- tor-relays - lists.torproject.org

Use OutboundBindAddress on multi-instance tor servers
by nusenu 13 Feb '23

13 Feb '23

Hi, to reduce the risk that your multi-instance tor relay setup triggers false-positive filter thresholds on other relays, I recommend you make use of the OutboundBindAddress (or OutboundBindAddressOR) option and set it to the same IP as in the ORPort line. This will ensure that the outbound source IP will be the same when connecting to relays. The man page is not clear what tor's default without that setting is but I guess that would leave it to the OS to pick the source IP and that could result in all your tor's using the same source IP. relayor users are covered by default, no further action required. https://github.com/nusenu/ansible-relayor/blob/2bc62d62f85b62c51a38d9caa893… kind regards, nusenu -- https://nusenu.github.io

4 5

publish current AuthDirMaxServersPerAddr limit?
by nusenu 12 Feb '23

12 Feb '23

Hi, would it be possible to publish the currently enforced value of AuthDirMaxServersPerAddr on some tpo website? Maybe consensus-health.tpo? kind regards, nusenu -- https://nusenu.github.io

3 2

HowTo use relayor's Prometheus Integration (relayor v23.1.0)
by nusenu 12 Feb '23

12 Feb '23

Hi, relayor v23.1.0 is released. It comes with: * a minor security fix that needs manual intervention * support for more than 2 relays per IP * a major simplification for users of the prometheus integration. * removal of the tor_dedicatedExitIP feature. relayor now implements conf.d support for prometheus. This includes a few backward incompatible changes. Full Changelog: https://github.com/nusenu/ansible-relayor/releases/tag/v23.1.0 With the release I also published this guide that should help users get started with relayor's prometheus integration: https://github.com/nusenu/ansible-relayor/discussions/239 kind regards, nusenu

1 0

Questions about 4 Relays per IP and the ddos mitigation scripts
by Chris Enkidu-6 08 Feb '23

08 Feb '23

Hello Everyone, Before I make changes to [my scripts](https://github.com/Enkidu-6/tor-ddos), I need to understand a few things and any help is much appreciated. - First, Does an Exit relay with zero Guard probability and zero middle relay probability need to initiate circuits with a Guard or middle relay and assuming it fails, would that affect my relay, relaying traffic to that Exit node as a part of my own circuit? To clarify the question, I have 2 Established connections to two Or Ports of an exit relay, the relay has no connections to me, Does that break anything? - I have a few Exit relays as permanent residents in my block list, not because I want them to be there but because, no matter how many times I remove them, day or night, they'll be back in seconds for making too many concurrent attempts. I'm assuming this is due to the fact that Exits are being used to attack other relays but I may be wrong which is why I need someone to clarify this for me and hence another reason for question one. - Each relay has Established connections to many other relays and if they're guard they will also have many connections to regular users and their Tor browsers until they have enough traffic to reach their MaxAdvertisedBandwidth. Obviously we don't Establish connections to all 6300 relays out there. So if we do not allow each IP more than two connections and they need 4, They'll have two from us and they'll move on to another relay and get the other two and get the job done and we will reach our Max Bandwidth anyway by accepting traffic from other relays. Diversity of relays as opposed to concentration of some relays. Am I correct in my assumption that this will have little to no effect on the health of the Tor network as a whole? Thanks for reading, I'm not going to make this longer than it is already.

5 8

tor relay shows offline @ tor relay search while running
by theyarewatching＠disroot.org 03 Feb '23

03 Feb '23

Good day, My relay shows offline on the Relay Search page but according to NYX the relay is always running. I am running two relays on on Proxmox through my home network. Please inform me of what info/logs you may need to help diagnose this. Thank you for your time and help. TAW

2 1

Ensure servers with >2 relays per IP do not get hit by rate limiting firewalls (by other relays)
by mail＠nothingtohide.nl 03 Feb '23

03 Feb '23

Hi Tor operators, Some of us took/will take advantage of the increase in allowed Tor relays per IPv4 address[1] to reduce costs for running Tor relays. This change will result in more relays sharing the same source IP address than before, which means other relays using rate limits on their ORPorts might need to make sure they do not unintentionally block relay to relay connectivity. Many relay operators deploy TCP SYN rate limiting packet filters theses days due to the ongoing DDoS issues. With the increase in Tor relays per IPv4 address, there might be more (new) connection coming from the same source IP. If you have strict TCP SYN rate limits per source IP, please ensure that this change does not result in blacklisting relay to relay traffic. You could for example whitelist relay IP addresses or have less strict rate limits for them. Thanks for reading, https://applied-privacy.net https://nothingtohide.nl [1] https://gitlab.torproject.org/tpo/core/tor/-/issues/40744

1 0

4 relays per IP address are allowed from now (Feb 2023) on
by Georg Koppen 02 Feb '23

02 Feb '23

Hello everyone! You might recall that Tor is restricting the possible amount of Tor relays per IP address to 2, mainly for Sybil prevention reasons.[1] Given that Tor on the relay side at least is not multithreaded yet (and will likely not be for the near and medium future) that's wasting a lot of useful resources as many servers can easily handle more than 2 relays. Additionally, IPv4 addresses are scarce/expensive. I have good news for you, though. Thanks to a push by our relay operator community we raised that limit to 4 with the help of the directory authorities (by having set `AuthDirMaxServersPerAddr 4` on a majority of them) and, depending on how that experiment goes, consider raising it even to 8. Thus from now one should be able to run 4 relays per IP address. We are looking very much forward to seeing a bunch of additional relays entering the network and making it stronger. :) For more details, information and discussion see: tor#40744.[2] Thanks, Georg [1] https://gitlab.torproject.org/tpo/core/torspec/-/blob/main/proposals/109-no… [2] https://gitlab.torproject.org/tpo/core/tor/-/issues/40744

1 0

(Save the date) Tor Relay Operators Meetup - 2023-01-28 @ 19UTC
by gus 02 Feb '23

02 Feb '23

Dear relay operators, Save the date: our next Tor relay operator meetup will happen on January 28 at 19:00 UTC! We're drafting the agenda here: - pad: https://pad.riseup.net/p/tor-relay-op-meetup-j28-keep - onionsite: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor… Feel free to add topics and/or questions. Room Link - https://tor.meet.coop/gus-og0-x74-dzn cheers, Gus -- The Tor Project Community Team Lead

2 2

Relays at universities campaign
by Eldalië 02 Feb '23

02 Feb '23

Hello everyone. At last Saturday's Tor Relay Operators Meetup, ongoing work on a "relays at universities" campaign was announced. I am interested in it as I may be able to help a little, so I'd like to receive any news, but I don't remember any message about it on tor-relays(a)lists.torproject.org list, and I see that tor-relays-universities(a)lists.torproject.org hasn't received any message at all since the only one from 2021. Is there a way to keep up with the campaign project already or it's being worked on by a "closed group"? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

2 1

relayor v23.0.0 is released
by nusenu 28 Jan '23

28 Jan '23

Hi, relayor v23.0.0 is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor#main-benefits-for-a-tor-relay-ope… This release comes with some great new prometheus integration features (some labels that tor does not provide out of the box). I'll follow up with a post that gives a general introduction on how to use relayor's prometheus integration soon. Changelog: https://github.com/nusenu/ansible-relayor/releases/tag/v23.0.0 Note: If you used relayor's prometheus support in previous relayor releases, make sure to set the tor_prometheus_scrape_file variable after upgrading to v23.0.0 and before running ansible-playbook with v23.0.0 for the first time. See the README for an example value. kind regards, nusenu -- https://nusenu.github.io

1 0