5

I don't want any connections coming from a tor network to be accepted by my servers.

1 Answer 1

10

See I want to ban the Tor network from my service from the official Tor documentation.

The Tor project provides a list with IPs of all the exit nodes that can access your service, use query string parameters to tell it the IP and port of your service, example : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8&port=443.

You can then loop through the results, split them each newline, ignore lines starting with "#" and finally adding a -J DROP IPtables action to each one of them or using an IPset which would give you better performance with such a large number of hosts, something like this should do the trick :

ipset -N tor iphash # create a new set named "tor"

# get the list, don't forget to put your service's IP in the query string
curl -s https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8 | sed '/^#/d' | while read IP
do
  # add each IP address to the set, silencing the warnings for IPs that have already been added
  ipset -q -A tor $IP
done

iptables -A INPUT -m set --match-set tor src -j DROP # block any IP in this set in IPtables

(source)

They also provide a DNS based list but it's still in experimental stage so I suggest you stick with the first option, it's also easier to work with.

1
  • Any DNS-based (or hash-based) solution is going to need routine updating. If you're okay with that, then carry on. Otherwise, you need a Layer 7 aware firewall OR, you could hack something together like this bloke: community.spiceworks.com/how_to/show/… Commented Dec 7, 2014 at 2:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .