commit e1a825f7b27fd315d897dab5c0010388fc7ba4c2 Author: George Kadianakis <desnacked@gmail.com> Date: Fri Jul 22 20:53:06 2011 +0200 Make tor-obfs-howto.txt a bit more user-friendly. --- doc/tor-obfs-howto.txt | 134 +++++++++++++++++++++++++----------------------- 1 files changed, 69 insertions(+), 65 deletions(-) diff --git a/doc/tor-obfs-howto.txt b/doc/tor-obfs-howto.txt index ed8ba72..324a98c 100644 --- a/doc/tor-obfs-howto.txt +++ b/doc/tor-obfs-howto.txt @@ -1,101 +1,105 @@ -How to set up Tor with Obfsproxy +How to set up Tor with obfsproxy ================================ - Preliminaries: + Instructions: -This isn't the final interface--we should make it much easier. + "I AM A CENSORED FELLOW" -This is experimental code--if it breaks, you get to keep both smouldering -pieces. - - - - Ingredients: - -Client side needs: +[1] You will need: * a copy of obfsproxy: git clone git://git.torproject.org/obfsproxy.git Building it should be easy, just do "./configure && make". * a copy of Tor that supports the Socks5Proxy option. - The git version should do the trick. + Tor 0.2.2.30 - for example - will work. -Bridge side needs: +[2] Set up obfsproxy: -* a copy of obfsproxy: - git clone git://git.torproject.org/obfsproxy.git - Building it should be easy, just do "./configure && make". +This command will setup an obfsproxy client speaking the obfs2 +protocol on localhost:1050: -* a copy of Tor with BridgeRelay capabilities. - Quite easy to find nowadays. +./obfsproxy obfs2 socks 127.0.0.1:1050 - Port setup: +[3] Set up tor: -Our port setup will be like this: +You should put in your torrc file: +--- +SocksPort 5000 +UseBridges 1 +Bridge <bridge address>:1051 # This is provided by the bridge operator. +Socks5Proxy 127.0.0.1:1050 # This points to the obfsproxy client. +--- - 1050 1051 - +-----------+ +------------+ - ----| Proxy |-------------| Server |---- - | +-----------+ +------------+ | - | | -+------------+ +--------------+ -| Tor Client | | Tor Bridge | -+------------+ +--------------+ - 5000 5001 +Of course you should substitute the value of the Bridge line above, +with the information provided to you by a bridge operator. +[4] Done! +Alright, you are done! +Make sure you have followed the above steps on the correct order: +First launch obfsproxy and then launch tor. - Setting up obfsproxies: +Now to test it, launch Firefox and set it up to use a Socks server on +127.0.0.1:5000. Now browse the web. -This command will setup an obfsproxy socks client listening to the -obfs2 protocol on localhost:1050: -./obfsproxy obfs2 socks 127.0.0.1:1050 -This command will setup an obfsproxy server listening to the -obfs2 protocol on localhost:1051: -./obfsproxy obfs2 --dest 127.0.0.1:5001 server 127.0.0.1:1051 + "I AM A BRIDGE OPERATOR THAT WANTS TO HELP CENSORED PEOPLE" - Setting up Tor: +[1] You will need: -Let's create .torrc_client and .torrc_bridge. -Warning: I'm only posting the relevant torrc options. +* a copy of obfsproxy: + git clone git://git.torproject.org/obfsproxy.git + Building it should be easy, just do "./configure && make". -torrc_client: ---- -SocksPort 5000 -UseBridges 1 -Bridge <bridge host>:1051 # This points to the bridge's obfsproxy server. - # You can change <bridge host> to 127.0.0.1 - # for local testing setup. -Socks5Proxy 127.0.0.1:1050 # This points to our obfsproxy client. ---- +* a copy of Tor which can function as a Tor bridge. + +[2] Set up obfsproxy: + +This command will setup an obfsproxy server speaking the obfs2 +protocol on localhost:1051: -torrc_bridge: +./obfsproxy obfs2 --dest 127.0.0.1:5001 server 127.0.0.1:1051 + +Be sure to pass the value of ORPort of your bridge relay to the --dest +argument (see next section). + +[3] Set up tor: + +You should put in your torrc file: --- -ORPort 5001 # Port where bridge will be listening on. +ORPort 5001 # Port on which bridge will be listening on. BridgeRelay 1 ExitPolicy reject *:* --- - Bootstrap sequence: +[4] Done! + +Make sure you have followed the above steps on the correct order. +First launch obfsproxy and then launch tor. +You can use any port numbers you want, just be sure to adjust the +torrc and obfsproxy commands accordingly. + +Don't forget that You might need to set up port forwarding. -Since we are still in PoC state you have to bootstrap the Tors and the -obfsproxies with the correct sequence: +Now you should tell censored people to connect to your IP on port 1051. +So, for example, if your bridge's address is 85.22.13.1, bridge users +should connect to 85.22.13.1:1051. +Pay attention that '1051' is the port where obfsproxy is listening on, +and *not* your bridge's ORPort. -1. Fire up server obfsproxy. -2. Fire up tor with torrc_bridge. -3. Fire up client obfsproxy. -4. Fire up tor with torrc_client. + Network diagram of the above setup: - The End +(If you don't understand this drawing, just ignore this section.) -Now open Firefox on the client side and set it up to use a Socks -server on 127.0.0.1:5000. -Stuff should work now. + 1050 1051 + +-----------+ +------------+ + ----| Proxy |------[internet]------| Server |---- + | +-----------+ +------------+ | + | | ++------------+ +--------------+ +| Tor Client | | Tor Bridge | ++------------+ +--------------+ + 5000 5001 -If you were smart enough to open wireshark and sniff the traffic -before doing all the above, you would notice that the TLS handshake -was not carried out plaintext, effectively obfuscating your Tor -experience. Yes.