Re: [tor-relays] need help with running tor in combination with shorewall

To: tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>

Subject: Re: [tor-relays] need help with running tor in combination with shorewall

Date: Thu, 3 Oct 2013 21:06:12 +0100

Delivery-date: Thu, 03 Oct 2013 16:06:26 -0400

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=1tfsm+XYbe0iuqjJOJkLDqd59CIA4Il33SWIwOiLvhQ=; b=hhuR6L2Ixg3u/3/rCLhMYPoFvDZodyDMf4Ha3n8HSCwb6k4RiuHNgWQnwjtZwIOsU8 k6k1REcYef9ETcCCIdtAdvCd5lgHJrQomuUJ04P+Ki9E+gLrSSovVz7YWtPbAPL6Hw9e 9R7jmj10hPV4fqRrknkRbLxO0SFls7Q4wkzkbI6LnjSIRnOZa9AgOWToT1d1p0gc+CyH rtGwIn+r2q307i7rWcbir6cMLY/AwkVnFfsKdPJnVXqLdrWMhYAUpwXj4dvlhxuvD4yy sPmcm63xVV6D3QXVtcHnvYHlEANxYMttgT9qW1dNKf7enL+6ZL8KtxrgWZDQlqp9LKPS sjrA==

In-reply-to: <CAKqc3T72=rA8mvAMwrXcbKN-j1v_4M8QGuDPgdv0ZodB_LgpmQ@xxxxxxxxxxxxxx>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays $exit, non-exit, bridge$" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <20131002193404.GA15882@localhost> <CAKqc3T72=rA8mvAMwrXcbKN-j1v_4M8QGuDPgdv0ZodB_LgpmQ@xxxxxxxxxxxxxx>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

Sorry, also your /etc/shorewall/policy file should read:

net all DROP notice

# The FOLLOWING POLICY MUST BE LAST

all all REJECT notice

to allow for whitelisting in rules file.

Regards,

On 3 October 2013 21:03, Thomas Hand <th6045@xxxxxxxxx> wrote:

Hi Jan,

Here is an example config for shorewall, pulled it straight off a relay I run.

# PORT PORT(S) DEST LIMIT GROUP

SECTION NEW

# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..

#Ping(ACCEPT) net $FW
Ping(DROP) net $FW

ACCEPT net $FW tcp 9001 #tor
ACCEPT net $FW tcp 9030 #tor-dir
#ACCEPT net $FW tcp 22 #ssh/dropbear

ACCEPT net $FW tcp 80 #apache
#ACCEPT net $FW tcp 443 #ssl apache

# Permit all ICMP traffic FROM the firewall TO the net zone

ACCEPT $FW net icmp

Paste that into your /etc/shorewall/rules file, uncomment lines as needed and then 'service shorewall restart'

Regards
T

On 2 October 2013 20:34, Jan Hendrik den Besten <tor@xxxxxxxxxxxxx> wrote:

Hi,

I installed tor a few days ago. It only runs fine if I stop my shorewall
firewall. I found here some online help:

https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ

However, the shorewall-rules example given there doesn't work. It's
mentioned the example is for shorewall v2.2.3 whereas the current version
is v4.5.16.1.

Does anyone have a latest exmple of the /etc/shorewall/rules file?

thanks, Jan Hendrik
--
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays