December 2025 - tor-relays - lists.torproject.org

RouteFluxMap: open-source Tor relay map with historical bandwidth snapshots
by Tor at 1AEO 26 Dec '25

26 Dec '25

Hello tor-relays, I’m sharing a new open-source visualization tool for exploring Tor relay distribution and bandwidth over time (updated daily): - Live site: https://routefluxmap.1aeo.com - Open-source code: https://github.com/1aeo/routefluxmap What it does: - Interactive world map of Tor relays, with relay presence and density visualized using bandwidth-weighted aggregation - Flow-style visualization based on the probability of traffic per relay, derived from each relay’s advertised bandwidth and consensus weight (not traffic tracing) - Historical snapshots built from Tor Collector / Onionoo data, covering 2007 through present - Country-level summaries showing relay count and aggregate bandwidth Why this is useful for relay operators: - Provides a fast, high-level view of where Tor bandwidth is concentrated geographically - Helps identify broad shifts in relay distribution or bandwidth that may correlate with performance or reachability changes - Useful for gaining network-wide context when debugging issues that aren’t obvious from single-relay metrics alone Implementation notes: - Static frontend built with Astro + React using Deck.gl and MapLibre - Data pipeline aggregates publicly available Tor network metadata into versioned historical snapshots Feedback is welcome, particularly on which additional historical or aggregate views would be most useful for operators. Significant inspiration and guidance from an open source and 7 year previously retired effort, TorFlow: https://github.com/unchartedsoftware/torflow Tor at 1AEO 1st Amendment Encrypted Openness (1AEO)

2 2

(FWD) December 2025 tor-edu update
by Roger Dingledine 26 Dec '25

26 Dec '25

Hi folks! Here is the latest update from the EFF Tor university relay campaign. We've added eight new relay groups since the last update. You can see the campaign page here: https://toruniversity.eff.org/ One of its advocacy goals is to show momentum at getting more relays running in universities and other educational institutions, first because universities make sense from an education/community/research perspective: https://toruniversity.eff.org/administrators/ and also because we want to help show the world that running relays is a normal activity that many groups around the world do, for a variety of reasons. If you are connected to an educational institution and you are reading this and want to get involved, please reach out to us! --Roger ----- Forwarded message from Roger Dingledine <arma(a)torproject.org> ----- Date: Fri, 26 Dec 2025 11:16:21 -0500 From: Roger Dingledine <arma(a)torproject.org> To: toredu-announce(a)lists.eff.org Subject: [Toredu-announce] December 2025 tor-edu update Hello excellent university relay operators, Since the July update, we have added 8 more new relay groups to https://toruniversity.eff.org/: * NYU Abu Dhabi (UAE), run by Zacharia Kornas in Christina Pöpper's research group * University of Macedonia (Greece), run by professor Panagiotis Fouliras * Bern University of Applied Sciences (Switzerland), run by professor Christian Grothoff * Hampden-Sydney College (US), run by professor William Tolley * A second relay at Arizona State University (US), now an exit relay, run by Pratham Gupta connected to professor Yan Shoshitaishvili's group * Fort Hays State University (US), run by Instructor Jackie Zhang * KAIST (Korea), run by Jinseo Lee in Min Suk Kang's research group * National Taiwan Normal University (Taiwan), run by a student named NZ I've added these folks to this list -- welcome! -- and it brings our total to 43 institutions. The two new relays at KAIST and NTNU are the first relays in East Asia to join the campaign! Here is a reminder that if your educational-network relay has been running for a year and you haven't gotten your awesome EFF challenge coin gift and you haven't heard from Cooper, please reach out to me or him and we'll get your coin(s) on track. And lastly, we've been pondering how best to set up a community for the tor-edu operators to share information and grow solidarity with each other. I would feel bad adding more zoom calls to people's schedules. Maybe we should start a wiki to record advice / experiences / questions asynchronously? Let us know if you are interested to help brainstorm about community and we will happily work with you. Thanks for everything! --Roger _______________________________________________ toredu-announce mailing list toredu-announce(a)lists.eff.org https://lists.mayfirst.org/mailman/listinfo/toredu-announce ----- End forwarded message -----

1 0

Bridge "identity crisis" after reinstallation
by telekobold 26 Dec '25

26 Dec '25

Hi, about four weeks ago, I switched off one of my relays and two of my bridges running on Debian 11 ("Bullseye") systems after discovering the "not recommended" flags on the Tor metrics overview of those relays with the intension of reinstalling and reconfiguring the underlying VMs and relays the following days. (A few days later, I read on this list that those flags are not that critical, but unfortunately Tor doesn't seem to be updated for Debian 11 at the official torproject Debian repositories [1]). But as life goes, something always came up in the days that followed. However, a week ago, I finally wanted to reinstall one of the bridges. I'm using Offline Relay Identity Keys [2], so I created a new intermediate key pair consisting of ed25519_signing_cert and ed25519_signing_secret_key locally and copied them to /var/lib/tor/keys on my freshly installed VM, together with ed25519_master_id_public_key. Unfortunately, I didn't copy the old secret_id_key key file. I then realized that the fingerprint files under /var/lib/tor changed (despite that IP address, port number and identity key stayed the same) and that I wasn't able to connect to my bridge using Tor Browser. So, a week later (yesterday), I gave it a new try and did the complete reinstallation and configuration process again, but with the slight difference of also copying the files secret_onion_key, secret_onion_key_ntor and secret_id_key to /var/lib/tor/keys. This resulted in the fingerprint files being as they were on my old installation, but I read the following message at /var/log/tor/notices.log: [warn] http status 400 ("Looks like your keypair has changed? This authority previously recorded a different RSA identity for this Ed25519 identity (or vice versa.) Did you replace or copy some of your key files, but not the others? You should either restore the expected keypair, or delete your keys and restart Tor to start your relay with a new identity.") response from dirserver 66.111.2.131:9001. Please correct. So, I uninstalled tor, copied only the files ed25519_master_id_public_key, secret_id_key, ed25519_signing_cert and ed25519_signing_secret_key to /var/lib/tor/keys, which unfortunately also resulted in the above warning message. My question now: Do I still have a change to recover the "old identity" of my bridge, or did I "burn" the old identity now since the directory authorities apparently registered a new identity? Kind regards telekobold [1] https://deb.torproject.org/torproject.org/dists/bullseye/main/binary-amd64/… [2] https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorRelaySecurity/Offl…

2 2

You can delete my Relay from consensus
by code9n＠pm.me 25 Dec '25

25 Dec '25

Hi, Doubt you need to know this but you can delete my relay: 41D4F82AB54AE5C5FB8D3CD24B4FC84350EFEF03 from the consensus, etc. The price for renewing has gone up 69 per cent from two years ago and it's through put has halved for the last six months or so. Not sure if Tor just doesn't need it as much as it did or if the vps hosting provider (Hostworld) is throttling it. I'll start a completely new one early in the new year when I get some time. This one is dead and the vps hire has expired - I no longer have access to it. Just out of interest is my telling [Tor Project] this useful? Christmas-y regards, Pete

3 2

Do nameservers ever block an entire /64 if a Tor exit is in there?
by forest-relay-contact＠cryptolab.net 19 Dec '25

19 Dec '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. I'm aware that some nameservers block Tor, so running a recursive local resolver on the same IP that traffic exits can be a bad idea. The usual solution is to buy an extra IPv4 and bind the local resolver to it. What about IPv6? Is it safe to simply make a new IPv6 on the same /64 and use that for recursive lookups, or are there nameservers that block the entire /64 that a single Tor exit relay is on? I currently use Unbound with "do-ip6: no" because I do not want to fail lookups and receive a BadExit flag if my entire /64 is blocked. Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmlFss8ACgkQBh18rEKN 1gugfA//UuYYhq7ATC1r3J/t5yHXB0bovAPzj519ICXGXaJ0TW86hY3PC5WzdYzk zKvKXArhQKm2Xdu9kh2w6YfETo3xTdUnTyLlBH1T/oeMamARUw1S+Osld4goiTS2 gsRzhN7hvzHw7NqMJLV+xEZQFBVLRg0Fi2E3oOqk5dBRbd5cMzpWZ4HiMqsY3jHH 6h5RY0HLk4HqPxGzAk0KRF056hDf4PmuGZuHSYsBR8PPMS4HwF/p6772KEK/ajBG VZr+v0Moi22dLMno+2SjkPy0rEOkRzOinOmqBLl6ajakn5lff0vR83eANTl3Vz2t bfP4PJ8bbraMVVdUEa5VobdDD8pGTbrryiB71gWO2AwS0GVnq8JIBK8pGSMAXmfc FNqxN/owYDSC+N3SlbOvK4YtIqbt5VKcU7nOuPzfBzm1cLMMq1NogzVN+FAdW9vr l9WD3AnKon6REM4ZpimDOZX8/5k0WKhhPm1TWmPa7ZB9NYyzQlbxEUmIIkQIXasW W0sVTeZ3vUwVQrUPilA8M0o8/cuWZleXs7RKNJP2T2r74olwUOw9E/afZXKxG9Hj daA1yUeD6tnUYk/pITddKHQ2V7Qd0BdHO2DMqQ71Bkcb7vTm/Ni45/jDaScaivz0 7vdCwPkC9k/sLEHHZ1kd33fjsGddILf7azSBRameI+9tgKZdw3E= =Z0tl -----END PGP SIGNATURE-----

1 0

Fwd: Potential vulnerability found in your Tor Relay
by krishna e bera 19 Dec '25

19 Dec '25

Hi all, Just got the below notice from researchers. Is the stated vulnerability an actively exploited problem or is this a DoS attack by scaremongering? This topic seems to have been covered in https://nusenu.medium.com/how-vulnerable-is-the-tor-network-to-bgp-hijackin… but i am not sure how to apply it to my situation. I have turned off the Guard capability for now. Doubtful i can influence the service provider to get them to publish a new ROA. Is there another mitigation? Regrets to all who were using the service :( -------- Forwarded Message -------- Subject: Potential vulnerability found in your Tor Relay Date: Thu, 18 Dec 2025 23:57:20 +0000 From: ENGR - SIDR Hello, We are writing to alert you that your Tor relay(s) (Pasquino3) is/are vulnerable to active BGP attacks that could be used to de-anonymize users. The best mitigation to help protect your relay is to have your service provider publish a ROA for prefix(es) 209.44.96.0/19 at AS(es) 10929 with a maxLength(s) of 19. We are researchers from the University of Connecticut reaching out to inform you that your Tor guard relay with IP address(es) 209.44.114.178 (Pasquino3) is/are currently covered by a Route Origin Authorization (ROA) which has an improperly configured maxLength attribute. This makes it vulnerable to BGP subprefix origin hijacks, where a malicious autonomous-system-level attacker may announce a subprefix of 209.44.96.0/19 and misdirect traffic destined with a high (>99%) rate of success. Guidance on how to correctly set the maxLength attribute is contained in https://datatracker.ietf.org/doc/html/rfc9319. We determined this vulnerability using public data sets including relay information from the Tor consensus, the RIPEStat data for IP prefix, and ROA coverage information. Feel free to contact us if you have further questions. For further information on ROAs, see https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/bgp-origi… If you are not a Tor relay operator and this message reached you in error, please let us know. Thank you, UConn Secure Interdomain Routing Group

6 5

automatic exit restriction policy does not include IPv6
by Marco Moock 18 Dec '25

18 Dec '25

Hello! I noticed that the implicit exit policy includes IPv4 localhost, RFC1918 IPv4 ranges etc, but does not include IPv6 by default, e.g. ::1, fe80::/10, fec0::/10 and not the public IPv6 itself. Is that a bug or a configuration issue? -- kind regards Marco Send spam to abfall1766003955(a)stinkedores.dorfdsl.de

2 3

Re: DirPort IPv6
by Marco Moock 05 Dec '25

05 Dec '25

On 04.12.2025 20:22 DiffieHellman <mailing_list(a)middlendian.com> wrote: > Reviewing a lot of contradictory information online and the tor > ChangeLog and torrc.sample, it appears that the DirPort supports > IPv6, but only authorities actually advertise directory information > anymore. > > There is still the secondary DirPort use, to serve the tor exit > notice (DirPort 80\n DirPortFrontPage /etc/tor/tor-exit-notice.html) > - which seems to be only targeted at those who see abuse and decide > to put the IPv4 address into a search engine and realise that it's a > tor exit (it seems that an assumption has been made that such sort > typically manages broken networks that are IPv4-only and therefore > listening on IPv6 wouldn't achieve anything). Thanks for the clarification. The note about this in the default torrc is outdated. -- kind regards Marco Send spam to abfall1764876123(a)stinkedores.dorfdsl.de

1 0

My exit isn't listed at https://check.torproject.org/exit-addresses
by Jon 04 Dec '25

04 Dec '25

Hi All, My exit 128.31.0.13 https://metrics.torproject.org/rs.html#details/A53C46F5B157DD83366D45A8E99A… is no longer listed in https://check.torproject.org/exit-addresses This is causing an uptick in abuse complaints to my upstream provider and making their stock response to check there a bit of a lie. metrics seem to show the relay is in good health and has a 14d uptime (since last package update). any idea what's going on with that? Thanks, -Jon

2 1

Re: Out-of-Memory-Attack & DoS from Tor-Client
by ProSecureRelays 04 Dec '25

04 Dec '25

Hi there, It's very unfortunate, but I don't have the Logs due to initial mistake I made, not setting up a Logfile. In the updated torrc file, i recently added it but I thought it is not worth a restart to implement this. Now it works. But I saw the relay logs in the cmd during the attack, and there was nothing unusal at all, except for the high rejection rates. The Out-of-Memory was also an Error that came from Windows, not the tor-process itself. I'm a bit positive surprised by the Windows Memory Management, all System Processes and the OS were unaffected by the attack. Additionally I have an powershell-script that monitores the tor.exe and restarts it after 2 minutes of "cool-down" if it crashes for 3 times. This was the first time it was ever needed, and I hope next time is not soon. Then I will also try the stupid oversize approach.. ;) About the Firewall Topic: I've read this manual you sent before, but I think its impossible with the windows firewall implementation. That's one weakness of closed source, either it matches the use case or you have to go for something completely different. The Windows Firewall is not statefull, but I had implemented very restrictive rules since the first day. However, this is limited by allowing only the tor.exe and related stuff to send and recieve traffic. If you would try to open a new process not listed, communication would fail. But fancy "real-time" stuff - not a chance. I mean creating some rules via powershell no prob, but how to analyse the concurrent, tor related connections (grabbing netstat?!) - sounds difficult and ressource heavy to me, and I'm sadly not a coding expert. In total there are 3 Firewalls between Internet and Tor, one Open-Source, one proprietary and the Windows Firewall, maybe I can stop this happening at another point in the network. I'll dig a bit deeper when I have the time, next step planned is implement Windows Applikation Control, so only the tor.exe I've made a checksum beforehand, is allowed to run. But thats a different topic. Thank you very much for your suggestions and maybe other hints/tips! Best regards, Joker

3 2