Tor on Linux. DNAT port 53 DNS requests to TOR DNS listener port set to 9041 on with iptables. tcpdump shows my default gateway answers to same client port.

[root@localhost memyself]# tcpdump -nni lo | grep -iF '.53 .9041'
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
23:37:39.845298 IP > UDP, length 28
23:37:39.981214 IP > 31087 1/0/0 A (44)
23:37:39.982541 IP > UDP, length 28
23:37:40.078528 IP > 5315 NXDomain 0/0/0 (28)
23:37:40.079020 IP > UDP, length 28
23:37:40.079067 IP > 20568 NotImp 0/0/0 (28)

Isn't that strange or am i missing something? However, when tcpdump dumps my wifi adapter, there is no tcpdump output.

1 Answer 1


It's because of the wrong firewall logic. Quite a lot of scripts are proposing DNAT - and this is wrong! You have to provide a local DNS resolver - I recommend Bind 9 - and give it to your clients via DHCP or a static field value. After this DROP ALL outgoing private network traffic for a client interface and only after thet utilize TransPort transparent proxy. For a local/single host implement this either via virtual machines or containers - or by per-user rules feature. But do not ever use DNAT!

UPDATE for a comment:

ISC Bind was quite a pain in the ass and a resource hog until version 9, yes - but they have made a great work to fix it, your 4Gb laptop won't even notice it! Inside the Bind config you're just forwarding any query about dot-onion zone to Tor's DNSport and relove recursivly all the rest without any forwarders from your ISP that are spying on you and censoring your queries in most of the cases. You don't need any kind of VM or even a Docker container for that - just deploy it on your host OS and be happy about it's benefits. The DNS leaks in form of the queries to an upstream DNS server are side effects of DNAT logic mailfunctioning: it's not for it, for sure! And you simply can't handle all the cases possible using it: at least you can't handle a case when the resolving is performed with a server forcibly specified like this: nslookup example.com - or you will have to divert any DNS query to some static destination like your Tor instance, but... But port 53 is not the only one that can be used for a DNS server - it can be any port, actually nslookup -port=12345 example.com will jailbreak from this scenario easily: because you physically can't forward all the requests to the DNS port, it won't work. So either you have a routing+TransProxy as I described - or you're using socks5s or HTTPS proxy for your clients. And a VM here will fit just fine even in your 4Gb laptop for a single-host setup. Here is the trick:

  1. At first, just install Debian netinst with a minimal package selection just with command line tools inside your VM.
  2. Compile kernel by hand from kernel.org Torvalds branch or just take a last stable build from a first page of kernel.org. When configuring it - do not build drivers that are not loaded, so you will have a kernel with a minimal footprint tailored just for your VM
  3. Use this minimal kernel by dpkg-installing it and route this VM through your host with TransProxy and DNS as I said. So not enable ssh and any other unneeded service! Your overhead for having a VM will be less than 100Mb ram and like 500m on your hard drive: all the rest of resources will spent be exactly the same to run your apps you need to pass through Tor anonymously!
  • Ok. That is probably THE ideal or perfect setup. But set up BIND just for using TOR... It's just my own old crappy laptop at home with 4 GB ram (so virtual machine.. ooofffff headache). The main thing for me is.. am i safe and anonymous like this? The 2nd (not so important) is the question how come the DNS requests go into TOR and my router replies????
    – TrIPpY
    Apr 22 at 12:44
  • Thank you for the extensive answer.
    – TrIPpY
    Apr 24 at 18:27
  • @TrIPpY It it fits your needs - then mark it as an answer, so other people will know what to do when they will find this thread later
    – Alexey Vesnin
    Apr 25 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .