What is a list of host/port combinations to get the onion proxy (a.k.a. the Tor client) working securely?

This is about host/port combinations, not simply ports, as already described in the FAQ.

An example would be:

Tor needs to connect to localhost ( at port 9150. And (made up IP-address) to a relay ( at port 9001.

So that for example iptables could be told,

iptables -A OUTPUT -d --dport 9150 -m owner --uid-owner toruser -j ACCEPT
iptables -A OUTPUT -d --dport 9001 -m owner --uid-owner toruser -j ACCEPT
  • 1
    Are you trying to connect to a specific Tor node? If I was a Bad Guy, what's to stop me posting the IP address of a malicious node that I control? Sep 23, 2015 at 11:37
  • @RichardHorrocks That was meant by securely. I rather meant a sufficiently large list of guard nodes, if that is enough. And if you were a bad guy at SO, what would stop you from giving someone code which makes the computer halt and catch fire? ;-) The community hopefully.
    – serv-inc
    Sep 23, 2015 at 11:52
  • 1
    To answer your question, you would need to download the list of hosts and ports that are cached in the tor directory. You will find a list of all available Tor nodes: guards, exits, relays, etc. This file changes every 10 minutes so you'd somehow have to keep your firewall up-to-date when new guards appear on the network. This wouldn't provide any additional security protection as the QUANTUM INSERT or other MITM attack scenario does not change by doing this... but I'm just answering your question.
    – Lizbeth
    Sep 23, 2015 at 13:13
  • @Lizbeth: QUANTUM INSERT or other MITM attacks do not work on hidden services, do they?
    – serv-inc
    Sep 23, 2015 at 13:55
  • the answer is basically no with a variety of caveats that I won't go into.
    – Lizbeth
    Sep 23, 2015 at 23:57

1 Answer 1


How to create a list

You can tell the firewall to log failed connections. For example in Linux

iptables -A OUTPUT -j LOG --log-prefix "OUTPUT: " --log-uid

as the last rule will log all dropped packets (with a DROP policy).

Then, you could block all outgoing connections by all users via (for iptables)

iptables -P OUTPUT DROP

then create port-based files, f.ex. tor-80 containing all tor-connections (by that user) to port 80, and finally do a

for i in $(cat tor-80); do 
    iptables -I OUTPUT 3 -p tcp -d $i --dport 80 -m owner --uid-owner toruser -j ACCEPT; 

for each port-based file (the 3 in above command should be before your logging rule).

As you see more blocked attempts by that user, you can allow further host/port combinations, yet it got the bundle to work several times in a row without alteration on separate days. This stability is to be expected, as the guard nodes should be chosen by availability (among other criteria).

A better approach might be to get a list of all relays as hinted in this SO answer, filtering by guard and directory and adding all of these.

Feel welcome to post if you know how.

  • Useful information about the iptables command - thanks. However, I'm not sure how useful it is to post lists of IP addresses. Without checking each one by cross-referencing with another source, it's difficult for anyone reading this to know how authentic they are. Now it's you who could be the bad guy... :) Also, given how transient certain parts of the Tor network are, these addresses could be out of date by tomorrow. Also, are any of these addresses for Tor bridges? Sep 25, 2015 at 11:22
  • @RichardHorrocks: I did not connect by a bridge and posts its secret ip-address here knowingly. It was a vanilla Tor bundle using the standard "connect" button. Anyways, list is removed from answer. (Maybe you do know how to find such a list via official API, since you wrote the part about the list of relays)
    – serv-inc
    Oct 21, 2015 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.