[tor-relays] What IPs does Torbrowser need?

Hi Imagine a router that want to only whitelist the IP addresses that Torbrowser needs to work. What IPs would it need (for start up and browsing) ? * Guards * Authorities * HSDir flagged relays (?) and would such a whitelisting of IPs even work? At least I think DNS can be ignored as it is routed over Tor too. Any more thoughts? ps: please leave me in CC as I'm not on the tor-talk list. thanks!! martin