Hi there,
the Bridge is working right now as expected - i was confused to see the
boostrapping not in the CMD but finally found it in the Notice file.
Beginners fault, I was literally working the whole time.
For testing I added IPv4 Support, but I will remove it now, because I'm
afraid people getting busted as tor user, when Relay and
Bridge-Obfs-Interface share their addresses - and I think for good reason.
The simple torrc option "IPv6Only" should do the trick.
Is there any additional site to look up the bridge aroi state? From what I
saw was 1aeo only tracks the relay stats (huge thanks for this!)
Best regards
Joker
Von: Jan Scherer via tor-relays [mailto:tor-relays@lists.torproject.org]
Gesendet: Sonntag, 23. November 2025 20:35
An: tor-relays(a)lists.torproject.org
Betreff: [tor-relays] Bridge Operation IPv6 only - possible?
Hi there,
I have two questions regarding bridge operations:
Is it possible to run an obfs4 Bridge with external-reachable IPv6 only?
I've tried to setup a "Node" on a seperate host, but in the same network as
my relay. (VLAN-seperated)
The idea was to open all external ports required for the tor part (on IPv4
and IPv6) and assign one different IPv6-Address as External obfs Port.
I generally thought this could be beneficial, as with every firewall restart
I get new IPs and potentially evade blocklists.
From what I read there is a higher demand of bridges at the moment due to
russian and chinese "ip whitelisting" attempts.
Overall, the Networking Scheme would look like this (from Firewall-View)
--------
WAN
Source Target IP-Ver Port
Desc.
WAN Tor-Relay IPv4/6 30003
Allow Incoming Relay-Traffic
WAN Tor-Bridge IPv4/6 30004
Allow Incoming Bridge-OR Traffic
WAN Tor-Bridge IPv6 56120
Allow Incoming Bridge-Obfs4 Traffic
--------
DMZ
Source Target IP-Ver Port
Desc.
Tor-Relay "WAN" IPv4/6 *
Allow Outgoing Relay-Traffic
Tor-Bridge "WAN" IPv4/6 *
Allow Outgoing Tor/Bridge Traffic
--------
The Bridge is starting but freezes in a state before any major bootstrapping
happened. (see Logs attached)
I can see outbound and inbound traffic on the tor ports (30004), but not on
the bridge ports. I assume the Tor part is "partially" working.
In the Log: Is the last line [notice] Opened Extended OR listener connection
(ready) on 127.0.0.1:50652 - is that an internal Port or the port that I
want to be 56120?
Maybe someone could give me hint if this frankenstein construct is even
supposed to work (like having a bridge with only public IPv6 Adress) and If
there are any security constraints.
Second Question: Should I exclude my own relay as Guard?
Other thoughts:
To improve privacy for the bridge even more, i thought about adding a second
Interface to the VM, and work with IPv6 ULA and NAT for the needed Tor
Connection.
E.g. Pick any GUA from the External Availabe IP-Range and NAT it to ULA
"fc55:c737:c747:c757::cafe" and do also Outbound NAT to the GUA again to not
confuse the peers.
But this is for another time.
Last point, maybe it makes you smile about my stupidness.. I took alot of
thought into physical security of my server, last Step was to trigger a
Bitlocker-Lock, when the Chassis is opened.
Unfortunetaly, the Chassis_Intrusion Implemetation of the Board is not
great, so I ended up with connecting the Chassis Switch onto the CLR_CMOS
Header. "Perfect Solution".
When you open up the chassis, the system immediately resets and due to PCR
Missmatch, the drive cannot be decrypted. I have removed any "Recovery
Options" from bitlocker, so no 40 Digit Number you may enter in this case.
If not planned, during a normal boot the TPM + Key-File + Pin would be
needed to unseal the drive.
I'm using TSME as additional layer of protection, so all of my ram is
enrypted and cold boot attacks are not an option anymore. The measured
performance impact was only about 6% in my case. It can be enabled in the
Bios.
To prevent DMA Attacks, I disabled USB-Support, Audio, SATA and there is
even no free PCIe Slot or any other interface on the Board.
Reason for all of this is that I may want to spread some more relays, and I
cannot guard them or ensure that they are 100% safe from physical tampering,
so I want them to just go down immediately when someone messes with them.
If you have any more thoughts/improvements, let me know.
After this long mail, I'm pretty sure you will all sleep well!
Best regards and a nice start into the week!
Joker