I used an iptables ruleset based on the sample ruleset from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, Section Linux, Local Redirection Through Tor, to set up Tor as a transparent Proxy.

I thought I had understood that ruleset, but there is one point I simply don't get: That TCP segments are only redirected to the port Tor listens on when the SYN flag is set.

For example I want to visit http://www.example.com. My browser does a DNS request, gets the corresponding IP address and sends a TCP segment to that address, the SYN flag is set.

According to the ruleset, the segment is redirected to the Tor port, so Tor functions as a proxy, routes the IP packet to http://www.example.com and delivers the answer from the website server back to my browser. My browser gets a packet back where the source IP is that from the server and the ACK flag is set in the TCP payload, right?

So my browser sends the next TCP segment where the SYN flag is not set anymore to www.example.com's IP address.

But, there is no corresponding rule in the NAT table because the SYN flag isn't set. So it shouldn't get redirected or get accepted in the output table afterwards.

Nonetheless, everything is working fine. What point am I missing?

2 Answers 2


The rule that takes care of the packets after the first ACK is:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

It essentially means: let all packets that are part of, or related to, an established session go through. All packets from your machine that follow the initial SYN (provided there was a valid reply to that) are part of an established session, so they will pass.
(RELATED is used for protovols like FTP, if you have that module enabled, where a "normal" session can involve more than one TCP session.)

Note that since you've set up DNS redirection to Tor too, and use AutomapHostsOnResolve, the IP address your browser (and other software) will see are not www.example.com's IP address but a virtual address in the range you specified ( This is incorrect, only some suffixes are mapped to that local range (.exit and .onion by default).

  • According to this, visiting a website with my browser typing in the the actual IP address so no DNS request is done shouldnt work, should it? : The initial syn packet would be routed through the Tor network, but the following packets without syn flag wouldnt and iptables should drop them (except iptables would deem the following packages as part of an established connection, but I guess in this case the connection to the website domain would not be torified at all cause no NAT was done for those packets). Nonetheless, it's working, and doing a request with nslookup brings up the real address
    – user18632
    May 11, 2012 at 11:13
  • Re: address mappings: should only happen for certain DNS suffixes by default, so you should see the real addresses for ordinary domains. There is no reason for connections you make with an IP directly not to be mapped. There is no relation (on the "iptables" side of things) between the DNS requests and the TCP connections. From the filtering layer, all TCP connections happen with an IP address. They'll all go through the syn rule, then pass with the established match.
    – Mat
    May 12, 2012 at 7:08

The excerpt below is taken from the beginning of chapter 5, Controlling What To NAT in this guide to NAT from 2002.

      _____                                     _____
     /     \                                   /     \
   PREROUTING -->[Routing ]----------------->POSTROUTING----->
     \D-NAT/     [Decision]                    \S-NAT/
                     |                            ^
                     |                            |
                     --------> Local Process ------

"At each of the points above, when a packet passes we look up what connection it is associated with. If it's a new connection, we look up the corresponding chain in the NAT table to see what to do with it. The answer it gives will apply to all future packets on that connection."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.