- tor-relays - lists.torproject.org

Tor Relay in Kubernetes cluster
by Daniel Nikoloski 18 Aug '23

18 Aug '23

Hi all, Is anyone running Tor relay in k8s cluster? I am trying for a few days but It does not come alive. My servers are not behind a firewall, should be and are accessible, I run two bare-metal servers in Contabo. 1 master 1 node. Docker image and helm chart that use; https://gitlab.com/nikoloskid/tor-server The logs I get; > Aug 05 21:04:55.000 [notice] Now checking whether IPv4 ORPort 38.242.233.101:32150 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) > Aug 05 21:24:45.000 [warn] Your server has not managed to confirm reachability for its ORPort(s) at 38.242.233.101:32150. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports > > , address, /etc/hosts file, etc. When i try telnet it is open to the internet > telnet 38.242.233.101 32150 > Trying 38.242.233.101... > Connected to 38.242.233.101. > Escape character is '^]'. You can see the service here; https://gitlab.com/nikoloskid/tor-server/-/raw/helm-chart-tor-relay/tor-ser… /etc/tor/torrc; > Nickname icebergk8s > Address 38.242.233.101 > ContactInfo nikoloskid(a)pm.me > RelayBandwidthRate 3.5MB > RelayBandwidthBurst 5MB > MaxAdvertisedBandwidth 5MB > ORPort 9001 NoAdvertise IPv4Only > ORPort 32150 NoListen IPv4Only > SocksPort 0 > ExitPolicy reject *:* > User debian-tor > DataDirectory /var/lib/tor Lep pozdrav / Best Regards, Daniel Nikoloski

2 1

Tor Relay Operator meetup @ CCCamp 2023 - Saturday 19th @ 7pm
by gus 17 Aug '23

17 Aug '23

Hello, The Tor Relay Operator Meetup - Chaos Communication Camp-2023[1] will happen at Bornhack (Cold North Village)[2] on Saturday, August 19th at 7pm (local time). After the meetup, we invite everyone to stay and have beer and drinks at Bornhack. Please spread the message. We have Tor stickers for you! :) Gus [1] https://events.ccc.de/camp/2023/infos/ [2] Coordinates: 53.0314175, 13.3065457 https://map.events.ccc.de/camp/2023/map/#20/53.03143/13.3066 -- The Tor Project Community Team Lead

2 4

WebTunnel: What ASNs/networks work best?
by tor-home at encryptfirst.com 17 Aug '23

17 Aug '23

When running a WebTunnel bridge, what types of IPs are better for serving requests? My background is with self-hosted home-lab type of setups. There are a number of different ways for homelabs to accept inbound https connections. A few examples: - Forward a port on a home router. - Rent a cloud VM/VPS and tunnel a port from the VPS's IP. - Have a CDN tunnel/forward requests. - VPN hybrid solutions like Tailscale Funnel. Are any of these better than others for hosting a WebTunnel bridge? Should cloud provider IPs be preferred over residential IPs, for example, considering that is where most web servers are hosted? Are large CDNs preferred over individual cloud VMs? Is it better to use a different IP for WebTunnel than the IP that runs the OR port (i.e. host OR port on home IP and WebTunnel from a cloud-based IP)? I'm mainly asking to determine which way helps the broadest number of Tor users. And which is less likely to be blocked in the future. What are the best practices? PS: Thanks for the webtunnel-bridge Docker image and the documentation on how to run it. It was very helpful and made setup easy.

4 4

Running an exit relay in Italy
by Eldalië 17 Aug '23

17 Aug '23

Hello there and thanks everyone for your answers to my message about middle relay blocking. Reading them I feel trying to solve the blacklisting of my IP would be overkilling. Since I have a chance to get a cheap VPS, I will try to migrate the relay on it. And since the relay would be on a dedicated IP, I'm thinking about making it an exit. Of course I must consider the law, and I'd like to read some references and listen about experiences from other operators before seeking professional (expensive, I guess) legal advice. My concerns are the following, but I would appreciate any other thoughts as well. The relay would be in Italy so Italian and EU laws apply. 1. Would I bear any responsibility for the use of the relay? I'm aware of the "mere conduit" concept (that is applied in the EU too) but Italy may have some crappy additional law I'm not aware of. 2. Would I be subject to any data retention or data monitoring obligation? 3. Would I be subject to any user identification obligation? 4. Would I risk the police knocking on my door even if the relay runs on a datacenter and not on my home network? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

2 1

(EVENT) Tor Relay Operator Meetup - June 24, 2023 @ 18.00 UTC
by gus 10 Aug '23

10 Aug '23

Hello, The next Tor Relay Operator Meetup will happen on June 24, 2023, at 18.00 UTC. We're working on the agenda here: https://pad.riseup.net/p/tor-relay-op-meetup-june-keep onionsite: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… Feel free to add other topics to the agenda. WHERE Room link: https://tor.meet.coop/gus-og0-x74-dzn Registration No need for a registration or anything else, just use the room-link above. We will open the room 10 minutes before so you can test your mic setup. Please share with your friends, social media and other mailing lists! cheers, Gus -- The Tor Project Community Team Lead

5 7

short conntrack DDoS attack
by Toralf Förster 09 Aug '23

09 Aug '23

Few days ago the throughput of my Tor relay went down to nearly zero for about 3 minutes. It turned out that the reason (maybe) was a change here in my iptables rules. Especially I switched these 2 lines: iptables -A INPUT -m conntrack --ctstate INVALID -j DROP iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and run then few hours later into problems. And switched back ofc. An explanation for the dropdown was given in [1]. Given that the explanation is right: How is the Tor application harmed if an attacker mangles packets so that the state of them are INVALID for the conntrack module but they do pass the RELATED,ESTABLISHED rule ? [1] https://forums.gentoo.org/viewtopic-p-8798034.html -- Toralf

