[tor-relays] What IPs does Torbrowser need?

Hi

Imagine a router that want to only whitelist the IP addresses that Torbrowser needs to work. What IPs would it need (for start up and browsing) ?

* Guards * Authorities * HSDir flagged relays (?)

and would such a whitelisting of IPs even work? At least I think DNS can be ignored as it is routed over Tor too. Any more thoughts?

ps: please leave me in CC as I'm not on the tor-talk list. thanks!!

martin