Tallow - Transparent Tor for Windows
Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks.
Tallow has several applications, including:
- "Tor-ifying" applications there were never designed to use Tor
- Filter circumvention -- if you wish to bypass a local filter and are not so concerned about anonymity
- Better-than-nothing-Tor -- Some Tor may be better than no Tor.
Note that, by itself, Tallow is not designed to be a complete strong anonymity solution. See the warnings below.
Usage
Using the Tallow GUI, simply press the big "Tor" button to start redirecting traffic via the Tor network. Press the button again to stop Tor redirection. Note that your Internet connection may be temporarily interrupted each time you toggle the button.
To test if Tor redirection is working, please visit the following site: https://check.torproject.org.
Technical
Tallow uses the following configuration to connect to the Internet:
+-----------+ +-----------+ +----------+
| PC |------->| TOR |------->| SERVER |
| a.b.c.d |<-------| a.b.c.d |<-------| x.y.z.w |
+-----------+ +-----------+ +----------+
Here (a.b.c.d) represents the local address, and (x.y.z.w) represents a remote server.
Tallow uses WinDivert to intercept all traffic to/from your PC. Tallow handles two main traffic types: DNS traffic and TCP streams.
DNS queries are intercepted and handled by Tallow itself. Instead of finding the real IP address of a domain, Tallow generates a pseudo-random "fake" domain (in the range 44.0.0.0/24) and uses this address in the query response. The fake-IP is also associated with the domain and recorded in a table for later reference. The alternative would be to look up the real IP via the Tor (which supports DNS). However, since Tallow uses SOCKS4a the real IP is not necessary. Handling DNS requests locally is significantly faster.