Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks.

Tallow has several applications, including:

• “Tor-ifying” applications there were never designed to use Tor
• Filter circumvention — if you wish to bypass a local filter and are not so concerned about anonymity
• _ Better-than-nothing-Tor _ — Some Tor may be better than no Tor.

Tallow has several advantages. Firstly, all non-Tor traffic is blocked and prevented from leaving your PC. This stops certain kinds of leaks, such as the DNS leak problem. Secondly, Tallow is transparent. This means that your applications and programs will not be aware that traffic is been diverted via Tor. You can therefore use your preferred web browser, or any other program that connects via the Internet, with zero configuration. But beware! Unlike the TorBrowserBundle , Tallow does not make any attempt to anonymize _ content _ sent though the Tor network. This may include cookies or other information that can identify you. For this reason Tallow is not intended to be a complete strong anonymity solution by itself.

Some uses of Tallow include:

• _ Tor-ifying applications/programs that were never designed to use Tor. _ Since Tallow is _ transparent _ , the application will not be aware that traffic has been diverted via the Tor network.
• _ Filter Circumvention _ . If you just want to circumvent Internet filtering, and do not care so much about strong anonymity, then Tallow may be appropriate.
• _ Better-than-nothing-Tor _ . Even though Tallow by itself is not a strong anonymity solution, some Tor may still be better than no Tor at all.

Technical

Tallow uses the following configuration to connect to the Internet:

+-----------+        +-----------+        +----------+
|    PC     |------->|    TOR    |------->|  SERVER  |
|  a.b.c.d  |<-------|  a.b.c.d  |<-------|  x.y.z.w |
+-----------+        +-----------+        +----------+

Here (a.b.c.d) represents the local address, and (x.y.z.w) represents a remote server.

Tallow uses WinDivert to intercept all traffic to/from your PC. Tallow handles two main traffic types: DNS traffic and TCP streams.

DNS queries are intercepted and handled by Tallow itself. Instead of finding the real IP address of a domain, Tallow generates a pseudo-random “fake” domain (in the range 44.0.0.0/24) and uses this address in the query response. The fake-IP is also associated with the domain and recorded in a table for later reference. The alternative would be to look up the real IP via the Tor (which supports DNS). However, since Tallow uses SOCKS4a the real IP is not necessary. Handling DNS requests locally is significantly faster.

TCP connections are also intercepted. Tallow “reflects” outbound TCP connects into inbound SOCKS4a connects to the Tor program. If the connection is to a fake-IP, Tallow looks up the corresponding domain and uses this for the SOCKS4a connection. Otherwise the connection is blocked (by default) or a SOCKS4 direct connection via Tor is used. Connecting TCP to SOCKS4(a) is possible with a bit of magic (see redirect.c).

All other traffic is simply blocked. This includes all inbound (non-Tor) traffic and outbound traffic that is not TCP nor DNS. In addition, Tallow blocks all domains listed in the hosts.deny file. This includes domains such as Windows update, Windows phone home, and some common ad servers, to help prevent Tor bandwidth wastage. It is possible to edit and customize your hosts.deny file as you see fit.

Note that Tallow does not intercept TCP ports 9001 and 9030 that are used by Tor. As a side-effect, Tallow will not work on any other program that uses these ports.