topic Re: Any trusted EDL of known TOR entry and exit nodes? in General Topics

Any trusted EDL of known TOR entry and exit nodes?

SThatipelly — Tue, 11 May 2021 20:58:04 GMT

I am looking to block TOR IPs inbound and outbound on my perimeter firewalls. Do any of you know of any trusted list of TOR nodes which I can use in EDLs?

Thanks.

Re: Any trusted EDL of known TOR entry and exit nodes?

reaper — Wed, 12 May 2021 13:20:43 GMT

MineMeld has a couple built-in TOR node miners

Re: Any trusted EDL of known TOR entry and exit nodes?

SThatipelly — Wed, 12 May 2021 13:37:18 GMT

@reaper Thanks for your response. do I have to be licensed for Minemeld to get that?

Re: Any trusted EDL of known TOR entry and exit nodes?

reaper — Wed, 12 May 2021 13:39:20 GMT

no, minemeld is completely free and those 'minemeld core team' ones are included for free

you can add subscription servie ones also if you find more

Re: Any trusted EDL of known TOR entry and exit nodes?

OtakarKlier — Thu, 13 May 2021 17:46:43 GMT

Hello,

In addition to using an EDL, I would recommend setting up an Application Filter and a URL filter and applying it to a deny policy as well.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/use-application-objects-in-policy/create-an-application-filter

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXfCAK

Regards,

Re: Any trusted EDL of known TOR entry and exit nodes?

Remo — Sun, 16 May 2021 16:48:32 GMT

Hi @SThatipelly

There are also ressourcws on the internet which you can use as EDL directly on the firewall without minemeld. For example:

https://www.dan.me.uk/torlist/?exit

https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst