This is a fairly common question. I've found good guidance from the Tor Project, this and other StackExchange communities, and so on. But I haven't found a coherent set of instructions, covering both setup and leak testing.

How about we create one here?

I'm going to post my answer. Although my iptables skills are iffy, perhaps it can serve as the basis for a good answer.

  • The above post worked beautifully albeit one time only. Now Craigslist is blocking the IP automatically and all my Google searches are 404. I have to browse with Chrome Incognito, but my IP is visible on IPLeak.
    – user15252
    Nov 30 '16 at 13:36

I've just tested this in a CrunchBang 11 x64 VM. It should work in Ubuntu and the rest of the Debian family. First install Wireshark, by opening a terminal and running these commands:

sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get install wireshark

To configure wireshark to allow a non-root user to sniff packets, run these commands:

sudo dpkg-reconfigure wireshark-common
sudo adduser $USER wireshark

Then install Tor:

sudo apt-get install tor

Now edit torrc:

sudo nano /etc/tor/torrc

After line 19, which begins "#SocksPort # Bind ..." add these four lines:

AutomapHostsOnResolve 1
SocksPort 9050
DnsPort 53

Save (Ctrl-o) and exit (Ctrl-x). The first two lines enable resolving hidden services (*.onion).

Then restart Tor:

sudo service tor restart

Now specify "" as the system DNS server. If using Network Manager, right click the connection icon, select "Edit Connections", and edit the active wired or wireless connection. In the IPv4 tab, select "Automatic (DHCP) addresses only" as "Method", type "" in the "DNS servers" box, and save. In the IPv6 tab, select "Ignore" as "Method", and save. Then close the "Network Connections" window.

Now install the iptables-persistent package, which will automatically load iptables rules at boot:

sudo apt-get install iptables-persistent

During installation, you will be asked to confirm saving the existing rules:


To see what they are, run these:

sudo iptables -L
sudo ip6tables -L

Then edit the IPv6 rules to drop everything:

sudo nano /etc/iptables/rules.v6

The file should contain this:




You can paste into the terminal window using Shift|Ctrl-v. To copy from the terminal window, select with the mouse, and use Shift|Ctrl-c.

Save (Ctrl-o) and exit (Ctrl-x).

Now get the user id (uid) for the user created in the Tor installation (debian-tor):

sudo id -u debian-tor

In my CrunchBang VM, it's uid 109.

Then edit the IPv4 rules to lock down Tor:

sudo nano /etc/iptables/rules.v4

The file should contain this:



-A PREROUTING -p udp -m udp --dport 53 -j REDIRECT --to-ports 53

-A OUTPUT -m owner --uid-owner 109 -j RETURN
-A OUTPUT -p udp -m udp --dport 123 -j REDIRECT --to-ports 123
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
-A OUTPUT -p tcp -m tcp --dport 9050 -j REDIRECT --to-ports 9050




-A INPUT -i lo -j ACCEPT

-A OUTPUT -m owner --uid-owner 109 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -d -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -d -p tcp -m tcp --dport 9050 -j ACCEPT


Save (Ctrl-o) and exit (Ctrl-x).

Now load the new IPv4 and IPv6 rules:

sudo iptables-restore < /etc/iptables/rules.v4
sudo ip6tables-restore < /etc/iptables/rules.v6

And check that they loaded:

sudo iptables -L
sudo ip6tables -L

If they didn't, go back and check for errors.

Now reboot:

sudo reboot

And check iptables again:

sudo iptables -L
sudo ip6tables -L

Now check Tor status:

sudo su
tail /var/log/tor/log

It should say "Bootstrapped 100%: Done".

Now start Wireshark, and start capturing on eth0.

Open Firefox, and set as the SOCKS5 proxy.

Browse a few key sites:


And search for a few random things, and hit some sites, to generate more traffic.

Then stop Wireshark capture (4th icon from the left), and select "Statistics/Conversations" from the main menu.

You should see one local Ethernet conversation, and 1-3 TCP conversations, but nothing else. There might also be a UDP conversation on port 123 with an NTP timeserver.

In https://atlas.torproject.org/, look up the remote IP addresses ("Address B") that you see in the TCP conversations. They should all be Tor relays. They are your entry guards.

Generally, you can use torsocks for other command line apps. By default, it points to Tor SocksPort 9050. But always test for leaks. However, there may well be more secure options (such as socat). Also, you can add more SocksPorts in torrc, and use a different one for each app. That better isolates the streams. Each additional SocksPort needs its own set of iptables rules.

For example, start a Wireshark capture on eth0, and run:

sudo torsocks apt-get update

After it finishes, stop the Wireshark capture (4th icon from the left) and run "Statistics/Conversations". You should see only TCP conversations with your entry guards.


  • 1
    What's missing from the IPv4 iptables rules are defenses against various attacks using malformed packets, and so on. I've included only what I understand, and I make no pretense of being an iptables guru. I've set this as a community wiki, and invite improvements.
    – mirimir
    Aug 4 '14 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.