# Hardening Tor server
**URL:** https://forum.torproject.org/t/hardening-tor-server/8669
**Category:** Relay Operator
**Tags:** tor
**Created:** [August 7, 2023, 11:53am UTC](https://forum.torproject.org/t/hardening-tor-server/8669 "2023-08-07T11:53:35Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [August 7, 2023, 11:53am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/1 "2023-08-07T11:53:35Z")
Hello,
What firewall (iptables) rules are appropriate for a Tor bridge server?
Thank you.
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [August 12, 2023, 2:39pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/2 "2023-08-12T14:39:42Z")
I’m not sure what “appropriate” means here. What do you want to achieve?
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [August 19, 2023, 7:58pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/3 "2023-08-19T19:58:35Z")
Hello,
Thanks again.
Can you show me an example of Tor bridge firewall rules?
---
### Author:  [@esev](https://forum.torproject.org/u/esev)
#### Post date: [August 21, 2023, 5:18am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/4 "2023-08-21T05:18:25Z")
You can follow this answer: [centos - Iptables rule to allow only one port and block others - Unix & Linux Stack Exchange](https://unix.stackexchange.com/a/119727)
Use your bridge’s ServerTransportListenAddr port where it says `allow your application port`. Remove the SSH and Ping sections if you want.
---
### Author:  [@boldsuck](https://forum.torproject.org/u/boldsuck)
#### Post date: [August 24, 2023, 3:22am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/5 "2023-08-24T03:22:09Z")
For static IP dual stack nft- & iptables examples in my git:
[https://github.com/boldsuck/tor-relay-bootstrap/tree/master/etc](https://github.com/boldsuck/tor-relay-bootstrap/tree/master/etc)
Adjust obfs4 & ORPort.
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [September 5, 2023, 1:16pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/6 "2023-09-05T13:16:07Z")
Hello,
Thank you so much for your reply.
No, you can’t disable `Ping`. If you do this, your Tor server will not work properly. I had this problem.
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [September 5, 2023, 1:16pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/7 "2023-09-05T13:16:15Z")
Hello,
Thank you so much for your reply.
Do you mean [this](https://github.com/boldsuck/tor-relay-bootstrap/blob/master/etc/iptables/rules.v4)?
---
### Author:  [@boldsuck](https://forum.torproject.org/u/boldsuck)
#### Post date: [September 6, 2023, 7:06am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/8 "2023-09-06T07:06:37Z")
Yes, these are the ipv4 tables rules. I forked this from [coldhak](https://github.com/coldhakca/tor-relay-bootstrap/tree/master/etc/iptables) back then and updated it for current Debian distries. For SSH I added commented examples. E.g. rate limit under DDOS or if you have several IPs on the server, only allow SSH on one.
ICMP Ping is rate limited.
I switched all systems to nftables and only allow some IP SSH access.
```auto
table inet filter {
set ssh_whitelist_v4 {
type ipv4_addr
size 65535
flags interval
counter
elements = { my ISP IP subnets }
}
set ssh_whitelist_v6 {
type ipv6_addr
counter
size 65535
flags interval
elements = { my ISP IPv6 subnets }
}
chain input {
# By default, drop all traffic unless it meets a filter
# criteria specified by the rules that follow below.
type filter hook input priority 0; policy drop;
8<
...
>8
# Allow SSH on port 22 but only from whitelist
ip saddr @ssh_whitelist_v4 tcp dport 22 counter accept
ip6 saddr @ssh_whitelist_v6 tcp dport 22 counter accept
}
```
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [September 6, 2023, 1:03pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/9 "2023-09-06T13:03:55Z")
Hello,
Thanks again.
The coldhak used **Fail2ban** service. Your iptables rules seems good and I think the important things are:
1- Leaving the Tor port open for clients to connect
2- Allowing loopback
3- Limiting SSH connections and Ping requests
---
### Author:  [@boldsuck](https://forum.torproject.org/u/boldsuck)
#### Post date: [September 6, 2023, 3:39pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/10 "2023-09-06T15:39:12Z")
> [@hack3rcon](#):
>
> The coldhak used **Fail2ban** service
This is ancient. Fail2ban has been entering the rules itself for years. The rules are otherwise duplicate, so I deleted that.
Btw, in my nft version I threw out fail2ban. On the one hand, I only whitelist some subnets for SSH. On the other hand, I’m starting to hate f2b bc. junior admins configure auto-generated abuse. This makes f2b worse than spam. Some 100/day automated abuse reports from Fail2Ban & x-arf I redirect to /dev/null. ™
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [September 7, 2023, 1:38pm UTC](https://forum.torproject.org/t/hardening-tor-server/8669/11 "2023-09-07T13:38:27Z")
Hello,
Thanks again.
Can you rewrite your new rules from `nftables` to `iptables`?
---
### Author:  [@tor-D](https://forum.torproject.org/u/tor-D)
#### Post date: [September 27, 2023, 7:59am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/12 "2023-09-27T07:59:22Z")
Fail2ban is quite good to block brute force attacks. You can also disable root login and change port.
---
### Author:  [@hack3rcon](https://forum.torproject.org/u/hack3rcon)
#### Post date: [October 23, 2023, 10:47am UTC](https://forum.torproject.org/t/hardening-tor-server/8669/13 "2023-10-23T10:47:50Z")
Hello to all,
Are these `iptables` rules enough for a Tor proxy?
```auto
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9050 -j ACCEPT
-A INPUT -s 172.21.50.0/24 -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 2/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A OUTPUT -o lo -j ACCEPT
```
Thank you.