Skip to content

Block Tor Exit Routes

First, you can block this traffic via Cloudflare by clicking some buttons. See the following post.
https://community.cloudflare.com/t/tor-traffic-blocking/396979/3

IPTables / Firewall

First make sure you have ipset installed. Essentially a tool to make managing lists of IPs for iptable rules simpler and more performant.

sh
apt-get install ipset
dnf install ipset

Next create a scheduled task (I'll use a cronjob) that will ensure we always have an up to date copy of the exit nodes (they can change overtime)

sh
install -m 744 /dev/null /opt/update-ipset-tor-exitnodes

cat > /opt/update-ipset-tor-exitnodes<< EOF
#!/usr/bin/env sh
echo "create tor hash:ip family inet hashsize 1024 maxelem 65536" > /tmp/tor-exitnodes.txt
curl 'https://check.torproject.org/torbulkexitlist?ip=' | sed 's/^/add tor /' >> /tmp/tor-exitnodes.txt
ipset restore -! < /tmp/tor-exitnodes.txt
EOF

echo "0 0 * * * root /opt/update-ipset-tor-exitnodes" > /etc/cron.d/update-ipset-tor-exitnodes

Finally lets populate our ipset, before we can add our iptables rule to block the set.

sh
/opt/update-ipset-tor-exitnodes
iptables -A INPUT -m set --match-set tor src -j DROP