlarm or Glasswire to restrict the connection on protocols and services.

0

If you're about to perform it on one host, then after Windows XP the answer is "it's impossible". Try to use IPFW for Windows, it's available as an open source software, but I was not able to run it in Vista and Windows 8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.