0

I’m trying to harden my host to not leak anything to clearnet. I have an idea to get EntryNodes IP addresses from TorProject site, add them to iptables as allowed, and prohibit other traffic.

Question: Do TOR connect to other IPs except entrynodes during normal operation? Any directory services or anything else? Can I spoil something with this configuration?

1

Your client may also connect to directory caches, and theoretically the directory authorities (but I'm not sure that the code currently does this). It might be better to whitelist all Tor relays rather than just guards. You will also need to re-download and update your rules periodically as the Tor network has high relay churn (your guard set should remain static for long periods of time so you shouldn't need to do this super often). You might also want to consider using iptables to block all outgoing connections, and only allow outgoing connections from the user which is running tor (for example the 'debian-tor' user). The following link describes some relevant security considerations for Tails: https://tails.boum.org/contribute/design/Tor_enforcement/Network_filter/

| improve this answer | |
0

You might also want to consider using iptables to block all outgoing connections, and only allow outgoing connections from the user which is running tor (for example the 'debian-tor' user)

Unfortunately, the per user method (i.e. using the iptables -m owner --uid-owner module) will not work for me because the process does not have a separate user. I use Whonix via Virtualbox. VM connections come out as a regular application with my user.

| improve this answer | |
0

That's the problem not just for Whonix, but for a LAN-behind-a-router networks: no firewall can make a proper per-user filtering in this case. The only reliable and secure way is:

  • Route all traffic through a TransPort by default
  • Use a HTTPS+LOCAL DOH/SOCKS5+DNS proxy with authorization for exception of any kind

All other approaches are looking good from the start, but they're vulnerable in a real life.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.