What is the simplest way to identify and block all non-tor network traffic on GNU/Linux?

I assume the most effective way would be some kind of iptables rule to distinguish between tor and non-tor traffic and block the latter.

(I know that one possibility would be to run the tor binary as a dedicated user, and block the network traffic of all other users, but this wouldn't work for the Tor Browser use case).

Note that I am not talking about automatically tunneling all network traffic through tor.


You are right, this can be achieved by using iptables. This is described in Tor documentation. So, as a root, type:

iptables -F OUTPUT
iptables -A OUTPUT -j ACCEPT -m owner --uid-owner debian-tor
iptables -A OUTPUT -j ACCEPT -o lo #used to allow traffic over the loopback device and is completely safe.
iptables -A OUTPUT -j ACCEPT -p udp --dport 123 #allow outbound NTP connections that are not routed over tor
iptables -P OUTPUT DROP
iptables -L -v

The last command will display the number of packets that have been allowed through per rule or else dropped.

The above will work without any modification for Debian/Ubuntu (username debian-tor). This might be just tor for other non-debian distros.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.