Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do you think Tor should be run over IPsec, or IPsec over Tor? Please be specific as of why you made this decision.


migration rejected from Oct 23 '14 at 2:06

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by Matthew Williams, music2myear, Nifle, Hennes, Mike Fitzpatrick Oct 23 '14 at 2:06

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

You obviously have no idea what is IPSEC. – geek May 9 '10 at 12:54

As Tor runs in an upper layer, I can't see how IPsec could be run on it.


As far as I understand from the Tor page: my first question is what is the relation between Tor and IPSEC?

Secondly, Tor is just for instead of taking a direct route from source to destination, data packets on the Tor network take a random pathway through several relays that cover your tracks so no observer at any single point can tell where the data came from or where it's going.

It also states that to create a private network pathway with Tor, the user's software or client incrementally builds a circuit of encrypted connections through relays on the network.

When I look in this perspective, Tor is just changing the IP addresses from source to destination and IP address as you may know are in the network layer, so IPSEC is in-between the datalink layer and network layer.

enter image description here

Tor works on the transport layer - TCP, not IP. It doesn't just "change the IP addresses". – grawity May 9 '10 at 18:15
Tor encrypts traffic during transport, but it is decrypted at the exit node before the exit node forwards it to its intended destination. The exit node can eavesdrop on the traffic unless the traffic itself is an encrypted protocol such as SSL. Tor does NOT substitute for encrypted transports! – LawrenceC Jul 30 '11 at 3:09

They work in different osi layers, one works in transport layer(Tor), and the other in Ip layer(ipsec), so it depends what you need:

  1. If you want anonymous http or other application layer protocol then use TOR, but TOR won't encrypt that application layer protocol after it leaves the last TOR node/proxy, you need to use them over SSL (https,ftps,sftp,ssh,...)

  2. If you need to encrypt all communications at a lower layer, then use IPSEC, it will encrypt all communications, but you won't be able to anonymize your origin. To anonymize your origin you will need to establish IPSEC tunnels in every node/proxy you use, for example nodes that has been hacked or that let you use IPSEC on them.

Real example: You can't do a port scanning or use other fingerprinting tools such as nessus through TOR because the results won't be accurate because they send lots of malformed TCP packets that simply don't work through proxysocks (port forwarding), but you can use TOR for ssh-tunneling.


I guess that you can run IPsec over IP over HTTP over TOR. If you really want.

The hack is IP over HTTP. There seems to be e.g.

I have not tried.