How to block all non-tor network traffic on GNU/Linux?

Question

What is the simplest way to identify and block all non-tor network traffic on GNU/Linux?

I assume the most effective way would be some kind of iptables rule to distinguish between tor and non-tor traffic and block the latter.

(I know that one possibility would be to run the tor binary as a dedicated user, and block the network traffic of all other users, but this wouldn't work for the Tor Browser use case).

Note that I am not talking about automatically tunneling all network traffic through tor.

Answer 1

You are right, this can be achieved by using iptables. This is described in Tor documentation. So, as a root, type:

iptables -F OUTPUT
iptables -A OUTPUT -j ACCEPT -m owner --uid-owner debian-tor
iptables -A OUTPUT -j ACCEPT -o lo #used to allow traffic over the loopback device and is completely safe.
iptables -A OUTPUT -j ACCEPT -p udp --dport 123 #allow outbound NTP connections that are not routed over tor
iptables -P OUTPUT DROP
iptables -L -v

The last command will display the number of packets that have been allowed through per rule or else dropped.

The above will work without any modification for Debian/Ubuntu (username debian-tor). This might be just tor for other non-debian distros.