2 1

Re: [tor-relays] Middle relay IP blocking
by torserver 08 Aug '23

08 Aug '23

Roger, I had the same problem with 3 financial websites blocking my IP address while running a middle relay. Exactly 5 days after stopping the relay these sites can be reached again. They probably use the same mechanism, visible in the TPRB Firefox plug-in. I run my home relay on a low energy consuming Raspberry Pi. Why is there no perfectly detailed instruction to install a relay on the Raspberry? With its built-in VNC it can be managed by SSH and remote desktop perfectly. Then there is no need for data congestion on a few cheap providers. One Watt power consumption only costs 3 Euros a year. Snowflake almost uses no data with a few occasional users. I 'd like to use my 100 Megabits more efficient. Regards, me. > Date: Tue, 8 Aug 2023 02:32:03 -0400 > From: Roger Dingledine <arma(a)torproject.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Middle relay IP blocking > Message-ID: <ZNHhY1rj8rQAId0y(a)nogrod.csail.mit.edu> > Content-Type: text/plain; charset=us-ascii > > On Mon, Aug 07, 2023 at 11:28:32PM +0300, s7r wrote: > > While all the above is true, a thing to remember is to make sure we don't > > end up all renting too many VPS'es or dedicated servers in the same places / > > same AS numbers - we need network diversity, it is a very important factor, > > more AS numbers, more providers, more physical locations, etc. So, running > > at home is super good and recommended from this perspective, provides us > > with the diversity we need, however not being to login to online banking to > > pay an electricity bill because of a middle relay is also way too annoying.. > > however who can afford the hassle should definitely run a middle relay or > > bridge at home > > Yes, exactly this. If you are interested in running a non-exit relay at > home, and you can tolerate the hassles from occasionally finding that > some service doesn't want to hear from you, then you are definitely > helping the diversity of the Tor network. > > Having the Tor traffic concentrated at a few cheapo providers like Hetzner > and OVH is not only scary in the sense that too much traffic goes through > too few cables, but it's also scary because it increases the appeal for > somebody to attack those few companies, either by breaking into their > infrastructure to watch traffic or through more traditional insider > threats like getting an employee there to help them monitor traffic. > > The internet already has uncomfortably many bottlenecks -- too few > undersea cables, too few Content Distribution Networks (CDNs), too few > app stores, etc. > > > (even Exit relay, I do run an Exit relay at my office place > > and I had one police visit in like 8 years or so). > > Follow this advice only with great caution. :) Many people happily > run their exit relay from their home, but it only takes one fresh new > cybercrime detective (trying to make a name for himself by kicking down > a door at 7am, and with no idea what Tor is) to ruin your day. > > --Roger > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 151, Issue 9 > ******************************************

2 2

Middle relay IP blocking
by Eldalië 08 Aug '23

08 Aug '23

Hello there! I've been running for over 1.5 year a middle relay on an IP address I also use to browse, withous issues. However it's now some weeks since many websites that always refused tor traffic started to also refuse normal traffic from my IP. I suppose this is related to the relay, because I don't run any other "suspect" service on this IP and when I change it the problem is gone for a few hours. My guess is that some widely used black list started including middle relay IPs, but I have no proofs. Has anyone had similar experiences? Any thoughts on this? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

12 15

Help Turkmens to bypass Internet censorship: run an obfs4 bridge!
by gus 02 Aug '23

02 Aug '23

Dear Relay operators community, The parliamentary elections in Turkmenistan are coming up very soon on March 26th[1], and the Turkmen government has tightened internet censorship and restrictions even more. In the last few months, the Anti-censorship community has learned that different pluggable transports, like Snowflake, and entire IP ranges, have been blocked in the country. Therefore, running a bridge on popular hosting providers like Hetzner, Digital Ocean, Linode, and AWS won't help as these providers' IP ranges are completely blocked in Turkmenistan. Recently, we learned from the Anti-censorship community[2] and via Tor user support channels that Tor bridges running on residential connections were working fine. Although they were blocked after some days or a week, these bridges received a lot of users and were very important to keep Turkmens connected. How to help Turkmens to access the Internet =========================================== You can help Turkmens to access the free and open internet by running an obfs4 Tor bridge! But here's the trick: you need to run it on a residential connection -- you won't need a static IPv4 --, and it would ideally be run on more robust hardware than just a Raspberry Pi (although that can help, we have found they can get overloaded). You can set up an obfs4 bridge by following our official guide: https://community.torproject.org/relay/setup/bridge/ After you setup a new bridge, you can share your bridge line with the Tor support team at frontdesk(a)torproject.org, and we will share it with users. A complete bridge line is composed of: IP:OBFS4_PORT FINGERPRINT cert=obfs4-certificate iat-mode=0 Check this documentation to learn how to share your bridge line: https://community.torproject.org/relay/setup/bridge/post-install/ Just sharing your bridge fingerprint is not the best, but it's fine. You can read more about censorship against Tor in Turkmenistan here: - https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… - Snowflake blocked: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… Thank you for your support in helping to keep the internet free and open for everyone. Gus [1] https://en.wikipedia.org/wiki/2023_Turkmen_parliamentary_election [2] https://ntc.party/c/internet-censorship-all-around-the-world/turkmenistan/17 https://github.com/net4people/bbs/issues/80 -- The Tor Project Community Team Lead

7 24

How do I set up a conjure Bridge?
by Poojith Bestha 01 Aug '23

01 Aug '23

I have a question. How do I set up a conjure bridge? Is the process hard? What hardware do I need to use? Regards, Poojith

2 1