Dear users,
My configuration:
-I’m on Arch Linux.
-I’m using the iptables rules from the following ArchWiki page without any modifications:
*nat
:PREROUTING ACCEPT [6:2126]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [17:6239]
:POSTROUTING ACCEPT [6:408]
-A PREROUTING ! -i lo -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A PREROUTING ! -i lo -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
-A OUTPUT -o lo -j RETURN
–ipv4 -A OUTPUT -d 192.168.0.0/16 -j RETURN
-A OUTPUT -m owner --uid-owner “tor” -j RETURN
-A OUTPUT -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
-A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports 9040
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
–ipv4 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
–ipv4 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
–ipv4 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
–ipv6 -A INPUT -j REJECT
–ipv4 -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
–ipv4 -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
–ipv6 -A OUTPUT -d ::1/8 -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m owner --uid-owner “tor” -j ACCEPT
–ipv4 -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
–ipv6 -A OUTPUT -j REJECT
COMMIT
These rules enable Transparent Torification on my Linux system by forcing outgoing connections through the TransPort or DNSPort, and blocks anything it cannot torrify.
My interrogation:
The following Tor GitLab page states:
When a transparent proxy is used, it is possible to start a Tor session from the client as well as from the transparent proxy, creating a ‘Tor over Tor’ scenario.
This sentence is a bit confusing to me.
Is this statement true for the Tor Browser in the context of my current Ip-tables configuration? Will the Tor browser be routed twice through the tor network?
If not, how does the Tor Browser make its connection to the internet in this setup?
It’s important to me that the Tor Browser establishes its own separate connection over the Tor network, distinct from the Transparent Torification used by other applications on my system. I want the Tor Browser to make it’s own connection with its own nodes distinctly from the rest of my system when connected to the internet. It shouldn’t be routed twice through the tor network for better security practice.
Please note that I am new to iptables so all help or precision is welcomed :). The purpose of this post is to better understand how the iptables rules are working and affecting my system.
Thanks in advance!
Apo