How should I configure my Isolating Proxy firewall for optimum security?

Question

I'm setting up a Tor-based isolating proxy using the 'Anonymizing Middlebox' iptables rules specified here: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy

i.e.

iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports 9040

...and the INPUT, OUTPUT and FORWARD chains are left at the default. Would there be any merit to also including the following rules?

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Or are they rendered unnecessary by my current setup?

Are there any other firewall rules that I should consider in order to improve security and ensure that all traffic is torified?

Many thanks.

Answer 1

Not sure about adding more rules but from what I understand having a drop all incoming and outgoing policy is a good thing to start from. Afterward , building your rule-set to punch holes in the wall. The addition of the lo rules is needed in a set up like that so it's good that you added them there. So, since you only have two major rules, EVERYTHING is being piped through Tor. Not sure if you've seen this but there is a blog post about doing this in shorewall. Seems like you did the same exact thing but in iptables. Using Shore wall to configure a Tor isolating proxy.

(I would have just commented this, but unfortunately I don't have enough points.)

Answer 2

I used to explore this subject and ended up with these rules, merging multiple sources together and adding I2P support/