Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm setting up a Tor-based isolating proxy using the 'Anonymizing Middlebox' iptables rules specified here: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy


iptables -t nat -A PREROUTING -i $INT_IF -p udp --dport 53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --syn -j REDIRECT --to-ports 9040

...where 9040 is the Tor TransPort. The INPUT, OUTPUT and FORWARD chains are left at the default. Would there be any merit to also including the following rules?

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Or are they rendered unnecessary by my current setup?

Are there any other firewall rules that I should consider in order to improve security and ensure that all traffic is torified?

Many thanks.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.