[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: IPTables transparent configuration


Curt Shaffer wrote (17 Nov 2010 12:53:27 GMT) :
> sudo iptables -t nat -A PREROUTING -p tcp -s -j DNAT --to-destination
> sudo iptables -t nat -A PREROUTING -p icmp -s -j DNAT --to-destination
> sudo iptables -t nat -A PREROUTING -p udp -s -j DNAT --to-destination

Tor is able to transport TCP only.
If you really want these LAN boxes to *only* access the Internet over
Tor, you have to forbid them anything other than TCP.

If I am not mistaken, the rules you are showing us allow any UDP
traffic to go out (without Tor) unless its destination port is !=53.
I'm not sure this is really what you want to achieve.

Feel free to have a look to the firewall we use in T(A)ILS as a source
of inspiration:


  intrigeri <intrigeri@xxxxxxxx>
  | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
  | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr-fingerprint.asc
  | Every now and then I get a little bit restless
  | and I dream of something wild.
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxxx with
unsubscribe or-talk    in the body. http://archives.seul.org/or/talk/