How to block all traffic except Tor on a Windows machine?

Question

Windows 7 has a firewall. I have tried blocking all the traffic from a box except that of Tor and Firefox (which uses Tor). It doesn't work. Does anyone have any experience with this?

Answer 1

There are way too many connections on a default Windows system and since Windows is closed source, you cannot fully trust it to not establish any other connections.

I have 2 simple ideas:

1. The easiest and should be used regardless of any additional firewalls: Use PeerBlock. Simply create three lists, one for blocking all IPs with a single 0.0.0.0-255.255.255.255 range. The other two will be for allowing connections, one for a Tor relay list, the other for other whitelisted IPs that you prefer or which are required for internet connection.
2. Use a physical or virtual router to whitelist Tor IPs while blocking everything else. I would suggest a cheap physical router that you can install an open source firmware. The other idea is to have a virtual router which I didn't try because it would still not be secure (closed-source Windows) and it would require more system resources. Here is a tutorial which could work: http://timita.org/wordpress/2011/07/29/protect-your-windows-laptop-with-pfsense-and-virtualbox-part-1-preamble/

In order to whitelist Tor IPs, there are some websites providing Tor relay lists. You may need to use other tools to convert these lists to be used on PeerBlock or on your router. Also, you may have to regularly update your lists, though it would work a long time without updates.

Answer 2

First, you should use the advanced firewall (start >run >wf.msc). There you should block everything with the general settings, block all incoming traffic without exception and all outbound traffic except specific rules. Then you should create two rules:

The first for tor.exe that allows all TCP out connections on any port (you can allow only port 443 which is the default port that tor.exe tries, but on restricted networks the tor.exe app will try many other ports, and anyway you have to trust the tor.exe process, if it's compromised then you're screwed anyway).

The second rule is firefox.exe TCP out with ports 9151 and 9150 AND destination address only 127.0.01, that rule basically says that firefox.exe is only allowed to connect to the tor.exe process which is availabe on 127.0.01:9150-1.

All the other Allow rules should be disabled, except the Core network-DHCP client if you're using a dynamic IP address. If should use static address (either by your ISP or your router config) then you can disable the DHCP rule on the firewall too.

Using these rules and monitoring network traffic with sysinternals process monitor seems to block virtually everything. Howether, of course it is always preferable to use Tails which is much more secured.

Answer 3

You can also use third party firewall like tools : ZoneAlarm or Glasswire to restrict the connection on protocols and services.

Answer 4

If you're about to perform it on one host, then after Windows XP the answer is "it's impossible". Try to use IPFW for Windows, it's available as an open source software, but I was not able to run it in Vista and Windows 8