How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?

  • 2
    You can't do that. If you routed all connections through Tor, that would mean you would also be routing Tor connections through Tor. That would cause your configuration to implode with infinite encapsulation. – David Schwartz Jul 11 '12 at 5:46
  • 1
    Ultimately, I would recommend that you use things like tor browser bundle where it's designed to work with it. – ewanm89 Jul 11 '12 at 11:44

You should be able to to that with the Windows Firewall "with advanced functionality" (something like that), as this firewall knows about local processes: you can make per-program rules (a "program" here is actually just a file name, as for example C:\Window\explorer.exe).

So you should be able to:

  1. block all outgoing packets (for all protocols, not just TCP or UDP)
  2. allow everything only for the Tor program, defined by its file name (often C:\Program Files\Vidalia Bundle\Tor\tor.exe). For a working Tor relay, you must allow both outgoing (active open) and incoming (passive open) TCP connexions.
  3. A Tor exit node needs to do DNS resolution. You might need to unblock the Windows DNS resolver if it is a standalone process - or is the resolution done by each program?


  • I have not tested this configuration.
  • Before changing any firewall rule, make sure you understand Windows firewall UI and what the rule means.
  • Before making a block all rule, make sure you know how to reset the firewall to normal state (without turning it off, unless it is usually off).
  • With Windows you can have different "profiles" with different firewall configurations. Make sure Windows 7 does not automatically change active profile without user confirmation (as Windows Vista sometimes does).
| improve this answer | |
  • Can you provide more information about how to do this please. Thank you. – Para Aug 22 '12 at 8:39
  • Note that Vidalia has been deprecated for a long time now, so the file path will have changed. – forest Mar 3 '18 at 0:16

When creating Windows 7 firewall rules for Tor, creating rules for the unzip'd Tor software on your desktop may not work.

This is because the Windows firewall doesn't work well with pathnames such as "%APPDATA%", etc, that end up in the pathname for rules when allowing the tor.exe client.

So if you've got Tor unzip'd on your desktop and "any any" rules for it aren't working in your Windows 7 firewall ruleset, try putting Tor in "C:\Program Files (x86)" instead and adjust firewall rules accordingly.

| improve this answer | |

You cannot guarantee that all connections will route through Tor, no matter what operating system you are using. Tor cannot route UDP traffic and is only able to route TCP traffic.

For your TCP traffic you can simply follow the Documentation on the Tor Project Website

| improve this answer | |
  • Does Tor not support UDP due to technical limitations or just to prevent people abusing by using it for DDOS with UDP packets? – Dracs Jul 11 '12 at 7:43
  • @Dracs Both, there are many other difficult issues. See the FAQ: You should transport all IP packets, not just TCP packets. notably answer e: "Exit policies for arbitrary IP packets mean building a secure IDS. () Many potential abuse issues are resolved by the fact that Tor only transports valid TCP streams (as opposed to arbitrary IP including malformed packets and IP floods)," So this is really really difficult. – curiousguy Jul 13 '12 at 3:13
  • Perhaps this was true in 2012 but it's wrong in 2016. Investigate TAILS. – Carey Gregory May 24 '16 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.