What is a list of host/port combinations to get the onion proxy (a.k.a. the Tor client) working securely?
This is about host/port combinations, not simply ports, as already described in the FAQ.
An example would be:
Tor needs to connect to localhost (127.0.0.1) at port 9150. And (made up IP-address) to a relay (220.127.116.11) at port 9001.
So that for example
iptables could be told,
iptables -A OUTPUT -d 127.0.0.1 --dport 9150 -m owner --uid-owner toruser -j ACCEPT iptables -A OUTPUT -d 18.104.22.168 --dport 9001 -m owner --uid-owner toruser -j ACCEPT