I'm looking for this option in about:config for firefox, to access to onion domains.

I've configured anonymous user on my Ubuntu:

iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner anonymous -m tcp -j REDIRECT --to-ports 9040
iptables -t nat -A OUTPUT ! -o lo -p udp -m owner --uid-owner anonymous -m udp --dport 53 -j REDIRECT --to-ports 53
iptables -t filter -A OUTPUT -p tcp -m owner --uid-owner anonymous -m tcp --dport 9040 -j ACCEPT
iptables -t filter -A OUTPUT -p udp -m owner --uid-owner anonymous -m udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner anonymous -j DROP

Tor well configured too.

Dns works:

$ dig @ google.com

; <<>> DiG 9.9.5-3-Ubuntu <<>> @ google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50585
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;google.com.                    IN      A

google.com.             60      IN      A

;; Query time: 293 msec
;; WHEN: Tue Jul 22 19:07:47 NOVT 2014
;; MSG SIZE  rcvd: 44

But firefox doesn't correctly looking for onion domains. It looks for www.hash.onion, etc. Thereafter Server not found.

In this case, my firefox is anonymized. I'm getting Congratulation from check.torproject.org. But Inner Tor Network with onion domains is not accessible.

I have already set:

network.proxy.socks_remote_dns = true

  • are you not using the tor browser bundle?
    – puser
    Jul 22, 2014 at 13:08
  • No, default Ubuntu's firefox. I'm trying to configure it.
    – superuser
    Jul 22, 2014 at 13:24
  • its recommended you use the browser bundle. Why are you trying to configure the default?
    – puser
    Jul 22, 2014 at 13:28
  • also what do you mean by looks for www.hash.onion? onion sites don't have www.
    – puser
    Jul 22, 2014 at 13:29
  • 1
    This is TransPort: 9040 and TransListenAddress
    – superuser
    Jul 22, 2014 at 17:27

3 Answers 3


For the transparent proxy functionality of Tor to work you also need to set Tor as your DNS server, normally by setting the DNSPort torrc option to 53 and changing your /etc/resolv.conf. See the TransPort instructions for more hints. Without altering your resolver settings, DNS requests will go out to the Internet – not only leaking DNS but also failing to resolve .onion addresses.

However, as puser has said, the transparent proxy feature is not safe for web browsing. Malicious websites can send traffic to your web browsing causing it to de-anonymise you. The Tor Browser Bundle was specifically designed to defend against these threats.



This was wrong iptables redirect rule that excludes loop from redirect devices:


#iptables -t nat -A OUTPUT ! -o lo -p udp -m owner --uid-owner anonymous -m udp --dport 53 -j REDIRECT --to-ports 53


iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonymous -m udp --dport 53 -j REDIRECT --to-ports 53



bind by dnsmasq, instead of external IP addresses.


In the search bar, type about:config and accept the risk to continue.

Then find the variable network.dns.blockDotOnion and change it to false. If your network configuration was done correctly, firefox should now be able to resolve .onion addresses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .