How to block Tor on your network
Tor wraps traffic in several layers of encryption and routes it through volunteer relays, so your filter only sees an encrypted connection to a relay. Blocking it takes more than one rule.
This guide is for IT admins, MSPs, school IT teams and filtering vendors who need Tor off their managed networks.
- Block Tor download sites and mirrors with the VPN / Proxy / Anonymizers category.
- Import the published list of public Tor relays into your firewall as an auto updating address list.
- Enable your firewall's Tor application signature.
- Stop Tor Browser running on managed devices with app control or MDM.
- Alert on repeated attempts rather than relying on silent blocks.
Policy firstWhy organisations block Tor, and why some do not
Tor has real legitimate uses, so it is worth writing down why your network blocks it. A clear reason makes exceptions easier to handle and the rule easier to defend.
Common reasons to block
- Tor traffic bypasses web filtering, so school and library CIPA filters can no longer do their job for minors.
- Security tools lose sight of destinations, which hides malware callbacks and data leaving the network.
- Some ransomware and data theft tools use Tor to reach their operators.
- Users can reach onion services that host illegal markets, malware and stolen data.
- Audit and regulatory duties require knowing what users accessed from company systems.
- Acceptable use policies usually ban tools designed to evade monitoring.
When a controlled exception makes sense
- Threat intelligence teams who research criminal forums and leak sites.
- Journalists and researchers protecting sources, in media organisations.
- Universities teaching network privacy or running Tor research projects.
- Human rights and legal teams supporting people in censored regions.
- In each case, use a separate isolated network segment or dedicated device, not the main network.
Know the pathHow a Tor connection starts, and where you can step in
Each stage below is a chance to stop Tor. The earlier stages are more reliable because they rely on names and known addresses rather than traffic patterns.
The user looks for Tor Browser
They search, then visit torproject.org or a mirror, an app store listing or a software download site.
Step in: category block on download and mirror domainsThe installer is downloaded and run
Tor Browser can run from a user folder without admin rights, and portable copies circulate on USB drives.
Step in: application allowlisting on managed devicesThe browser fetches the network directory
It contacts directory authorities or cached directory relays to learn which relays exist.
Step in: relay address list and Tor application signatureIt builds a circuit through three relays
The first hop is a guard relay or, if configured, an unlisted bridge. The connection is encrypted TLS.
Step in: relay list blocks guards; bridges need device controlsTraffic flows to websites or onion services
From this point your network sees only a long lived encrypted session to one relay address.
Step in: alerting and session analysis, too late to filter contentChoose your stanceBlock, detect or isolate? A quick decision by network type
K-12 schools
Block on all student networks and devices. Tor defeats the technology protection measure that CIPA requires. See our page on K-12 school web filtering.
Businesses
Block, and send repeated attempts to the security team. A user persistently trying Tor is worth a conversation.
MSP tenants
Make the block part of the baseline policy. Let tenants request an isolated exception for named research devices.
Public and guest Wi-Fi
Block relays and download sites to protect your network reputation. Accept that unmanaged devices limit what you can do.
Universities and research
Keep the main campus blocked, and route approved research devices through a segment with its own logging.
The control ladderSeven controls to block Tor, from easiest to strongest
Work down the ladder. Each control catches cases the one above misses, and together they leave very little room.
Block Tor download sites
Block torproject.org and its download mirrors. A VPN / Proxy / Anonymizers category also catches mirrors on unfamiliar domains that a manual list would miss.
Block encrypted DNS bypass
Stop browsers using their own DNS over HTTPS, so your DNS layer sees download and mirror lookups. Disable DoH by policy and block known DoH resolvers.
Import the public relay list
The Tor network publishes the addresses of its public relays. Load that list into your firewall as an external dynamic address list and block outbound connections to it.
Enable the Tor application signature
Most next generation firewalls can recognise standard Tor handshakes. Turn it on in the outbound application control policy and log the hits.
Block Tor Browser on devices
Use app control to prevent the Tor Browser executable from running, including portable copies. On phones, keep Tor apps out of the managed catalogue.
Remove the escape routes
Block personal VPN apps, web proxies and remote access tools that users try after Tor fails. A user who gives up on Tor often tries a VPN next.
Alert and follow up
Send Tor signature hits and relay list matches to your security team or SIEM. Treat repeated attempts as a conduct or security issue, not a filtering issue.
For the other escape routes see our guides to blocking VPN apps and blocking proxy sites.
The hard partBridges and pluggable transports: what admins need to know
Tor was built to work in countries that censor the internet, so it has tools to get past network blocks. On your network those same tools are the main bypass risk. The answer is mostly at the device, not the wire.
Bridges
Bridges are Tor entry relays that are not in the public list, so a relay address block does not include them. Users obtain bridge details through several channels designed to resist blocking.
Admin view: you cannot list every bridge. Stop Tor Browser from running on managed devices, and watch for long lived sessions to unknown addresses.
obfs4
obfs4 makes the connection look like random data instead of a recognisable Tor handshake, and resists scanning for bridges.
Admin view: some firewalls flag high entropy traffic to unknown hosts, with false positives. Device controls remain the dependable layer.
Snowflake
Snowflake routes through short lived volunteer proxies and uses the same technology as browser video calls, so it resembles a call.
Admin view: it needs to reach a broker service first. Category blocking of anonymizer infrastructure helps, and blocking Tor Browser on devices closes it.
meek
meek makes Tor traffic look like a connection to a large cloud provider's website, which you would not want to block outright.
Admin view: this is the clearest case where network rules alone fall short. Rely on app control and endpoint agents.
WebTunnel
WebTunnel disguises Tor as ordinary HTTPS browsing to an ordinary looking website.
Admin view: the host names behind WebTunnel bridges are often new or low reputation sites. A policy on newly registered domains and uncategorised sites reduces the risk.
By platformWhere to set each Tor block
| Platform | What to configure | What it covers | What it misses |
|---|---|---|---|
| Router | Point DHCP at a filtering DNS resolver, block outbound DNS to others, add the relay list if the router supports address lists | Downloads, mirrors, public relays on capable routers | Bridges, disguised transports, portable copies |
| Firewall (any vendor) | Anonymizer URL category, Tor application signature, relay address list, DoH resolver blocks | Most standard Tor use, downloads, mirrors | Well configured bridges with pluggable transports |
| DNS filter | Block VPN / Proxy / Anonymizers, block DoH and the Firefox canary domain | Download and mirror sites, onion web gateways | Direct IP connections to relays |
| Microsoft Intune | App control policy (WDAC or AppLocker) that blocks the Tor Browser executable and unsigned portable apps | Running Tor on managed Windows | Personal devices on the network |
| Microsoft Defender for Endpoint | Network protection in block mode, custom indicators for Tor domains and known relay addresses | Web access across all browsers on onboarded devices | Unmanaged devices |
| Google Admin console | URL blocklist for Tor sites, block side loading and unapproved apps on ChromeOS and Android, disable DoH or fix the resolver | Managed Chromebooks and Android | Unmanaged phones on guest networks |
| MDM for iOS and Android | Approved app catalogue only, block VPN configuration changes, push your DNS profile | Tor apps on managed phones and tablets | Unmanaged and personal phones |
Vendors building these controls into products can read our overview of what URL filtering is and how categories feed policy engines.
Often overlookedOnion links opened in a normal browser
Users do not always need Tor Browser to reach onion services. Web gateways can fetch an onion site and show it inside a normal browser tab, which looks like ordinary web traffic to your firewall.
These gateways behave like web proxies, and we categorise them that way. Blocking the anonymizer category in your DNS filter or web filter closes this path without any Tor specific rule.
Checklist for onion gateways
- Block VPN / Proxy / Anonymizers on every user policy.
- Also block malware and phishing categories, since some gateways inject ads or scripts.
- Treat uncategorised domains with long unusual hostnames as suspicious.
- Review DNS logs for names containing "onion" that resolve on the public internet.
People, not just packetsPolicy wording and what to tell users
A Tor block works best when users know it exists and why. Clear wording also protects the IT team when a block is challenged.
Name the tool class
Ban "tools designed to hide or anonymise network traffic, including Tor, personal VPNs and web proxies". That covers future tools too.
Explain the reason
Show the category name and a contact for exception requests. Users who see a reason rarely escalate.
Make them formal
Require a named owner, a business reason, an isolated device and an end date. Review every exception twice a year.
Talk before you sanction
Most repeated attempts come from curiosity or a blocked work task. A short conversation often reveals a site that should be allowed.
Prove it worksHow to test your Tor block
Use a dedicated test device on each segment, and keep a log like the one below. Re-run it after firmware updates and every quarter. Keep the unmanaged test laptop off the production network when it is not being used for tests.
| Test | How to run it | Expected result |
|---|---|---|
| Download site | Browse to the Tor Project download page from a user device | Block page with the anonymizer category |
| Category check | Look up the Tor Project and a mirror in our domain lookup tool | VPN / Proxy / Anonymizers listed |
| Installer run | On a managed Windows test device, try to run a copy of Tor Browser from the downloads folder | App control refuses to launch it |
| Direct connect | On an isolated unmanaged test laptop with Tor Browser, press Connect with default settings | Connection fails; firewall logs a Tor signature or relay list hit |
| Bridge mode | On the same test laptop, choose a built in bridge option | May connect; confirm an alert fires and rely on device controls |
| Onion gateway | Open a known onion web gateway in a normal browser | Block page |
| Phone | On a managed phone, search the app store for Tor apps | Not available or install refused |
| Alerting | Check that the security team or SIEM received the test events | Events visible with device and user |
Stay currentCategory-based blocking with our database
Tor mirrors, onion gateways and anonymizer services appear on new domains all the time. A category database keeps the name based layer current without anyone maintaining a list by hand.
One category, many services
Our VPN and proxy category groups Tor sites with VPN providers, web proxies and gateways, so a single setting covers the whole family.
New domains every day
About 300,000 newly registered domains are categorized each day and checked again after a week and a month, because many sites add content after launch.
Runs in your systems
Files in CSV, Parquet or JSON load into firewalls, DNS filters and gateways on-premise or air-gapped. A lookup API is included with licences.
Ready to use formats
Licensed customers can export DNS RPZ, hosts files, firewall external dynamic lists and PAC files. See our guide to blocklist formats.
Maps to your firewall
Built for vendors and MSPs
Internal use, OEM and group-wide licences. Read about OEM licensing if you embed data in a product.
AnswersTor blocking FAQ
Does blocking torproject.org stop Tor?
It stops the easiest download route, nothing more. Copies of Tor Browser circulate on mirrors, app stores and file sharing sites, and a browser that is already installed connects to relays directly. Block relay addresses and control software on devices as well.
Can I block Tor by IP address?
Partly. The list of public Tor relays is published, and many firewalls can import it as a dynamic address list that refreshes automatically. Bridges are deliberately unlisted, so an IP list alone will not stop a user who configures a bridge.
What are Tor bridges and pluggable transports?
Bridges are unlisted entry relays. Pluggable transports such as obfs4, Snowflake, meek and WebTunnel disguise the connection so it looks like other kinds of traffic. They exist to help people in censored countries, and on a managed network the reliable answer is stopping Tor Browser from running.
Should a business block Tor completely?
Most businesses, schools and public networks block it, because it hides traffic from security and filtering tools. Teams with a real need, such as threat researchers or journalists, are better served by a separate, isolated network segment with its own policy.
Does Tor show up in DNS logs?
Tor Browser itself connects to relays by IP address, so a normal Tor session creates few DNS lookups. Downloads, update checks and some bridge methods do use names, which is why a DNS category block still helps.
Which category covers Tor sites?
In our database Tor project sites, Tor download mirrors and web gateways that open onion services in a normal browser fall under VPN / Proxy / Anonymizers.
Give your filter current anonymizer coverage
120 million categorized domains in 59 categories, daily delta files for new domains and a lookup API, all running in your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Talk to usTor and Tor Browser are trademarks of The Tor Project, Inc. Microsoft, Windows, Intune and Defender are trademarks of Microsoft Corporation. Google, ChromeOS and Android are trademarks of Google LLC. Firefox is a trademark of the Mozilla Foundation. These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these organisations.