Smart Firewall blocks Tor Browser from launching

[Napoleon]

Since around mid-September, Tor Browser 13.5.22 has been blocked from launching and running. Only disabling Smart Firewall allows it to run.

Product & version number: Norton VPN Ultimate 25.9.10453 (build 25.9.10453.0)

OS details: Windows 7 Ultimate (x64)

2025-10-01 08:32:26.120 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-01 08:32:26.216 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-01 08:32:26.216 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150

2025-10-01 07:45:40.436 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-01 07:45:40.557 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-01 07:45:40.557 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-10-01 07:45:56.937 [NOTICE] Bootstrapped 5% (conn): Connecting to a relay
2025-10-01 07:46:06.926 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:46:06.926 [NOTICE] Our circuit 0 (id: 60) died due to an invalid selected path, purpose General-purpose client. This may be a torrc configuration issue, or a bug.
2025-10-01 07:46:51.439 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:47:44.277 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:48:32.835 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:49:22.666 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:50:16.322 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:51:06.020 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:51:55.791 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:52:47.443 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:53:55.946 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.
2025-10-01 07:54:29.335 [NOTICE] Failed to find node for hop #1 of our path. Discarding this circuit.

[SoulAsylum]

What does your Norton history indicate? Are you using the standalone VPN or N360 included VPN? Hopefully both are not installed, if so remove one or the other and retest.

SA

[Napoleon]

I have a standalone and Tor Browser itself is blocked by the authorities. So I have to use a VPN, Psiphon, obfs4, and now Socks5 to bypass the firewall. It was still working at the beginning of September, but a week later I noticed problems. The torrc file says:

ExcludeExitNodes {ru},{ua},{by},{kz},{kg},{uz},{ch},{su},{??}
ExcludeNodes {ru},{ua},{by},{kz},{kg},{uz},{ch},{su},{??}

[SoulAsylum]

Thanks. Again, are there entries in your Norton history regarding Tor blocking? If so could you share a screenshot for us to review? TIA.

SA

[Napoleon]

Norton VPN Ultimate has no history, and tor.exe and lyrebird.exe are set to Allow in Smart Firewall.
The Tor Browser is DPI-blocked in my country.

[Napoleon]

Below are logs of what happens immediately after disabling the Smart Firewall, when the Tor Browser is running and frozen.

2025-10-09 23:27:22.533 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-09 23:27:22.569 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-09 23:27:22.569 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-10-09 23:27:25.867 [NOTICE] Bootstrapped 5% (conn): Connecting to a relay
2025-10-09 23:27:48.433 [NOTICE] Application request when we haven’t used client functionality lately. Optimistically trying directory fetches again.
2025-10-09 23:34:21.018 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150
2025-10-09 23:34:21.018 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-09 23:34:21.614 [NOTICE] Delaying directory fetches: DisableNetwork is set.
2025-10-09 23:34:21.900 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-09 23:34:21.900 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150

2025-10-09 23:27:22.533 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-09 23:27:22.569 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-09 23:27:22.569 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-10-09 23:27:25.867 [NOTICE] Bootstrapped 5% (conn): Connecting to a relay
2025-10-09 23:27:48.433 [NOTICE] Application request when we haven’t used client functionality lately. Optimistically trying directory fetches again.
2025-10-09 23:34:21.018 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150
2025-10-09 23:34:21.018 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-10-09 23:34:21.614 [NOTICE] Delaying directory fetches: DisableNetwork is set.
2025-10-09 23:34:21.900 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-10-09 23:34:21.900 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-10-09 23:34:34.812 [NOTICE] Application request when we haven’t used client functionality lately. Optimistically trying directory fetches again.
2025-10-09 23:34:36.032 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay
2025-10-09 23:34:36.104 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay
2025-10-09 23:34:36.299 [NOTICE] Bootstrapped 15% (handshake_done): Handshake with a relay done
2025-10-09 23:34:36.300 [NOTICE] Bootstrapped 20% (onehop_create): Establishing an encrypted directory connection
2025-10-09 23:34:36.366 [NOTICE] Bootstrapped 25% (requesting_status): Asking for networkstatus consensus
2025-10-09 23:34:36.446 [NOTICE] Bootstrapped 30% (loading_status): Loading networkstatus consensus
2025-10-09 23:34:41.194 [NOTICE] Bootstrapped 45% (requesting_descriptors): Asking for relay descriptors
2025-10-09 23:34:41.195 [NOTICE] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 5796/9169, and can only build 23% of likely paths. (We have 63% of guards bw, 62% of midpoint bw, and 58% of exit bw = 23% of path bw.)
2025-10-09 23:34:41.604 [NOTICE] Bootstrapped 59% (loading_descriptors): Loading relay descriptors
2025-10-09 23:34:43.671 [NOTICE] Bootstrapped 65% (loading_descriptors): Loading relay descriptors
2025-10-09 23:34:45.801 [NOTICE] Bootstrapped 72% (loading_descriptors): Loading relay descriptors
2025-10-09 23:34:46.171 [NOTICE] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
2025-10-09 23:34:46.857 [NOTICE] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
2025-10-09 23:34:46.857 [NOTICE] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
2025-10-09 23:34:47.449 [NOTICE] Bootstrapped 100% (done): Done

