Filter traffic from and to Tor IP addresses automatically with Mikrotik RouterOS

November 30, 2014

Some newer malware communicates with their command and control servers via the Tor network, in a typical enterprise network no system should connect the Tor network. A other scenario is that you’re providing services which don’t need to be accessed via the Tor network but your servers get attacked from Tor Exit Nodes. In both cases it may be a good defence to filter/log/redirect the traffic on your router. With Mikrotiks RouterOS this is possible. You need also a small Linux/Unix server to help. This server needs to be trustworthy one as the router executes a script this server generates. This is required as RouterOS is only able to parse text files up to 4096 by itself, and the Tor IP address list is longer.

Linux Part

So first we create the script /usr/local/sbin/generateAddTorIPsScript.sh on the Linux server with following content:
#!/bin/sh # the full path of the file we create filename=/var/www/html/addTorIPs.rsc

# remove the comment if you want to use the List of All Current Tor Server IP Addresses #url=http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv # remove the comment if you want to use the List of All Current Tor Server Exit Node IP Addresses #url=http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv

echo "# This scrip adds Tor IP addresses to an address-list (list created: $(date))" > $filename echo "/ip firewall address-list" >> $filename

/usr/bin/wget -q -O - $url | sort -u | /bin/awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=addressListTor dynamic=yes address="$1" " ;}' >> $filename

The filename path works on CentOS, on Ubuntu you need to remove the html directory. Now make the file executable

chmod 755 /usr/local/sbin/generateAddTorIPsScript.sh

and execute it

/usr/local/sbin/generateAddTorIPsScript.sh

No output is good. Make sure that the file is reachable via HTTP (e.g. install httpd on CentOS) from the router. If everything works make sure that the script is called once a day to update the list. e.g. place a symlink in /etc/cron.daily:

ln -s /usr/local/sbin/generateAddTorIPsScript.sh /etc/cron.daily/generateAddTorIPsScript.sh

Mikrotik part

Copy and pasted following to get the script onto the router:

/system script add name=scriptUpdateTorIPs policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="# Script which will download a script which adds the Tor IP addresses to an address-list\ \n# Using a script to add this is required as RouterOS can only parse 4096 byte files, and the list is longer\ \n# Written by Robert Penz <[email protected]> \ \n# Released under GPL version 3\ \n\ \n# get the \"add script\"\ \n/tool fetch url=\"http://10.xxx.xxx.xxx/addTorIPs.rsc\" mode=http\ \n:log info \"Downloaded addTorIPs.rsc\"\ \n\ \n# remove the old entries\ \n/ip firewall address-list remove [/ip firewall address-list find list=addressListTor]\ \n\ \n# import the new entries\ \n/import file-name=addTorIPs.rsc\ \n:log info \"Removed old IP addresses and added new ones\"\ \n"

To make the first try run use following command

/system script run scriptUpdateTorIPs

if you didn’t get an error

/ip firewall address-list print

should show many entries. Now you only need to run the script once a day which following command does:

/system scheduler add interval=1d name=schedulerUpdateTorIPs on-event=scriptUpdateTorIPs start-date=nov/30/2014 start-time=00:05:00

You can use this address list now in various ways .. the simplest is following

/ip firewall filter add chain=forward comment="just the answer packets --> pass" connection-state=established add chain=forward comment="just the answer packets --> pass" connection-state=related add action=reject chain=forward comment="no internal system is allowed to connect to Tor IP addresses" dst-address-list=addressListTor add chain=forward comment="everything from internal is ok --> pass" in-interface=InternalInterface

In HowTo, IT Security, Networking | 2 Comments

2 Comments »

RSS feed for comments on this post. TrackBack URI

[…] network need to access a tor node? Block that on the router or proxy. Sometime ago I’ve written about doing that with a Microtik router. The script can be easily modified or any other router or […]

Pingback by Stop panicking about the Locky ransomware | Robert Penz Blog — February 22, 2016 #
[…] I wrote about blocking, detecting and mitigating the Locky Ransomware. I’ve referenced to a earlier blog post of mine which allows to block traffic to/from the Tor network. This blog post combines both – […]

Pingback by Block Ransomware botnet C&C traffic with a Mikrotik router | Robert Penz Blog — March 14, 2016 #

Filter traffic from and to Tor IP addresses automatically with Mikrotik RouterOS

2 Comments »

Leave a comment