Any trusted EDL of known TOR entry and exit nodes?

[SThatipelly]

I am looking to block TOR IPs inbound and outbound on my perimeter firewalls. Do any of you know of any trusted list of TOR nodes which I can use in EDLs?

Thanks. 

[reaper]

MineMeld has a couple built-in TOR node miners

[SThatipelly]

@reaper Thanks for your response. do I have to be licensed for Minemeld to get that?

[reaper]

no, minemeld is completely free and those 'minemeld core team' ones are included for free

you can add subscription servie ones also if you find more

[OtakarKlier]

Hello,

In addition to using an EDL, I would recommend setting up an Application Filter and a URL filter and applying it to a deny policy as well. 

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/use-application-objects-in-policy/...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXfCAK

Regards,

[Remo]

Hi @SThatipelly 

There are also ressourcws on the internet which you can use as EDL directly on the firewall without minemeld. For example:

https://www.dan.me.uk/torlist/?exit

https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst