Block a Tor exit-node list

To block Tor exit nodes in cPFence v4+, use a reviewed address list rather than treating Tor as a country.

Use the reviewed exit-node list and retain it for removal later. Select the image for full size; use browser Back to return.

1. Obtain a current plain-text exit-node list from a source you trust. Check its contents and keep a dated local copy.
2. Open IPDB Firewall & IP Tools → Advanced Tools → Bulk blacklist IPs.
3. Check the sidebar targets, paste the reviewed addresses one per line, and confirm. Use the CLI below for a local file.
4. Read each result and verify current policy. Use Bulk remove blacklisted IPs with the saved list to remove your entries later.

A root administrator can use cpfence --bulk-blacklist-ip /root/tor-exits.txt and cpfence --bulk-del-bl-ip /root/tor-exits.txt on the target server.

Tor is not a two-letter country code

Country controls accept supported two-letter codes; do not enter tor. Exit nodes change frequently, so a stale list provides incomplete coverage. Use custom feed scheduling only with a reviewed source.

Privacy networks include legitimate visitors

Blocking exit nodes also blocks legitimate users of those nodes. Limit the policy to an actual need, and retain alternate administrator access.