<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">Hi,</div><div dir="ltr"><br>On 28 Aug 2019, at 23:44, <a href="mailto:tux@hikari.me">tux@hikari.me</a> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><span>Quoting teor <<a href="mailto:teor@riseup.net">teor@riseup.net</a>>:</span><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>On 28 Aug 2019, at 14:21, Hikari <<a href="mailto:tux@hikari.me">tux@hikari.me</a>> wrote:</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>So, it's just that few people receive my bridge from BridgeDB. So it's a guard relay, right? What am I lacking to receive a guard flag?</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Guards and Bridges are different.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Bridges are secret entry nodes for a few Tor clients.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Guards are public entry nodes for any Tor client.</span><br></blockquote><blockquote type="cite"><span>But they are easier to block, because they are public.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>And what about being a middle relay? Shouldn't it be used more frequently in this mode?</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Middle relays are public middle nodes for any Tor client.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Bridges can't be used as middles, because bridge addresses are secret.</span><br></blockquote><span></span><br><span>Now I get it.</span><br><span></span><br><span>Is it worthy running a public middle relay at home? Or is it possible sites will block my IP and I should stick with a bridge as it is now?</span><br></div></blockquote><div><br></div><div>You should stick with a bridge.</div><br><blockquote type="cite"><div dir="ltr"><span>I suppose a guard relay isn't advised, right?</span><br></div></blockquote><div><br></div><div>There is no setting that lets operators make their relays middles or guards.</div><div>Instead, all non-exits have some chance of being a middle or a guard.</div><div>For new or slow relays, the chance of being a guard might be zero.</div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><blockquote type="cite"><span>I have obfs3 and obfs4 enabled, but I've never tested them. And never got any error message either.</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>You can test them with Tor Browser, but it takes a bit of cut and paste work.</span><br></blockquote><blockquote type="cite"><span>Look up the obfs4 instructions for the location of the bridge line file.</span><br></blockquote><span></span><br><span>Does Tor Browser for Windows come with obfs4? How to enable it?</span><br></div></blockquote><div><br></div><div>Yes.</div><div>Enter an obfs4 bridge line in the bridge settings.</div><div><br></div><div><div><span style="background-color: rgba(255, 255, 255, 0);">See the bridges part of the Tor Browser manual:</span></div><div><a href="https://tb-manual.torproject.org/bridges/" style="caret-color: rgb(0, 0, 0); background-color: rgba(255, 255, 255, 0);"><font color="#000000">https://tb-manual.torproject.org/bridges/</font></a></div></div><br><blockquote type="cite"><div dir="ltr"><span>I could also try running Tails on a VM if it has obfs4.</span><br></div></blockquote><div><br></div><div>Tails has Tor Browser with obfs4.</div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><span>If you'd like to get more bridge traffic, start another few bridges on different</span><br></blockquote><blockquote type="cite"><span>ports on the same IP, or different IPs.</span><br></blockquote><span></span><br><span>Do you know any tutorial teaching how to run multiple Tor instances? I did it with Transmission and had some trouble but did it.</span><br></div></blockquote><div><br></div><div>I don't know what Transmission is.</div><br><blockquote type="cite"><div dir="ltr"><span>I suppose I'll need to duplicate /etc/tor and /var/log/tor and have 2 systemctl files pointing to the correct torrc.</span><br><span></span><br><span>And also point nyx to the correct instance. I just run it without parameters.</span><br></div></blockquote><div><br></div><div>ansible-relayor is good, but I don't know if it supports bridges.</div><div><br></div><div>See the Tor Relay Guide:</div><div><a href="https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#ConfigurationManagement">https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#ConfigurationManagement</a></div><div><br></div><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><blockquote type="cite"><span>Another question. I currently have Address setting on torrc pointing to a domain handled by no-ip. I have 2 ISPs in load balancing, and before this setting I was having very frequent log messages saying my IP had changed, because each time Tor made its test it was using a different route. Isn't it possible to use Tor in load balancing?