Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Jason Long
Tor can't connect and show me below error: 12/09/2016 17:41:40.300 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 12/09/2016 17:41:40.300 [NOTICE] Opening Socks listener on 127.0.0.1:9150 12/09/2016 17:41:42.1

[tor-talk] Tor and iptables.

2016-12-11 Thread Jason Long
Hello. I like to close all INPUT connections via iptables but I like to use TorBrowser, Then Which port(s) must be open? -A OUTPUT -p tcp -m tcp --dport 9151 -j ACCEPT Is it enough? How about "INPUT"? Must I open any input port too? Thank you. -- tor-talk mailing list - tor-talk@lists.torproj

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Jonathan Marquardt
You always need to allow some input as well in order for the Tor guard node to talk to your computer. Stateful Inspection is used for this. Here's a complete ruleset to accomplish what you asked for. All output is allowed, but no input, except it belongs to some output your computer previously d

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Jason Long
Excuse me, I must allow input to my system? It is so bad :(, I don't like to allow everyone. On Sunday, December 11, 2016 2:44 AM, Jonathan Marquardt wrote: You always need to allow some input as well in order for the Tor guard node to talk to your computer. Stateful Inspection is used for t

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Jonathan Marquardt
On Sun, Dec 11, 2016 at 12:26:47PM +, Jason Long wrote: > Excuse me, I must allow input to my system? It is so bad :(, I don't like to > allow everyone. This has nothing to do with Tor. It's just the general way how the IP protocol works. Without allowing stateful input, you couldn't do any

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Mirimir
On 12/10/2016 07:16 AM, Jason Long wrote: > Hello. > I like to close all INPUT connections via iptables but I like to use > TorBrowser, Then Which port(s) must be open? > > -A OUTPUT -p tcp -m tcp --dport 9151 -j ACCEPT > > > Is it enough? How about "INPUT"? Must I open any input port too? > >

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Jonathan Marquardt
On Sun, Dec 11, 2016 at 11:33:23PM -0700, Mirimir wrote: > On 12/10/2016 07:16 AM, Jason Long wrote: > > Hello. > > I like to close all INPUT connections via iptables but I like to use > > TorBrowser, Then Which port(s) must be open? > > > > -A OUTPUT -p tcp -m tcp --dport 9151 -j ACCEPT > > > >

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Mirimir
On 12/11/2016 11:44 PM, Jonathan Marquardt wrote: > On Sun, Dec 11, 2016 at 11:33:23PM -0700, Mirimir wrote: >> On 12/10/2016 07:16 AM, Jason Long wrote: >>> Hello. >>> I like to close all INPUT connections via iptables but I like to use >>> TorBrowser, Then Which port(s) must be open? >>> >>> -A

Re: [tor-talk] Tor and iptables.

2016-12-11 Thread Roman Mamedov
On Mon, 12 Dec 2016 00:12:54 -0700 Mirimir wrote: > > Also: "-A OUTPUT -i lo -j ACCEPT" is neither a valid rule, nor is it > > necessary, since loopback traffic is already allowed at input and stateful > > inspection is enabled both ways. > > Not valid? It works for me. And by default, I drop