I don't want any connections coming from a tor network to be accepted by my servers.
See I want to ban the Tor network from my service from the official Tor documentation.
The Tor project provides a list with IPs of all the exit nodes that can access your service, use query string parameters to tell it the IP and port of your service, example : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=18.104.22.168&port=443.
You can then loop through the results, split them each newline, ignore lines starting with "#" and finally adding a
-J DROP IPtables action to each one of them or using an IPset which would give you better performance with such a large number of hosts, something like this should do the trick :
ipset -N tor iphash # create a new set named "tor" # get the list, don't forget to put your service's IP in the query string curl -s https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=22.214.171.124 | sed '/^#/d' | while read IP do # add each IP address to the set, silencing the warnings for IPs that have already been added ipset -q -A tor $IP done iptables -A INPUT -m set --match-set tor src -j DROP # block any IP in this set in IPtables
They also provide a DNS based list but it's still in experimental stage so I suggest you stick with the first option, it's also easier to work with.