I am configuring a tor hardware router as an anonymizing transparent proxy using the info here and the good news is everything is working as it should; I can connect and browse sites, dns is forwarded to port 9053 and everything else tcp is forwarded over tor on the router port 9040. I go to https://check.torproject.org to test and it says tor is running and configured properly.

The only thing is I would also like to browse hidden services (.onion) and so far have not been able to get it to work. When I am connected to the tor hardware router and I troubleshoot from the command line .onion domains resolve to the false ip addresses as they should:

 sh-4.1$ host 3g2upl4pq6kufc4m.onion
3g2upl4pq6kufc4m.onion has address
3g2upl4pq6kufc4m.onion has address
Host 3g2upl4pq6kufc4m.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrzrnw6insl.onion
xmh57jrzrnw6insl.onion has address
xmh57jrzrnw6insl.onion has address
Host xmh57jrzrnw6insl.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrdrnw6insl.onion
xmh57jrdrnw6insl.onion has address
xmh57jrdrnw6insl.onion has address
Host xmh57jrdrnw6insl.onion.lan not found: 4(NOTIMP)
sh-4.1$ host xmh57jrdrnw6ins0.onion
xmh57jrdrnw6ins0.onion has address
xmh57jrdrnw6ins0.onion has address
Host xmh57jrdrnw6ins0.onion.lan not found: 4(NOTIMP)

Those are all addresses with the VirtualNetwork as configured in my torrc which looks like this:

AutomapHostsOnResolve 1
TransPort 9040
DNSPort 9053

And I have added a firewall rule (this may be where I done goofed) like so:

# allow ssh access over port 99 from LAN
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 99 -j REDIRECT --to-ports 22
# everything else goes over tor
iptables -t nat -A PREROUTING -i br-lan -p tcp --syn -j REDIRECT --to-ports 9040
# udp traffic for DNS (port 53) is sent to tor 9053
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j REDIRECT --to-ports 9053
# everything else udp is dropped.. not working yet
#iptables -t nat -A PREROUTING -i br-lan -p udp --syn -j DROP
# resolve onion domains (this is the rule in question)
iptables -t nat -A OUTPUT -p tcp -d -j REDIRECT --to-ports 9040

I know .onion domains do not have ip addresses to resolve to, but when my browser queries the router for an onion domain it comes back with a seemingly random ip within the range, and then when my browser requests that ip (say it should be redirected via iptables back to the router right? Or am I doing it wrong?

Everything is working fine except .onion domains...

1 Answer 1


I found the issue after some reading. The VirtualAddrNetwork setting was the same as the dhcp pool in my network configuration so when .onion domains were returned the browser was attempting to forward traffic to an address on my local area network, which was not the correct configuration. If anyone is interested I can post the config files, but a much better and in depth explanation can be found here:


this ticket should be closed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .