We will want to support filtering arbitrary SOCKS5 proxies:
Right now SGFW implements the "stream isolation" hack in its proxy relay implementation:
https://github.com/subgraph/fw-daemon/blob/master/sgfw/socks_server_chain.go#L173
Tor should be made a special case (this is one reason we added a "Name" field to the proxy definition, there are other reasons to treat Tor as a special case, like default TLSGuard).