March 2025 - tor-relays - lists.torproject.org

GeoIPFile option warning
by krishna e bera 27 Jun '26

27 Jun '26

I am seeing these warnings in Tor's notices.log: Mar 24 09:42:21.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Mar 24 09:42:21.000 [notice] Configured to measure entry node statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. However the option is set in torrc and i verified the files are at those locations and readable by all: GeoIPFile /usr/local/share/tor/geoip GeoIPv6File /usr/local/share/tor/geoip6 Any hints how i could check whether the warnings are spurious or dump what the running config actually is? I know it is reading the torrc because introducing an error in the file stops it from loading.

2 2

Attempting to create a relay with Orbot
by blueapple128 20 Jun '25

20 Jun '25

Hi, I am trying to use Orbot's "Enable your device to be a non-exit relay" option, but (after waiting enough hours) the relay's nickname fails to show up in Tor Metrics' Relay Search. How can I begin to debug this?

2 2

Self hosting bridge at home - de-anonymization risk?
by bjewrn2a＠anonaddy.com 28 Apr '25

28 Apr '25

is there any documentation on self-hosting a bridge at home and using it for your own connections? I am trying to understand why this isn't a recommended setup, would it lead to de-anonymization? Why/how much? your traffic blends with other users directly via the same connection other users use your bridge on a regular basis together with you and your hidden services ISP monitoring of your exact connection times are made harder (not sure how much exactly) I don't understand why hosting a bridge outside of your geographic location is necessary? is it a problem that the first hop is from your own IP address if the other two hops are external? were there any studies or similar questions asked before? I couldn't find anything I can't find help anywhere, so would appreciate any advice

6 16

Running an obfs4 Bridge behind a UniFi UXG
by Malcolm MacDonald 01 Apr '25

01 Apr '25

Hello All! Not sure if anyone else is running a bridge behind a UniFi UXG but in my Flow log I am seeing blocked items with the Category of "DShield Block List" and Signature of "ET DROP Dshield Block Listed Source group 1" and the connection is being blocked. I'm thinking these alerts can be set to Allow Signature? Am I wrong on this one? Malcolm

2 1

Tor Relay Deployment Dilemma: Single 40Gbps Server or Four 10Gbps Machines?
by Tor at 1AEO 01 Apr '25

01 Apr '25

Looking for feedback on my Tor relay configuration decision: Assuming both options cost the same and provide the same aggregate bandwidth—and by “better,” I mean improved advertised bandwidth, reliability, and diversity—is it preferable to deploy: Option A: One hardware server on a 40Gbps link, or Option B: Four hardware servers, each on a 10Gbps link, located in different geographic areas and/or with different upstream providers? I lean toward Option B because it offers advantages in advertised bandwidth, reliability, and diversity. Additionally, does the ideal choice depend on whether the relays serve as exit nodes or as guard/middle nodes? Also, is there a more comprehensive way to define “better” for this context? I appreciate any suggestions or refinements!

2 2

Happy Families - Relay Operator Friendlyness
by nusenu 30 Mar '25

30 Mar '25

Hi Marco, moving the discussion from: https://gitlab.torproject.org/tpo/core/tor/-/issues/41033#note_3181625 to tor-relays as the features in the issue have already been implemented by Nick and the discussion has evolved into a more general direction. > I think many people have > HiddenService instances in addition to their relay instances. > HiddenService instances must then be configured not to use default > FamilyId * if tor automatically detect and use those. > Ultimately, > @nickm has to decide how much work he wants to put into c-tor. > (Especially auto detecting KeyDir on all OS requires a lot of time > to test.) Happy families is not relevant for onion services. I sense a misunderstanding of "FamilyId *". It only looks for family keys in the "keys" subfolder of a specific tor instance's DataDirectory or within the directory given in "FamilyKeyDirectory". See also the man page section: "KeyDirectory" because "keys" is just the default but can be configured. It does not search across the all "keys" subfolders of multiple tor instances on the same server, which would fail anyway with proper filesystem permissions, because one tor instance should not be able to read another tor instance's data directory if setup correctly. kind regards, nusenu -- https://nusenu.github.io

1 0

Self hosting bridge at home - de-anonymization risk?
by bjewrn2a＠anonaddy.com 30 Mar '25

30 Mar '25

> All Tor relays -- even non-exit relays -- are in a public list. Many > sites and services block access to all traffic coming from a Tor relay > IP address. Either they don't understand how Tor works or (more likely, > in my experience) they're just hostile to Tor. > > If you host a relay on your home IP, you'll likely find that you are > blocked from streaming services and other web sites (Cloudflare, for > one, facilitates this and by some reports they control about 30% of web > traffic). Thanks Ron, I will bear that in mind. Want to try it anyway and see how it goes.

1 0

Re: Self hosting bridge at home - de-anonymization risk?
by Zachary 29 Mar '25

29 Mar '25

Hello, I just wanted to make a comment on hosting a relay at home. > Many sites and services block access to all traffic coming from a Tor relay IP address Having hosted a relay at my house for over a year and in an institutional setting prior to that, I have ran into very few instances of this personally. It does indeed happen and often it's extremely hard to troubleshoot because you don't realize what the problem is. > If you host a relay on your home IP, you'll likely find that you are blocked from streaming services and other web sites I personally don't use many streaming services, but people I live with use them as their main source of entertainment. They haven't been blocked from any streaming services, at least so far. The only two things (that I remember/think are important) that I've been "banned" from for being a Tor Guard/Middle relay are: 1. Insurance company 2. My bank I live in a small town and have a good working relationship with my bank, who I was able to get in touch with their hosting provider to whitelist my IP (and when it rarely changes due to a router switch-out etc. they have been very good and whitelisted my new IP no questions asked.) As for the insurance company, which is a large nationwide provider, there is no feasible way to get in contact with anyone who even knows what I am talking about. The only solution to access them unfortunately is to use my phone as a cellular hotspot to get a different WAN IP. This doesn't always work because some routers don't announce themselves in a traceroute, but it can be very useful to run a traceroute to the website you are blocked on to see what router is actually blocking the traffic. That way when you contact the site operator you can point them in the right direction (if they are willing to help you.) If a website's upstream hosting provider is blocking the traffic, you would want to tell the website operator to tell their hosting provider that so they don't chase a red herring. I'm not downplaying your concerns, they are 100% valid, just sharing that in my experience it has been a non-issue (except the insurance company lol.) Of course, if my bank wasn't a small local organization and they weren't willing to assist, then it would be a different story entirely and I would feel very different about it. Just for perspective, my Pihole has caused vastly more issues cutting off legitimate content than being blocked for being a relay. Just wanted to share my thoughts. (: Zachary ----------- On Saturday, March 29th, 2025 at 7:00 AM, tor-relays-request(a)lists.torproject.org <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > Today's Topics: > > 1. Re: Self hosting bridge at home - de-anonymization risk? > (Ron Risley) > 2. Re: Self hosting bridge at home - de-anonymization risk? (mpan) > 3. Self hosting bridge at home - de-anonymization risk? > (bjewrn2a(a)anonaddy.com) > 4. Re: Self hosting bridge at home - de-anonymization risk? > (gerard(a)bulger.co.uk) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Mar 2025 07:50:44 -1000 > From: Ron Risley ronqtorrelays(a)risley.net > > Subject: [tor-relays] Re: Self hosting bridge at home - > de-anonymization risk? > To: tor-relays(a)lists.torproject.org > Message-ID: c1978073-7a34-4be4-ba69-feaada8028ac(a)risley.net > > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 3/26/25 11:56, bjewrn2a--- via tor-relays wrote: > > > That would incentivize users to also become > > relays - why isn't it recommended more often? > > > All Tor relays -- even non-exit relays -- are in a public list. Many > sites and services block access to all traffic coming from a Tor relay > IP address. Either they don't understand how Tor works or (more likely, > in my experience) they're just hostile to Tor. > > If you host a relay on your home IP, you'll likely find that you are > blocked from streaming services and other web sites (Cloudflare, for > one, facilitates this and by some reports they control about 30% of web > traffic). > > ------------------------------ > > Message: 2 > Date: Thu, 27 Mar 2025 19:59:48 +0100 > From: mpan tor-1qnuaylp(a)mpan.pl > > Subject: [tor-relays] Re: Self hosting bridge at home - > de-anonymization risk? > To: tor-relays(a)lists.torproject.org > Message-ID: 3c48cbbf-1693-4f05-ab6d-9e8032989848(a)mpan.pl > > Content-Type: text/plain; charset=UTF-8; format=flowed > > > > > but what if you used tor normally, not through your own bridge, but through > > > > "regular" randomly chosen 3-hop circuits and at the same time run a tor relay > > > > (entry/middle) > > > > > This wouldn't require weakening the tor circuit model > > > anymore. Yes, this is correct. The more Tor traffic goes through the machine > > > that identifies you, the more confused an adversary is. It also makes > > > naïve correlation attacks impossible,⁽¹⁾ and increases cost of more > > > advanced ones. > > > > That is great news mpan, thank you. That would incentivize users to also become > > relays - why isn't it recommended more often? This is the first time I ever hear > > about it and it sounds like a powerful idea. Normally I only see tor relay > > operators claim that they run tor relays purely altruistically: > > https://www.reddit.com/r/TOR/comments/6znjkg/why_would_anyone_setup_a_tor_r… > > To know why Tor Project itself doesn’t speak on this matter, you’d > need to wait for a reply from somebody from the project. > > I may speculate, that the two topics are orthogonal: running a relay > and using Tor. They don’t interfere with each other. In your original > question they didn’t either. The problem was not running a relay and > using Tor, but using Tor with the number of hops effectively reduced. > > It would also be a poor advice, if directed towards a person wishing > to only connect to Tor. Running a relay from home isn’t without > downsides. Both for the operator (bandwidth use, facing hostility) and > the network itself (completely inexperienced person is an easier attack > target). > > > Are you aware of any articles from torproject or research papers confirming that > > hosting tor relay at your own IP does in fact help your own traffic blend in? > > I've looked through all tor proposals (https://spec.torproject.org/proposals) > > and many research papers (https://www.freehaven.net) and couldn't find any > > mentions of this? Specifically for Tor? No. For exactly the same reason I can’t point > > you to any research that confirms, that downloading 500 kB/s and 200 > kB/s over Tor requires 700 kB/s. It’s a trivial consequence of basic > knowledge for the given field. In this case probabilistics, flavored > with practicality of correlation attacks and with signal processing > basics (none of this in Tor specifically). > > > ------------------------------ > > Message: 3 > Date: Thu, 27 Mar 2025 22:08:31 +0000 > From: bjewrn2a(a)anonaddy.com > Subject: [tor-relays] Self hosting bridge at home - de-anonymization > risk? > To: tor-relays(a)lists.torproject.org > Message-ID: d0d4ecac8b6e815e6a1768fb7cf32523(a)anonaddy.com > > Content-Type: multipart/alternative; boundary=fOfmQjRb > > > My personal opinion is that hosting a bridge or middle at your home doesn't risk de-anonymizing > > > Thank you, I am counting on that too. However, I haven't seen it recommended anywhere else before. Are you aware of any articles or studies backing this up? If that's a preferred setup I would have expected it to be more popular? > > > I would host a tor exit at home if I could get extra IPv4 addresses > > > Interesting, I haven't thought about that.

1 0

Re: Self hosting bridge at home - de-anonymization risk?
by DiffieHellman 27 Mar '25

27 Mar '25

My personal opinion is that hosting a bridge or middle at your home doesn't risk de-anonymizing you unless you go misconfigure your client to use your bridge or specifically only your middle. Maybe there is a chance of deanoymisation if you happen to use your own middle inadvertently, but it seems changing the default configuration to exclude your own relay is more of a deanoymisation risk. Running a middle instead of a bridge will make extra work for any ISP or NSA snoop to determine which tor traffic is yours, as most of the tor traffic won't be yours and even some tor traffic from middles goes to guard relays, which will require filtering out to determine which is your tor traffic to guards. I would host a tor exit at home if I could get extra IPv4 addresses at a reasonable price, but I can't. -- Kind Regards, DiffieHellman

2 1

Got contacted by another relay operator
by tempemailoNiceRelays 27 Mar '25

27 Mar '25

We were contacted by another relay operator (Zakwan Kalb zk(a)onionmail.org) He told us that Torproject intentionally added two new flags to our relays (BadExit, MiddleOnly) and our relays cannot be used as exit or guard. We checked our relays on https://metrics.torproject.org/rs.html as he asked and found that these flags really exist and our relays only used as middle. Has anyone faced the same problem?

2 3