- tor-relays - lists.torproject.org

Closing relay
by Ole Rydahl 29 Aug '22

29 Aug '22

Since 2014 I have run a non-exit relay at my premises. However ultimo July the system load increased abruptly. Idle-cpu -typically 60-70% - dropped to 30%, _and_ with frequent drops to 0! I reduced the max bandwidth to 1.2 Mbytes. That reduces the load somewhat but still with frequent spikes where the idle-cpu hits 0 and I get the "relay too slow" indication. Any suggestions? /Ole Rydahl https://metrics.torproject.org/rs.html#details/CE1FD7659F2DFE92B883083C0C6C9 74616D17F3D

2 1

Overload
by sysmanager7 28 Aug '22

28 Aug '22

Another New one: 19:01:09 [NOTICE] General overload -> Ntor dropped (176948) fraction 25.2668% is above threshold of 0.5000% â 17:19:32 [WARN] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth â config option or choosing a more restricted exit policy. Any Ideas?? What is the syntax for MaxAdvertisedBandwidth? Currently is: MaxAdvertisedBandwidth 3Mb Sysmanager Sent with [Proton Mail](https://proton.me/) secure email.

1 0

missing IPv6 close events
by Toralf Förster 27 Aug '22

27 Aug '22

Playing with Python and Stem I wrote a script to monitor the ORStatus.CLOSED event reasons [1]. A helper script [2] gives statistics from those data. From the last 2 days I got: $> orstatus-stats.sh /tmp/orstatus.29051 CONNECTRESET 6197 CONNECTRESET 13214 DONE 18769 IOERROR 58 NOROUTE 1661 TIMEOUT 2562 TLS_ERROR 42461 I was wondering if it is expected that DONE is just a 1/4 of all reasons. And I do wonder why all events are IPv4 only. [1] https://github.com/toralf/torutils/blob/main/orstatus.py [2] https://github.com/toralf/torutils/blob/main/orstatus-stats.sh -- Toralf

1 0

Warn:
by sysmanager7 25 Aug '22

25 Aug '22

I got the below message on my relay #2. It's been in operation for a year and a half. First time I've ever got one of these. 0re7:26:40 [WARN] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [505 similar message(s) suppssed in last 57840 seconds] OK > Both relays operate on Digital Ocean Droplets Bandwidth on both 2 MBs Burst 3MBs both relays have the same settings NEITHER is an exit: ExitPolicy reject I see relay #2 has been restarted. Last eve it had been up four days. As of this writing just over 2 hours. Or is this another way to muck up a relay? Sysmanager Sent with [Proton Mail](https://proton.me/) secure email.

1 0

We need much more bridges with obfs4 and iat-mode set to 1 or 2..barely can't find any.
by elise.toradin＠web.de 24 Aug '22

24 Aug '22

4 3

Strange entries in notices.log
by toritdown 23 Aug '22

23 Aug '22

I am suddenly finding numerous entries in my /var/log/tor/notices log that look like this: Aug 22 01:21:46.000 [warn] Unable to store router descriptor Aug 22 01:21:46.000 [warn] Error writing to "/var/lib/tor/cached-descriptors.new": No space left on device What does this mean? What do I need to do about? Sent with [Proton Mail](https://proton.me/) secure email.

4 3

Relays spamming my OR port
by Logforme 19 Aug '22

19 Aug '22

I run the relay 8F6A78B1EA917F2BF221E87D14361C050A70CCC3 I have tried to mitigate the current DoS by implemented connection limits in my iptables using Toralf's template: More than 25 connection during 10 mins and you end up on my naughty list. Lots of connection attempts from the naughty list dropped but still my relay gets "overloaded" However, I have noticed that a few relays also end up on the naughty list, and I wonder how that can happen. My understanding is that a relay will only open 1 connection to another relay so should therefore never end up on the list. Correct? D767979FE4C99D310A46EC49037E9FE7E3F64E9D is a particularly frequent naughty boy. Maybe these relays disconnect and reconnect to my relay frequently due to network issues (effect from the DoS?) or from not having enough connections available on the router? I guess my real question is if these connections are legit and I'm hurting the Tor network by using connection limits?

4 10

Metrics falsely showing my relay as offline
by Eddie 19 Aug '22

19 Aug '22

I have 1 relay (40D13096BBD11AF198CE61DEE4EAECCE5472F2E7) that according to the metrics is always bouncing between online and offline, sometimes multiple times per day. The logs show it running the whole time and when the metrics also show it running, the uptime continues to increase correctly. This hasn't always been the case, as the history shows this didn't happen prior to around June based on the guard flag usage. This relay is hosted at AWS if that makes any difference. Should I care about this, because the relay is running correctly. It's just that it never gets the stable (long running) and guard flags any more because of this yo-yo effect, which I'm sure is affecting how the relay is allocated circuits. I do have another relay (E823B5F000835A669E902EBAE5ECCB9A324F46C9) that sometimes exhibits the same issues, but to a much lesser extent. Like it will show offline (maybe) once a month for a very short period and any flags lost are quickly regained.

2 2

[New Initiative] Tor Weather: Improving the Tor Weather
by Sarthik Gupta 19 Aug '22

19 Aug '22

Hello everyone, As we all know, nodes are the building blocks of the tor-network. More often than not these nodes require some maintenance, which could be in the form of software upgrades, troubleshooting issues, rebooting the relays in case of failures, etc. As of today, if any relay disappears from the tor-network, no one will know. Tor-Weather aims at solving this by creating a notification service which relay operators can subscribe to in order to get various types of updates for their relays. The tor-weather service will offer a plethora of notifications options for the relays. These include, the node being down, running on EOL/Outdated version, losing a flag, ranking in top 20/50/100, etc. These notifications can be subscribed & customized by the relay operators to fit their needs using a web-frontend. Folks interested in the project can refer this <https://lists.torproject.org/pipermail/tor-dev/2022-May/014734.html> thread in the tor-dev mailing list for regular updates. Suggestions are always welcomed! Please reach out to us in irc (#tor-dev) for any ideas, questions, or suggestions you might have. Thanks, Sarthik Gupta

4 6

easy way to test my exit policy
by Tom Yates 18 Aug '22

18 Aug '22

i've been grumbled at in a way that makes me want to validate my exit policy before dismissing the grumble. is there any easy way to check that, as a tor client, i can't make an outbound connection from my tor server to a particular port on a particular server? i suppose i'm asking if there's a tor-aware telnet, or equivalent. how do people test their exit policies? -- Tom Yates - https://www.teaparty.net

2 2

tor relay over wifi
by andrew reid 18 Aug '22

18 Aug '22

hi i am running a tor relay on an old phone over wifi. is this a bad idea ?

1 0

Have you experienced DDoS?
by Viktor Nikolov 16 Aug '22

16 Aug '22

Hi! My provider of server housing disconneded today at about 12:00 CET my server running two guard relays because of "very strong attack; top traffic was in tens of GBps and threatened both our internal network infrastructure, as well as the availability of the provided services for other customers; number of network flows according to monitoring was between 3-4M." My normal traffic is max. 600 Mbps and few tens of thousands connections. They will come back to me during the office hours of Monday. :-( Was somebody else also subject to DDoS today? Viktor

3 2

Flags gone after restart
by andrew reid 11 Aug '22

11 Aug '22

Hey there, I am running a tor relay off an old samsung phone. When I first started the relay, my observed bandwidth was around 4.5MB/s. It was running for around 7 days and had the stable and HSdir flag. After a few problems with IP6 and being overloaded (thought this was a problem on my end, not a DDoS attack) I restarted the phone and edited the config file to take away IPv6. It has now been running for 7 days again but my observed bandwidth is only 1.6MB/s now and I still haven't gotten the stable and HSdir flag back. How long would this take or is it just a problem on my end ? and for the bandwidth, my connection is still the same and hasn't changed. Is this just something that takes time to come back like the flags. This is my first relay so I would like to understand a bit more. Thank you

2 1

Refuse Guard flag
by Eldalië 11 Aug '22

11 Aug '22

Hello there. I have been running my (non-exit) relay without issues for some months. Recently I noticed that my ISP started to reset my IP a few hours after the node gets the Guard flag, thus making it lose such a flag (as well as Stable and HSDir). I am not sure if the Guard flag is the real cause, but it is the only condition that is verified always and only right before I get a new IP. Is there a way I can keep my node running with the same settings but preventing it from becoming a guard, to investigate if the flag is the real cause? Thanks, Eldalië -- Eldalië My private key is attached. Please, use it and provide me yours!

3 2

How useful are bridges on ports other than 80 and 443
by Eddie 11 Aug '22

11 Aug '22

Unfortunately I've had to shut down my home based tor relay because my wife's employer is mis-categorising it as an exit node, instead of the middle/guard that it really is. So, until she retires, in a few months, that relay will now be silent after about 5-years running (all of which her having the same employer. Go figure). So, I thought in the meantime I'd run a couple of tor bridges, as my IP should now be clear of any published tor node lists. But I do need to leave ports 80 and 443 open for "normal" HTTP(S) traffic, which I know are the recommended bridge ports as they raise the least suspicion. Are there any other ports that folks might suggest I use that would get enough traffic and not be blocked by a simple firewall. I also run an internal mail server, so all those ports are off limits as well. Cheers.

1 0

Setting a bridge to automatically change IP adresses
by Keifer Bly 11 Aug '22

11 Aug '22

3 3

Overload (dropped ntor) due to DDoS??
by Richard Menedetter 06 Aug '22

06 Aug '22

Hi All I have a non exit relay running on a root server (4 AMD Epyc cores, 8 GB RAM, 2.5 GBit/s Ethernet) I have limited tor to numcpus 2, relaybandwidthburst 15 MB, hardwareaccel 1, maxadvertisedbandwidth 10 MB, maxmeminqueues 3GB Usually it takes less than 1 CPU core, and like 1 GB of RAM. But recently my relay is foten shown as obverloaded. I have these LOG entries: Tor[814]: General overload -> Ntor dropped (290376) fraction 5.3451% is above threshold of 0.5000% Is this due to DDoS attacks or a misconfigration on my side? Is there something that I can do to aleviate this issue? CU, Ricsi

4 5

OT: cheap bar metal machines
by lists＠for-privacy.net 06 Aug '22

06 Aug '22

HiHo, because I switched to my own servers in colocation, I canceled some rented ones. These were all Supermicro blades 8c Opteron, 2 hd's and BMC (IPMI). https://www.supermicro.com/Aplus/system/3U/3012/AS-3012MA-H12TRF.cfm SSD: Samsung (840,850,860) EVO, SATA: WD Enterprice (WDC_WD1003FBYX) They're relatively cheap. 16 EUR + 8 EUR per 16GB RAM. So server with 16GB RAM = 24 EUR/month or 32GB = 32 EUR/month. The 16GB are more than enough for 2 Tor instances! I still operated Monero mining on 4 CPU cores. Currently there is a 10% discount (permanent) and all servers with unmetered unlimited traffic (1000 Mbit). All with no setup fee. https://servdiscount.com/ The same applies to the new servers https://www.webtropia.com/ You can rent the servers prepaid or with a term of 1,3,6,... months/notice period. Hints: If you set up a customer account beforehand, you can upload your SSH keys for server setup. When setting up, select Raid1 (mdraid on Linux) directly. If you have any questions, please write to me personally. German or English. -- ╰_╯ Ciao Marco! Debian GNU/Linux It's free software and it gives you freedom!

1 0

Re: [tor-relays] tor 0.4.6 reached end of life
by torserver 03 Aug '22

03 Aug '22

Hi, on my Raspberry Pi 4 I can 't update from 0.4.5. The armhf architecture seems to be the problem. How do I have to upgrade to the newer versions? So far I haven 't found the ultimate way to setup a TOR relay on a Raspi 4 with auto updates. Greetz ghostbuster > Op 02-08-2022 14:00 schreef tor-relays-request(a)lists.torproject.org: > > Subject: [tor-relays] tor 0.4.6 reached end of life > > If you still run tor 0.4.6, now is a good time to upgrade your tor version. > > the list of largest operators still running end of life tor versions: > https://nusenu.github.io/OrNetStats/#end-of-life-relays-share > > https://nusenu.github.io

2 1

Please update your Snowflake proxy
by gus 03 Aug '22

03 Aug '22

Hi, If you're running Snowflake proxies, please read and share the message below. Thank you! Gus ------------------------------------------------------------------------ Please Update your Snowflake Proxy to help us rollout Distributed Snowflake Server Support https://forum.torproject.net/t/please-update-your-snowflake-proxy-to-help-u… At Tor, we are constantly trying to improve Snowflake to make it accessible to more people. This means we are currently working on enabling horizontal scaling of Snowflake to distribute the traffic to more than one server. After this update is roll outed, users will be able to choose one of the secondary snowflake servers as the connection target and reduce the traffic load on the default server. However, this change requires an updated version of the snowflake to be rolled out. This means this change is not live until enough proxies are updated to the most recent version and after we start to reject the previous version of snowflake proxies. For this reason, we would like to request you to update the version of your snowflake proxy, if you haven’t done that yet. Here are some guides on how to check the version and/or update the most recent version of snowflake: ### WebExtension on Firefox To check the version: go to about:addons. Click the 3 dot symbol on the right of Snowflake, and then select manage. you will be able to check the version of Snowflake. It should be 0.6.1. To update: Click the gear symbol on the top of the page, and then select check for updates. ### WebExtension on Chrome To check the version: go to chrome://extensions/?id=mafpmfcccpbjnhfhjnllmmalhifmlcie, and you will see the option to update the snowflake WebExtension. It should be 0.6.1. To update: go to chrome://extensions/ turn on developer mode and then select update. ### Standalone with Docker To check the version: docker run thetorproject/snowflake-proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: docker pull thetorproject/snowflake-proxy ### Standalone with Go Toolchain To check the version: proxy -v should include “-allowed-relay-hostname-pattern” in the output. To update: go install git.torproject.org/pluggable-transports/snowflake.git/v2/proxy@latest -- The Tor Project Community Team Lead

1 0

When will relays disappear form tor metrics
by Anders Burmeister 02 Aug '22

02 Aug '22

Hi heroes Ended and deleted my two relays Aerodynamik02 and Aerodynamik03. When can I expect they will disappear from tor metrics?https://metrics.torproject.org/rs.html#details/EFEACD781604EB80FBC0… Best regards Anders

2 1

tor 0.4.6 reached end of life
by nusenu 02 Aug '22

02 Aug '22

If you still run tor 0.4.6, now is a good time to upgrade your tor version. the list of largest operators still running end of life tor versions: https://nusenu.github.io/OrNetStats/#end-of-life-relays-share -- https://nusenu.github.io

1 0

An attempt to block spam ip addresses
by Toralf Förster 02 Aug '22

02 Aug '22

Issue 40636 and others deal with DDoS / concurrent connections. Here're few numbers from my attempt [1] of the last days to block such ip addresses. The stats are from 2 relays running at the same ip. Currently there're 700 ip addresses (15 IPv6) caught in the denylist. Those either opened >4 connections to the same orport and/or produced >12 new connection attemps within 5 minutes to the orport. Those system do re-appear quickly if the denylist is flushed. Within one hour over 500K packets, mainly TCP connection attempts, are dropped. Furthermore the number of used sockets at the system is reduced from >35K to about 21K. Nevertheless both relays spew the warnings "Your computer is too slow" and "General overload" from time to time. I do assume that this is a layer 7 problem and therefore can't be fixed at layer 3. The filter is build up from iptables. Scripts for IPv4 and IPv6 can be found under [2] and [3] respectively. [1] https://gitlab.torproject.org/tpo/core/tor/-/issues/40636#note_2821683 [2] https://github.com/toralf/torutils/blob/main/ipv4-rules.sh [3] https://github.com/toralf/torutils/blob/main/ipv6-rules.sh -- Toralf

1 0

Impact on running a tor relay on other internet services?
by Thoughts 28 Jul '22

28 Jul '22

Hi all - I've been running a TOR non-exit relay for several months now. Its rare, but I'm seeing what I believe is the occasional connection attack, with my relay complaining about the number of connections and suggesting I reduce capacity. Those are rare, and most of the time my server is running at about 20% CPU. During attacks, which seem unrelated to my Tor Upload/Download rate, CPU jumps to well over 100% (quad core, so 400% is max). I'd normally just ignore this, but it seems to be impacting other aspects of my network experience: Messenger Rooms will unexpected close, NetFlix gets "unable to stream this title", family complains about slow and dropped connections, etc. Just had it happen a few minutes ago with a Messenger Room and sure enough, CPU is at 130%, even though I'm only pumping about 15MB/Sec (37.5MB/S limit, 56.2 burst, 40.3 observered) over my gigabit ISP connection. Speedtest shows the performing within acceptable parameters. So contemplating what I can do, since this is bothersome. I've come up with a few alternatives, and curious about your thoughts: 1) Do some type of connection limiting at my PFSense Plus firewall. Perhaps limiting things to, say, 30 connections per IP address? Not even sure that is possible, but figure it might lighten the load on the TOR server. 2) Drop being a TOR non-exit relay and convert to a bridge. Not sure how long, if ever, it would take for my IP address, which is now public, to fade off of block lists... Not ideal, but at least as a bridge I'd still be servicing the environment. 3) Try connection limiting via iptables on the TOR host. Just seems like doing that at the firewall would be better. Thoughts? Kevin

1 1

relay memory leak?
by Fran 26 Jul '22

26 Jul '22

Hey, new non-exit relay, Debian 11, tor 0.4.7.8-1~d11.bullseye+1, ~ 1 week old (-> no guard) KVM VM with atm 4 cores, host passthrough AMD EPYC (-> AES HW accel.). As can be seen at the attached screenshots memory consumption is irritating as well as the quite high CPU load. All was fine when it had ~100 Mbit/s but then onion skins exploded (110 per second -> up to 4k per second) as well as CPU and memory. Tor complains: > Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. And from time to time memory killer takes action torrc is pretty basic: Nickname 123 ContactInfo 123 RunAsDaemon 1 Log notice syslog RelayBandwidthRate 2X MBytes RelayBandwidthBurst 2X MBytes SocksPort 0 ControlSocket 0 CookieAuthentication 0 AvoidDiskWrites 1 Address xxxx OutboundBindAddress yyyy ORPort xxxx:yyy Address [zzzz] OutboundBindAddress [zzz] ORPort [zzz]:xxx MetricsPort hhhh:sss MetricsPortPolicy accept fffffff DirPort yy Sandbox 1 NoExec 1 CellStatistics 1 ExtraInfoStatistics 1 ConnDirectionStatistics 1 EntryStatistics 1 ExitPortStatistics 1 HiddenServiceStatistics 1 Ideas/suggestions (apart from limiting BW) to fix this? Thanks fran

3 5