Blocking Tor Using Smoothwall Filter & Firewall

Summary:

This article describes the steps involved to block the anonymity network Tor.

Problem:

If users can connect to Tor, they can bypass Guardian and therefore have an unfiltered connection. This means that they can browse to websites that would otherwise be blocked. Tor uses a range of different firewall ports. In the past, it has mainly used 80, 443, 9001, 9050 and 9150. However, this has changed in some of the more recent updates.

Solution:

To block Tor, you need to set up both a Firewall rule and a HTTPS Decrypt and Inspect policy:

1. Set up a Firewall rule to block the Tor layer 7 signature, see our help topic, Adding new Smoothwall Firewall rules:
   
   1. Go to Network > Firewall > Firewall rules.
   2. Click Add section, type the Name "Tor" and click Save changes.
   3. Point to your new Tor section, click Add rule, and then click Top of section.
   4. Type the Name "Block Tor".
   5. Enter or select the network interfaces/IP addresses to which you want the rule to apply.
   6. Under Services, add from the list or create any ports Tor may use (some noted above, some research may be required to find the latest ports).
   7. OPTIONAL: Applications, look for "Proxies > Tor", select it and click Add -This requires a licences for Layer 7 Filtering.
   8. From the Action list, select "Drop" and click Save changes.
2. Set up a HTTPS Decrypt and Inspect policy, see our help topic, Creating HTTPS inspection policies.
   Tor also tries to connect over port 80 and 443. This policy stops it from connecting over those ports:
   1. Go to Guardian > HTTPS inspection > Policy Wizard.
   2. Add in the following attributes:
      • Who - Everyone*
      • What - Everything
      • Where - Everywhere*
      • When - Always*
      • Action - Decrypt and Inspect
        * Change as appropriate

When these two rules are applied, Tor can no longer connect.