[Napoleon]

Smart Firewall blocks launch Tor Browser (and other portable software) if Cyrillic characters are present in the paths.

@Napoleon

I think I’ve determined that the problem launching portable software (Speedtest and Tor Browser) is caused by Cyrillic characters in the paths. If I create a folder named тест on the D drive and place the portable program there, Smart Firewall blocks Speedtest from launching. However, if I rename this folder to test, the problem immediately disappears.

D:\тест\Tor Browser — launch is blocked

2025-11-04 23:50:39.366 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-11-04 23:50:39.366 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip.
2025-11-04 23:50:39.367 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:39.368 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6.
2025-11-04 23:50:39.369 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:39.594 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-11-04 23:50:39.594 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-11-04 23:50:39.595 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip.
2025-11-04 23:50:39.595 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:39.595 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6.
2025-11-04 23:50:39.595 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:44.908 [NOTICE] Bootstrapped 5% (conn): Connecting to a relay
2025-11-04 23:50:48.585 [WARN] Problem bootstrapping. Stuck at 5% (conn): Connecting to a relay. (Permission denied [WSAEACCES ]; RESOURCELIMIT; count 10; recommendation warn; host 2955D8C86F5848FD3469E3F38A027D3E169359D8 at 138.201.225.177:9100)
2025-11-04 23:50:48.586 [WARN] 9 connections have failed:
2025-11-04 23:50:48.586 [WARN] 9 connections died in state connect()ing with SSL state (No SSL object)
2025-11-04 23:50:48.600 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150
2025-11-04 23:50:48.600 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-11-04 23:50:48.605 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip.
2025-11-04 23:50:48.606 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:48.606 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6.
2025-11-04 23:50:48.606 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:50:49.379 [NOTICE] Delaying directory fetches: DisableNetwork is set.

D:\test\Tor Browser — successful launch

2025-11-04 23:56:44.368 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-11-04 23:56:44.368 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip.
2025-11-04 23:56:44.369 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:56:44.369 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6.
2025-11-04 23:56:44.370 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:56:44.477 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2025-11-04 23:56:44.477 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2025-11-04 23:56:44.477 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip.
2025-11-04 23:56:44.477 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:56:44.477 [WARN] Failed to open GEOIP file D:\ÏÎ\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6.
2025-11-04 23:56:44.478 [WARN] We’ve been configured to use (or avoid) nodes in certain countries, and we need GEOIP information to figure out which ones they are.
2025-11-04 23:56:45.696 [NOTICE] Bootstrapped 5% (conn): Connecting to a relay
2025-11-04 23:56:45.699 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay
2025-11-04 23:56:46.083 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay
2025-11-04 23:56:48.576 [NOTICE] Bootstrapped 15% (handshake_done): Handshake with a relay done
2025-11-04 23:56:48.577 [NOTICE] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
2025-11-04 23:56:48.578 [NOTICE] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
2025-11-04 23:56:48.579 [NOTICE] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
2025-11-04 23:56:53.558 [NOTICE] Guard AnotherTorNode0602 ($91EE3488AB5271FA998BCE851D01A2608FAC0E61) is failing more circuits than usual. Most likely this means the Tor network is overloaded. Success counts are 153/262. Use counts are 41/63. 257 circuits completed, 86 were unusable, 19 collapsed, and 1 timed out. For reference, your timeout cutoff is 60 seconds.
2025-11-04 23:56:54.405 [NOTICE] Bootstrapped 100% (done): Done