8

One of the fundamentals of Tor is that it can only really hide you if, when Tor is enabled and in use, you're using it exclusively.

Agents wishing to de-anonymize you can examine requests to different endpoints and look for common or synchronized requests, which suggests that the traffic from a proxied IP address is related to the traffic from the actual endpoint.

So to prevent other components on my laptop from disclosing my location, I'd like to configure the system so it blocks all traffic that isn't going through the Tor relay. For instance, Skype, Gmail, Spotify, or anything else that makes requests to the Internet must be disabled?

How can I configure Tor, or my network, so that only components using the Tor relay can make requests to the Internet? I've used firewall UNIX tools like ufw and ipfw, but automating this would reduce the potential for making mistakes and forgetting to close or block something.

Improve this question

4 Answers 4

Reset to default
9

Tails might be your best bet

The Amnesic Incognito Live System or Tails is a Debian-based Linux distribution aimed at preserving privacy and anonymity. It is the next iteration of development on the previous Gentoo based Incognito Linux distribution. All its outgoing connections are forced to go through Tor, and direct (non-anonymous) connections are blocked. The system is designed to be booted as a live CD or USB, and leaves no trace on the machine unless explicitly told to do so. The Tor Project has provided most of the financial support for development. (Wikipedia)

It would be best if you could run it on a spar computer. If you need it to run in a virtual machine you can disable DHCP on your host machine and bridge your network card to your VM.

Improve this answer
3
  • So in other words, you're saying that if I need that level of security, I shouldn't trust my suave, shiny Macbook Pro but should instead have a dedicated machine? :D
    – jmort253
    Sep 26, 2013 at 3:15
  • 2
    A dedicated machine would be great.. even better if it doesn't have a hard drive built in. You could run it on your Mac (non-virtualized) but if you were to pick up malware that infects the hard drive you've lost your anonymity, though not very likely to happen. It really all depends on how important your anonymity is to you. For most cases the VM option should be good enough but for the very paranoid you can always buy a computer with cash, remove hard drive, piggy back wifi, use tails, etc. Based off your needs you need to draw the line somewhere.
    – David
    Sep 26, 2013 at 3:26
  • I think dual boot or live boot would be best without getting a seperate machine. Probably more secure and will definitely run faster then VM.
    – cubecubed
    Jun 18, 2014 at 6:49
3

You could use a virtual machine if you don't have an extra computer for Tails and install Whonix on it. Whonix has a gateway VM which works like a router and a workstation which connects to it. All traffic goes through Tor.

https://www.whonix.org/

Improve this answer
2

Your best bet would probably be to configure the firewall to only allow Tor traffic through. I don't have experience with the firewall in mac or linux but in windows it seems possible. If you can't find firewall setup open Run (Windows Key + R) and type WF.msc.

It seems some things like Internet Explorer aren't in the allow list and are allowed by default, you may or may not be able to block them. Also, you can configure the system wide proxy settings and that should catch most programs (including internet explorer).

You could use something like wireshark to check that it is working. Other option is to have a hardware firewall. I assume this is 10x easier on mac/linux and If someone else knows how to do it on mac/linux I also would like to know.

Remember, if you are really serious about privacy you shouldn't be using windows so this whole answer is probably useless.

Improve this answer
2
  • I use Mac, and have used Linux before. I'm familiar with ufw (on Linux) and ipfw (on Mac OS). +1 as this would work, but maybe a better solution would be to find a way to automate this to minimize the possibility for mistakes.
    – jmort253
    Sep 26, 2013 at 1:12
  • @jmort253, Yes that would be a good idea but i'm not aware or any program that does that, and as David said, either a VM or even better, a livecd linux boot would be good. I use a livecd boot when I am paranoid (for example when I create colde storage bitcoin addresses).
    – Bardi Harborow
    Oct 1, 2013 at 20:28
2

This is very old thread discussed everywhere. The best solution for you, is to read the official FAQ, so called "Wiki".

See here the Tor Project Wiki page on IsolatingProxy.

Take a look, there are two ways:

  • Isolating Proxy
  • Transparent Proxy

The "Transparent Proxy's" way is the oldest one, there are configurations for all type of OS: Windows, Linux, BSD, MacOS, etc. There are many good and precise information for you.

However, this is the wrong way. Part of UDP traffic would leak from the transparent proxy. Once folks have discovered this, has appear the second way, called "Isolating Proxy".

You could find that this just a hardened Transparent Proxy.

See, both, Transparent and Isolated proxies, advice to use separate machine for your Tor box.

This looks like:

Your Network --> Tor-Box(Isolated proxy) --> Internet.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .