<br><br><div class="gmail_quote">On Nov 8, 2007 8:53 AM, Martin Fick <<a href="mailto:mogulguy@yahoo.com">mogulguy@yahoo.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Wed, Nov 07, 2007 at 08:20:37AM -0800, Martin<br>Fick wrote:<br>> My home router offers an http administration<br>> console on port 80 which for obvious security<br>> reasons is normally only accessible from the
<br>> internal facing side of the router. While<br>> many of these home routers typically have an<br>> internal private IP such as <a href="http://192.168.1.1" target="_blank">192.168.1.1</a> and<br>> an external public IP, they sometimes respond
<br>> to both IPs from the inside and sometimes they<br>> even allow access to the administration console<br>> on the external IP if it is accessed from the<br>> internal side of the router (mine does). This<br>
> would not normally be a problem, but add a tor<br>> exit server to the inside of a home network<br>> serviced by such a router and ...you can<br>> probably guess where I am going with this.<br><br></div>...<br>
<div class="Ih2E3d">--- Kyle Williams <<a href="mailto:kyle.kwilliams@gmail.com">kyle.kwilliams@gmail.com</a>> wrote:<br>><br>> If anyone is concerned about this, and you should<br>> be add the following to your torrc.
<br>><br>> ExitPolicy reject <YOUR_EXTERNAL_IP>:*<br>><br>> Obviously replacing <YOUR_EXTERNAL_IP> with your<br>> real IP address...not your internal (LAN) IP<br>address.<br><br></div>...<br><div class="Ih2E3d">
--- Jacob Appelbaum <<a href="mailto:jacob@appelbaum.net">jacob@appelbaum.net</a>> wrote:<br>><br>> I run a few services on the net. I like the idea<br>> that if I run a Tor server on the same machine<br>> (on the same interface, with the same IP) as
<br>> my service, people using Tor will prefer my node as<br>> their exit node. This allows me to provide services<br>> indirectly to the Tor network without very much<br>> effort. Smart routing is neato. This is a
<br>> feature and a pretty neat one at that.<br><br></div>...<br><div class="Ih2E3d">--- Ruben Garcia <<a href="mailto:ruben@ugr.es">ruben@ugr.es</a>> wrote:<br>> Perhaps it might be possible to tell tor about the
<br>> router's nat policy so that if the router is<br>> supposed to port forward the external request<br>> to <ipA>:<portA>, tor does it itself.<br>> That way, the problematic<br>><br>> host->tor->tor->your host tor->router->your host web
<br>></div></blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>> can become<br>><br>> host->tor->tor->your host tor->your host web
<br>><br>> (This requires some changes to the torrc and tor<br>> source, so I'd like to add it to the feature<br>> request list in case somebody has free time)<br></div></blockquote><div><br>That would be a hidden service. Tor already does that.
<br>What we are talking about is secure defaults for exit nodes.<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">
<br><br></div>This seems like a nice valid option, spoofing<br>the external IP from within the tor exit node?<br>In other words if the web internal IP is say:<br><a href="http://192.168.1.2" target="_blank">192.168.1.2</a>
, any request for the external<br>IP through the tor exit would actually yield<br>a request directly to the web server's internal<br>IP, <a href="http://192.168.1.2" target="_blank">192.168.1.2</a>, instead?<br></blockquote>
<div><br>That's a horrible idea. You do NOT want everyone to be able to anonymously fuck with your router's admin page. <br>You don't need to redirect that specific request either. It needs to be dropped. If you want to offer up a website, then use the hidden service feature of Tor.
<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>That sounds like a nice feature to be able to<br>get the best of both worlds: 1) security for
<br>the relay operator and 2) for users accessing<br>the NATed web site!</blockquote><div> </div><div>Yes, a hidden service will work behind a router (or NAT'd setup). <br></div><div> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>Naturally this should be configurable for<br>specific ports only. Of course, adding an<br>IP spoofing mechanism directly to tor exit<br>nodes makes it that much easier for IPs in<br>general to be spoofed by exit nodes! :(
<br><div><div></div><div> <br></div></div></blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div class="Wj3C7c"><br>-Martin<br>
<br><br>__________________________________________________<br>Do You Yahoo!?<br>Tired of spam? Yahoo! Mail has the best spam protection around<br><a href="http://mail.yahoo.com" target="_blank">http://mail.yahoo.com</a><br>
</div></div></blockquote></div><br><br>If you want to run a hidden server, such as a web site over a .onion address, then that's fine. <br>If your router is disallowing people to access the admin webpage interface from the Internet, that's probably a good thing.
<br>But if running a Tor exit node opens up that admin webpage to the rest of the Tor network, that's not good. At that point, anyone could anonymously try and hack your router. God help you if they do get in, then your really in trouble.
<br><br>There is no point in redirecting that type of request, it needs to be rejected. <br>....Maybe replying with a "bad hacker, not root for you!" webpage would be funny though.<br><br><br>- Kyle<br>