Arch Linux

Archeryus

Member

Registered: 2012-03-11

Posts: 7

Rules of Vidalia for Iptables

Hello all,

I have some problems with Tor/Vidalia and Iptables, I want to use Vidalia as a proxy for Firefox with foxyProxy, but if i don't disable Iptables, that's don't work and i get a infinite loop message "Failed to find node for hop 0 of our path. Discarding this circuit."

Here is the torrc

ControlPort 9051
DataDirectory /home/archeryus/.tor
DirReqStatistics 0
EntryNodes removed_for_security_or_not
ExitNodes removed_for_security_or_not
Log notice stdout
ReachableAddresses *:80,*:443
ReachableAddresses reject *:*
StrictNodes 1

So the proxy for proxyfoxy is 127.0.0.1:9050

Here is the Iptables

# Generated by iptables-save v1.4.19.1 on Fri Jun 21 16:43:57 2013
*filter
:INPUT DROP [59:3304]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m multiport --sports 80,443,8000 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 212.27.38.253/32 -p tcp -m tcp --sport 554 -j ACCEPT
-A INPUT -s 212.27.38.253/32 -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -s 212.27.38.253/32 -p udp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443,8000 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -d 212.27.38.253/32 -p tcp -m tcp --dport 554 -j ACCEPT
-A OUTPUT -d 212.27.38.253/32 -p udp -j ACCEPT
COMMIT
# Completed on Fri Jun 21 16:43:57 2013
# Generated by iptables-save v1.4.19.1 on Fri Jun 21 16:43:57 2013
*nat
:PREROUTING ACCEPT [90:5040]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [59:3656]
:POSTROUTING ACCEPT [53:3260]
COMMIT
# Completed on Fri Jun 21 16:43:57 2013

The local loop entry/out seem's to be allowed, the ports that i have specified to tor too (80,443), but that.. just don't work. It's probably sure that's a iptables rules problems because if i do a "systemctl stop iptables", it's work good..

Thanks in advance !

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: Rules of Vidalia for Iptables

I just did the following:
1. pacman -S tor (no configuration)
2. systemctl start tor
3. set the socks5 proxy (only this one!) in firefox to localhost:9050
4. reload my iptables with your above rules
And now I write this over the tor network. So your rules do work (not commenting on them plus - I have not checked, but you might want to xx the IPs in your rules)  Just give it a try without that foxyproxy addon or make sure it is not specifying a http proxy.