Ah, interesting, thank you. As far as point (b) goes, it seems to work pretty well: I can’t recall an occasion where I’ve had traffic blocked. (I suppose in practice not many applications use custom IP-but-not-TCP-or-UDP-based protocols.) So could that same thing not be a solution to e12e’s question?
- Configure all applications to use Tor with the SOCKS proxy
- Block all non-Tor traffic with iptables
https://tails.boum.org/contribute/design/Tor_enforcement