Tor Browser Proxy Access to Closed Sources

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•8

This rule detects TCP connections originating from the internal network ($HOME_NET) to any external destination on port 9150, specifically looking for the SYN flag in the TCP handshake. Port 9150 is commonly associated with Tor Browser's SOCKS proxy. The rule's message suggests it's intended to identify instances where Tor Browser is being used to access external resources, potentially bypassing organizational policies or security controls.