</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>There are different kinds of load balancing.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Tor relays and bridges can only advertise a single IPv4 address.</span><br></blockquote><blockquote type="cite"><span>Tor relays can also advertise an IPv6 address.</span><br></blockquote><blockquote type="cite"><span>We're working on dual-stack advertised addresses for bridges.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>So Tor works well when your AS announces your relay's IP address on multiple</span><br></blockquote><blockquote type="cite"><span>upstream routers.</span><br></blockquote><span></span><br><span>What's an AS?</span><br></div></blockquote><div><br></div><div>A network on the internet.</div><br><blockquote type="cite"><div dir="ltr"><span>I'm still working on getting IPv6 working. My Cisco RV340's WebUI doesn't have settings for enabling ULA and neither for delegating global prefix. I just bought a new router and will try to put OpenWRT on it, and hope to be able to setup everything then.</span><br><span></span><br><span>In early monitorings I'm noticing that one of my ISPs, the one I'm able to use global prefix, hasn't changed mine for over a week. But my server's IP is changing a few times every day inside the same prefix.</span><br><span></span><br><span>When (and if) I get everything working, I hope to have 1 no-ip domain for each ISP IPv4 address, and get 1 fixed IPv6 ULA and an equivalent global IP for each ISP global prefix and keep it fixed as long as ISPs don't change their prefix.</span><br><span></span><br><span>It's gonna take a few months to set it all.</span><br><span></span><br><span>Regarding Tor, maybe I'll need to run 1 instance for each ISP's IPv4+IPv6 combination. IPv4 will be easy, IDK how to make it know which IPv6 to use, if I'm unable to get no-ip working for IPv6.</span><br></div></blockquote><div><br></div><div>Set the IPv6 address as an ORPort in the relay config.</div><div><br></div><div>But bridges can only advertise one obfs4 address right now.</div><div>So I wouldn't worry too much about IPv6 yet.</div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><span>If you have different IP addresses for each upstream, you can:</span><br></blockquote><blockquote type="cite"><span>* Run a separate Tor instance for each address, or</span><br></blockquote><blockquote type="cite"><span>* Set (inbound) Address to one upstream, and OutboundBindAddress to another.</span><br></blockquote><span></span><br><span>Sorry I didn't understand the second option.</span><br></div></blockquote><div><br></div><div>I don't think it will work very well for bridges anyway.</div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><blockquote type="cite"><span>I'm buying a Ubiquiti EdgeRouter X to put OpenWRT. If everything works, in the near future I'll have IPv6 and load balancing working, but no-ip seems to not support IPv6. How should I setup my relay to use both ISPs and IPv4 + IPv6 with dynamic addresses?</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Address supports DNS for IPv4 addresses.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>IPv6 is only supported for ORPort (relays) and ServerTransportListenAddr (bridges).</span><br></blockquote><blockquote type="cite"><span>Tor doesn't have support for dynamic IPv6 yet.</span><br></blockquote><span></span><br><span>Well that's troubling lol so I think I won't be able to use IPv6, unless ISPs leave static global prefixes and I'm able to set a relative fixed ULA.</span><br></div></blockquote><div><br></div><div>Your router might be changing the address?</div><br><blockquote type="cite"><div dir="ltr"><span>Is it possible to set Tor to use a specific network device?</span><br></div></blockquote><div><br></div><div>No, that happens at the OS level.</div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite"><span>Can your provider allocate static IPv6?</span><br></blockquote><blockquote type="cite"><span>It should have a pool of millions of IPv6 addresses, so static should be easy.</span><br></blockquote><span></span><br><span>As I said, I'm monitoring IPv6 and the working ISP's global prefix hasn't changed in a week, but IPv6 addr is changing.</span><br><span></span><br><span>They won't wanna provide fixed global prefix, because they wanna charge for fixed IP. They are also serving only a /64 prefix. And blocking some most common ports.</span><br></div></blockquote><div><br></div><div>Wow that's unhelpful.</div><br><blockquote type="cite"><div dir="ltr"><span>My guess is that they haven't get dynamic global prefix allocation working yet, so they are just leaving it be for now. I also haven't tried turning modem off to see that forces prefix to change.</span></div></blockquote><br><div>T</div></body></html>