5

I don't want any connections coming from a tor network to be accepted by my servers.

10

See I want to ban the Tor network from my service from the official Tor documentation.

The Tor project provides a list with IPs of all the exit nodes that can access your service, use query string parameters to tell it the IP and port of your service, example : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8&port=443.

You can then loop through the results, split them each newline, ignore lines starting with "#" and finally adding a -J DROP IPtables action to each one of them or using an IPset which would give you better performance with such a large number of hosts, something like this should do the trick :

ipset -N tor iphash # create a new set named "tor"

# get the list, don't forget to put your service's IP in the query string
curl -s https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8 | sed '/^#/d' | while read IP
do
  # add each IP address to the set, silencing the warnings for IPs that have already been added
  ipset -q -A tor $IP
done

iptables -A INPUT -m set --match-set tor src -j DROP # block any IP in this set in IPtables

(source)

They also provide a DNS based list but it's still in experimental stage so I suggest you stick with the first option, it's also easier to work with.

1
  • Any DNS-based (or hash-based) solution is going to need routine updating. If you're okay with that, then carry on. Otherwise, you need a Layer 7 aware firewall OR, you could hack something together like this bloke: community.spiceworks.com/how_to/show/… Dec 7 '14 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.