I was thinking about how to block outgoing traffic on a server hosting a hidden service. I could lock down this server via iptables, but that does nothing for me if someone gets root (still gonna do it regardless). I also thought about routing all traffic to a hardware firewall and only allowing the tor port. But then I realized someone could easily send an outbound netcat connection through the open port on the firewall. Then I thought, what if on the firewall on the tor port, if I could limit traffic based on the protocol itself, so only tor related traffic could get through.

Has anyone solved this situation, and how were you able to do it?

1 Answer 1


Root is an adversary indefendable against: if it's breached - you're fucked. On any OS: Unix, Linux, Windows and all the rest of them. The use of the root account is a can-do-everything one: to fix something or tweak sensitive system parts. If you're having a VPS - just use IPTables: the hypervisor's owner(your hoster) will have full access even to the server's memory without you ever knowing it! If you're hosting a dedicated box - use virtualisation, not Docker! And in a virtualized machine add only single host-only network adapter to that VM and rule it via.. IPTables, but on a hypervisor host

  • I think someone with root on the hypervisor could still make an outbound connection and discover the public IP of the server. I'm thinking there's no real way to accomplish this, but your hypervisor suggestion is definitely a good one. I have a secondary question if you know it. Isn't it true that tor relay servers pick their own ports, so if I wanted to lock down outgoing connections on the host machine and only allow outbound tor traffic, I cannot predict what ports should be allowed out?
    – eclair
    Dec 10, 2023 at 9:59
  • The ports are stated strict in the config, so you can predict it for sure. If you're owning the box or having a dedicated server rented - no external management can be done, at least unnoticed
    – Alexey Vesnin
    Dec 10, 2023 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .