- tor-relays - lists.torproject.org

Fwd: Potential vulnerability found in your Tor Relay
by krishna e bera 19 Dec '25

19 Dec '25

Hi all, Just got the below notice from researchers. Is the stated vulnerability an actively exploited problem or is this a DoS attack by scaremongering? This topic seems to have been covered in https://nusenu.medium.com/how-vulnerable-is-the-tor-network-to-bgp-hijackin… but i am not sure how to apply it to my situation. I have turned off the Guard capability for now. Doubtful i can influence the service provider to get them to publish a new ROA. Is there another mitigation? Regrets to all who were using the service :( -------- Forwarded Message -------- Subject: Potential vulnerability found in your Tor Relay Date: Thu, 18 Dec 2025 23:57:20 +0000 From: ENGR - SIDR Hello, We are writing to alert you that your Tor relay(s) (Pasquino3) is/are vulnerable to active BGP attacks that could be used to de-anonymize users. The best mitigation to help protect your relay is to have your service provider publish a ROA for prefix(es) 209.44.96.0/19 at AS(es) 10929 with a maxLength(s) of 19. We are researchers from the University of Connecticut reaching out to inform you that your Tor guard relay with IP address(es) 209.44.114.178 (Pasquino3) is/are currently covered by a Route Origin Authorization (ROA) which has an improperly configured maxLength attribute. This makes it vulnerable to BGP subprefix origin hijacks, where a malicious autonomous-system-level attacker may announce a subprefix of 209.44.96.0/19 and misdirect traffic destined with a high (>99%) rate of success. Guidance on how to correctly set the maxLength attribute is contained in https://datatracker.ietf.org/doc/html/rfc9319. We determined this vulnerability using public data sets including relay information from the Tor consensus, the RIPEStat data for IP prefix, and ROA coverage information. Feel free to contact us if you have further questions. For further information on ROAs, see https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/bgp-origi… If you are not a Tor relay operator and this message reached you in error, please let us know. Thank you, UConn Secure Interdomain Routing Group

6 5

automatic exit restriction policy does not include IPv6
by Marco Moock 18 Dec '25

18 Dec '25

Hello! I noticed that the implicit exit policy includes IPv4 localhost, RFC1918 IPv4 ranges etc, but does not include IPv6 by default, e.g. ::1, fe80::/10, fec0::/10 and not the public IPv6 itself. Is that a bug or a configuration issue? -- kind regards Marco Send spam to abfall1766003955(a)stinkedores.dorfdsl.de

2 3

Re: DirPort IPv6
by Marco Moock 05 Dec '25

05 Dec '25

On 04.12.2025 20:22 DiffieHellman <mailing_list(a)middlendian.com> wrote: > Reviewing a lot of contradictory information online and the tor > ChangeLog and torrc.sample, it appears that the DirPort supports > IPv6, but only authorities actually advertise directory information > anymore. > > There is still the secondary DirPort use, to serve the tor exit > notice (DirPort 80\n DirPortFrontPage /etc/tor/tor-exit-notice.html) > - which seems to be only targeted at those who see abuse and decide > to put the IPv4 address into a search engine and realise that it's a > tor exit (it seems that an assumption has been made that such sort > typically manages broken networks that are IPv4-only and therefore > listening on IPv6 wouldn't achieve anything). Thanks for the clarification. The note about this in the default torrc is outdated. -- kind regards Marco Send spam to abfall1764876123(a)stinkedores.dorfdsl.de

1 0

My exit isn't listed at https://check.torproject.org/exit-addresses
by Jon 04 Dec '25

04 Dec '25

Hi All, My exit 128.31.0.13 https://metrics.torproject.org/rs.html#details/A53C46F5B157DD83366D45A8E99A… is no longer listed in https://check.torproject.org/exit-addresses This is causing an uptick in abuse complaints to my upstream provider and making their stock response to check there a bit of a lie. metrics seem to show the relay is in good health and has a 14d uptime (since last package update). any idea what's going on with that? Thanks, -Jon

2 1

Re: Out-of-Memory-Attack & DoS from Tor-Client
by ProSecureRelays 04 Dec '25

04 Dec '25

Hi there, It's very unfortunate, but I don't have the Logs due to initial mistake I made, not setting up a Logfile. In the updated torrc file, i recently added it but I thought it is not worth a restart to implement this. Now it works. But I saw the relay logs in the cmd during the attack, and there was nothing unusal at all, except for the high rejection rates. The Out-of-Memory was also an Error that came from Windows, not the tor-process itself. I'm a bit positive surprised by the Windows Memory Management, all System Processes and the OS were unaffected by the attack. Additionally I have an powershell-script that monitores the tor.exe and restarts it after 2 minutes of "cool-down" if it crashes for 3 times. This was the first time it was ever needed, and I hope next time is not soon. Then I will also try the stupid oversize approach.. ;) About the Firewall Topic: I've read this manual you sent before, but I think its impossible with the windows firewall implementation. That's one weakness of closed source, either it matches the use case or you have to go for something completely different. The Windows Firewall is not statefull, but I had implemented very restrictive rules since the first day. However, this is limited by allowing only the tor.exe and related stuff to send and recieve traffic. If you would try to open a new process not listed, communication would fail. But fancy "real-time" stuff - not a chance. I mean creating some rules via powershell no prob, but how to analyse the concurrent, tor related connections (grabbing netstat?!) - sounds difficult and ressource heavy to me, and I'm sadly not a coding expert. In total there are 3 Firewalls between Internet and Tor, one Open-Source, one proprietary and the Windows Firewall, maybe I can stop this happening at another point in the network. I'll dig a bit deeper when I have the time, next step planned is implement Windows Applikation Control, so only the tor.exe I've made a checksum beforehand, is allowed to run. But thats a different topic. Thank you very much for your suggestions and maybe other hints/tips! Best regards, Joker

3 2

Out-of-Memory-Attack & DoS from Tor-Client
by ProSecureRelays 04 Dec '25

04 Dec '25

Hi there, i just want to report two partially successfull DoS Attacks on my Relay: First attack: Occured yesterday. The tor process showed massive traffic, much more my upload ( 45 Mbits) could handle. I don't know how in detail this worked, but I had receiving traffic at about 40Mbits and the relay tried to send about 100Mbits towards WAN. Because I didn't know if this was harmful traffic for the tor network, I finally pulled the plug and obtained a new IP after about 4 hours into the attack. I had the feeling that a short time, there was still unusual sending/recieving ratio, but all related to tor.exe and it stabilized soon after. My Guess ist hat a malformed packet was sent by tor, resulting in uncontrolled, unknown traffic to the WAN-Side. The Realy had 3 DDoS Circuits killed, rejected circuits and introduce 2 at unnormal high rate, also like 117 marked addresses. It sent about 250GB more then it recieved. The attack is also clearly visible in Tor Metrics, a massive spike in written Bytes can be seen. Fingerprint: 8AFE4E6F05234B0184327C052B09F10191EAFAF3 Second Attack (today): Today at about 2 p.m., the memory of the relay spiked to maximum (8GB) and additionally 22GB of virtual memory was used. This caused the process to die, with an out-of-memory Error. This also must came from a malformed packet in tor. Is there any known method to circumvent both of these Issues? In the first event, i don't know if the error could have cleared self after some more hours. Regarding the memory issue, i think this must be resolved in the tor software itself, allthough I thought about adding 64GB of RAM and 256GB Page-File, just to see if it makes any difference in case of attacks. But I don't think so. Best regards, Joker

6 7

Add CGNAT 100.64.0.0/10 to Default Exit Relay Reject Policy
by admin＠likogan.dev 03 Dec '25

03 Dec '25

Hello, I've noticed that the non-publicly routable CGNAT subnet of 100.64.0.0/10 is not in the default exit policy reject list like 192.168/16 and 10/8 are. This range is not publicly routed, and should never need to be accessed from a Tor exit. Tailscale and other ISPs use this block. How many exit relays connected to a Tailscale network are unknowingly exposing all of their other Tailscale devices to the Tor network? ISPs may be less willing to allow exit relays if there are bots using Tor to toy with the ISPs 100.64/10 range. Maybe there is something I am missing for it to not be included? Thanks, Likogan.Dev

3 2

DirPort IPv6
by Marco Moock 03 Dec '25

03 Dec '25

Hello! Does DirPort support IPv6? If I use it without address, it only listend on the IPv4 socket. If I use DirPort [::]:9030, it cannot start up. -- kind regards Marco Send spam to abfall1764741021(a)stinkedores.dorfdsl.de

1 0

Small update to Relay Operator Expectations Policy
by Georg Koppen 02 Dec '25

02 Dec '25

Hello! We just pushed a commit to update our Relay Operator Expectations Policy[1] to version 2.1. It comes with a clarification for section "3. Make sure your relay isn't broken", where we now say "Don't block outgoing connections." instead of "Don't firewall outgoing connections." This makes the point we try to convey in that particular part of the policy clearer. For context, this topic got raised in a recent thread about Hetzner related issues[2] and, while we improved the wording of our expectations document and updated the bad-relay criteria accordingly, we are not done on that front yet. There is still a ticket open for investigating potentially acceptable solutions dealing with the underlying issue at Hetzner on a technical level[3]. Depending on that outcome and after thinking through filtering/rate-limiting concerns we might need to update the expectations document in the future again. Thanks to everyone who helped so far both with the technical investigation and policy discussion. Georg [1] https://community.torproject.org/policies/relays/expectations-for-relay-ope… [2] https://lists.torproject.org/mailman3/hyperkitty/list/tor-relays@lists.torp… [3] https://gitlab.torproject.org/tpo/network-health/analysis/-/issues/105

1 0

Split Horizon Tor+Mastodon
by Jon 01 Dec '25

01 Dec '25

Hi All, I'm working on https://domum.social a Mastodon instance that does not collect email addresses and only allows authenticated access via the tor hidden service URL: http://f3rz5puehnq7dfqqwajxu3izuovb6wqepof3prqesle76qyfivlfxgyd.onion Federation to and from the regular clear-net fediverse works as normal. While there's a number of Mastodon instances that have onion addresses and at least one I found that doesn't block well know disposable email addresses like sharklasers.com, this puts a high burden on the user. My technical goal with domum.social is to make privacy the default so you can't accidentally login outside Tor and there's no opportunity to enter an identifiable email address. Socially a lot of documentation is needed so that a general audience can understand how to evaluate their own threat models and manage their own operational security. I've been working on the site off and on since last April and running live with myself as the only user for about a month. Before taking on real users I want to open the concept and implementation to wider scrutiny. I'm an infrastructure person not a a programmer by trade so hopefully it's not too ugly. I tried to keep code over rides to a minimum with nothing in tree. This repo has all the Mastodon related overrides: https://github.com/domum-social/mastodon-additions There's a bit more special sauce in the proxy config to disallow access to the authentication endpoints on the clear-net site, and to ensure rewriting of clear-net URL that mastodon generates to the onion URL when accessed through the hidden site. The mail server config is also a bit special so most users get their fake internal email discarded but Admins and Moderators (who are nonymous) can get real mail deliver to be notified or any issues. Depending on feed back, I'm hoping to start a limited public beta in about a week. Any and all thoughts are appreciated here, or on Mastodon @jon@domum.social Thanks! -Jon https://metrics.torproject.org/rs.html#details/A53C46F5B157DD83366D45A8E99A…

2 1

Regarding DNS reliability testing for relay operators
by relayadmin 01 Dec '25

01 Dec '25

Hey all, I've spent a good part of the fall learning about Tor, and I'm excited to start contributing as a relay operator. DNS seems to be a significant point of confusion. I posted about this a few weeks back (https://forum.torproject.org/t/best-practices-for-dns-local-vs-external-res…) and got a helpful response from NTH, but there still seems to be uncertainty around DNS performance. That inspired me to run some tests that might help current and future operators set up more reliable and private DNS. My plan is to run three separate hosts with identical OS/resources and torrc configs, but with different DNS setups based on the three most commonly recommended configurations: - Node 1: Runs a local Unbound server using itself as the resolver - only contacting recursive resolvers from the node. - Node 2: Runs an Unbound server on an external IP used by the relay as an upstream resolver, ensuring queries aren't made over a Tor IP. - Node 3: Uses the ISP's local DNS configuration (no changes from the “out-of-the-box” setup). Is there another configuration worth testing that I haven't listed here? Have anyone here conducting similar testing? Feel free to email me directly. I still need to get more comfortable with Prometheus and Tor metrics before I feel ready to run the nodes, so in the meantime I'd really appreciate hearing your thoughts on this kind of contribution. Happy December 1st everyone. Riley

2 1

Re: Bridge Operation IPv6 only - possible?
by ProSecureRelays 01 Dec '25

01 Dec '25

Hi there, the Bridge is working right now as expected - i was confused to see the boostrapping not in the CMD but finally found it in the Notice file. Beginners fault, I was literally working the whole time. For testing I added IPv4 Support, but I will remove it now, because I'm afraid people getting busted as tor user, when Relay and Bridge-Obfs-Interface share their addresses - and I think for good reason. The simple torrc option "IPv6Only" should do the trick. Is there any additional site to look up the bridge aroi state? From what I saw was 1aeo only tracks the relay stats (huge thanks for this!) Best regards Joker Von: Jan Scherer via tor-relays [mailto:tor-relays@lists.torproject.org] Gesendet: Sonntag, 23. November 2025 20:35 An: tor-relays(a)lists.torproject.org Betreff: [tor-relays] Bridge Operation IPv6 only - possible? Hi there, I have two questions regarding bridge operations: Is it possible to run an obfs4 Bridge with external-reachable IPv6 only? I've tried to setup a "Node" on a seperate host, but in the same network as my relay. (VLAN-seperated) The idea was to open all external ports required for the tor part (on IPv4 and IPv6) and assign one different IPv6-Address as External obfs Port. I generally thought this could be beneficial, as with every firewall restart I get new IPs and potentially evade blocklists. From what I read there is a higher demand of bridges at the moment due to russian and chinese "ip whitelisting" attempts. Overall, the Networking Scheme would look like this (from Firewall-View) -------- WAN Source Target IP-Ver Port Desc. WAN Tor-Relay IPv4/6 30003 Allow Incoming Relay-Traffic WAN Tor-Bridge IPv4/6 30004 Allow Incoming Bridge-OR Traffic WAN Tor-Bridge IPv6 56120 Allow Incoming Bridge-Obfs4 Traffic -------- DMZ Source Target IP-Ver Port Desc. Tor-Relay "WAN" IPv4/6 * Allow Outgoing Relay-Traffic Tor-Bridge "WAN" IPv4/6 * Allow Outgoing Tor/Bridge Traffic -------- The Bridge is starting but freezes in a state before any major bootstrapping happened. (see Logs attached) I can see outbound and inbound traffic on the tor ports (30004), but not on the bridge ports. I assume the Tor part is "partially" working. In the Log: Is the last line [notice] Opened Extended OR listener connection (ready) on 127.0.0.1:50652 - is that an internal Port or the port that I want to be 56120? Maybe someone could give me hint if this frankenstein construct is even supposed to work (like having a bridge with only public IPv6 Adress) and If there are any security constraints. Second Question: Should I exclude my own relay as Guard? Other thoughts: To improve privacy for the bridge even more, i thought about adding a second Interface to the VM, and work with IPv6 ULA and NAT for the needed Tor Connection. E.g. Pick any GUA from the External Availabe IP-Range and NAT it to ULA "fc55:c737:c747:c757::cafe" and do also Outbound NAT to the GUA again to not confuse the peers. But this is for another time. Last point, maybe it makes you smile about my stupidness.. I took alot of thought into physical security of my server, last Step was to trigger a Bitlocker-Lock, when the Chassis is opened. Unfortunetaly, the Chassis_Intrusion Implemetation of the Board is not great, so I ended up with connecting the Chassis Switch onto the CLR_CMOS Header. "Perfect Solution". When you open up the chassis, the system immediately resets and due to PCR Missmatch, the drive cannot be decrypted. I have removed any "Recovery Options" from bitlocker, so no 40 Digit Number you may enter in this case. If not planned, during a normal boot the TPM + Key-File + Pin would be needed to unseal the drive. I'm using TSME as additional layer of protection, so all of my ram is enrypted and cold boot attacks are not an option anymore. The measured performance impact was only about 6% in my case. It can be enabled in the Bios. To prevent DMA Attacks, I disabled USB-Support, Audio, SATA and there is even no free PCIe Slot or any other interface on the Board. Reason for all of this is that I may want to spread some more relays, and I cannot guard them or ensure that they are 100% safe from physical tampering, so I want them to just go down immediately when someone messes with them. If you have any more thoughts/improvements, let me know. After this long mail, I'm pretty sure you will all sleep well! Best regards and a nice start into the week! Joker

2 1

Getting IP reputation services to use ExoneraTor?
by forest-relay-contact＠cryptolab.net 30 Nov '25

30 Nov '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. A discussion with a hosting provider led to them making a suggestion after I showed them https://metrics.torproject.org/exonerator.html, so I thought I'd explain his suggestion and post it here. Nowadays, a huge number of hosts are familiar with Tor and sympathize, but do not allow exits because it severely taints their IPs and makes them difficult to resell afterwards. With the rising costs of IPv4, it is a deal-breaker even if the host would otherwise be fine with exits. Obviously, convincing IP reputation services and blacklists to make an exception for Tor is impossible: It goes against their mission. But has anyone tried advocating to these reputation services that they remove exit IPs from blacklists once they are no longer exiting traffic? This would reduce the number of false positives in their database without increasing that of false negatives (which is all they care about). I imagine hosts would be much more amenable to hosting exits if the subsequently blacklisted IPs revert to being clean as soon as the exit operator leaves. After all, "if I'm your customer, the IP ranges I use will be tainted for a long time and potentially unsellable even after I leave" is not going to inspire as much confidence as "if I'm your customer, the IP ranges will only be dirty while I use them". Is there anything to this? Large exit operators can just register their own ASN and simply not care about blacklists, but most operators are not going to be able to do this, especially if they run just a couple relays anonymously and on a tight budget. Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmkrjRgACgkQBh18rEKN 1gvHJQ/9FJBMMFJ86hCR1OE4n9ONwAsP7CxB4MBO58mUz+bN40Ngzv/N+Ih0BaQf 8qYEcHeEaYp7IB+/OFJS3hTOZDZYCdXU7nocxZgZ5l4k4e68JnyyNSio/zMu5tHk GUeQd10wZXxQnzBgdfDlj2tyCMUkWlzcvgxTaqk7scHuEk1kwfyixvcfbgMQL7T8 nWqik8BTzKYuS6zimks4MQsl8viE2dpOaWkz4xtm4EPUlQv1kh2N3c7JO0vFyC3s Q1ad/4VmlZQ3lgOO++0B3CSJ/6Fh2hYGYJm8B2Fe1nSdZ/SY1+mLYr0KupM53tEL FKsnXliqyIMVExBW5MlxoGlK4AQ3AkbrafkpUSPvNsvjmu94GHrg2Y1jcefSelFO zd34lfRmDaNE1yoxL1ehxYIEJGbwkMnxU4+FC5tnHxcWM8gtE499kFu4+5JCFiBu i2ldLycdIEaez2mb8VbXHXdwjAQy8dVlFaHVua26riirVoKmTgKEJ+wnVkCbAF8W 8ZUQVVRQIwJyo2dlcNGrwGwZ5BtzXFtYiJfmqE4yesc7MESQsqb02kWlPVEVTCyq UMDzVa+W08xhTr+c9iaFIC8scmZCoI0zOpFiqBUofIR9NWKszccXrJbOdF3vDkNJ ZGquAzEnrwwhB9Zj3QLoz05AUzlmLtWd0u30gqZ8zMMx5KSs9iY= =IVGe -----END PGP SIGNATURE-----

1 0

Exact criteria for receiving a BadExit flag
by forest-relay-contact＠cryptolab.net 27 Nov '25

27 Nov '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. I contacted an exit operator who had BadExit flags on the same host that I run an exit on and we discussed possible reasons for this. Eventually, we jointly set up a new relay on that host and I configured it exactly as I had configured my own relay, and it still obtained the BadExit flag. So far, these are the exact steps I took to configure it: - Unbound is configured to use a second, clean IPv4 - sysctls are tweaked to ensure conntrack does not drop connections - torrc is configured with safe, sensible exit defaults And it still obtained a BadExit flag. We had discussed whether there was a possibility that his family was "tainted" and somehow the BadExit flag was being applied to new exits on his relay family, but starting up a new relay unrelated to his did not help. We tried disabling Unbound and instead using a popular upstream DNS resolver, but that did not prevent a BadExit from being issued either. What other troubleshooting steps are suggested? The provider does not censor or block anything, and I have been successfully running an exit on their infrastructure for more than a month, but when he sets one up, even if he configures it identically to the way I configure mine, it receives a BadExit flag within a matter of days. The criteria for issuing the BadExit flag do not seem very clear. Since it is not a flag intended to be issued to malicious exits, I would like to understand the exact criteria for being issued a BadExit, beyond the vague explanations that I can find on the Gitlab. Note that I am only asking about the automated flag, not about the (potentially sensitive) policies behind determining whether or not a relay is malicious and should be manually excluded from the consensus. Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmkmGG8ACgkQBh18rEKN 1guZhxAAxUFcZm1SuoCO5OOST915LtPPmZ6mizq+NUfS3tPoJj6zKRd/grZJYIRj TZzw7JqK62ajtMJLQcLLKuMNMHYZmzr0DP8jVo/JAoh/rcGIqXL+jWIupDDxIQG7 Mf25OF6OrhNb23HTwrudJIiM/PFH6Yyoj0hlDBxpSu3IcopP9xxPwPKYXQjgaZEx mJPpbTb86vrs1TmBQ7C7W6pBoq6zOtne2NfqC6SJ1UNpk/dYxQnknuFYLDeaSPdz qNkh/h2Ua0a0ASGswxTRatd2epkDKrJHoVJ5t/WBPnzPOUJdo6D26oLr1bKzSTM1 +nKkd5ws5b2d8Fi+FQk7LbgiLBSdGAIFL3bBL3FD5ERE+1LkOTaOs9wR0dlIFNRV 4draROjsgfYIw0LavO+O8EEbS5R5xyf5RNIueNMpqbV/IGhoYLYUUfdqITB1swHr jFaEUoNIFAvBS1qp+9ApjmQJ/J2CiPZJ7Su73v6vA9Qq6Amv3ruMK+w5sqO1BpFB V9L/pr/ZB3619SyqMVN2e+M58xDumwwMTHK1AVIGHZLlff5VYR4rBtqXR1T0qPKl AdliLh39C+oBFD0q+12tbucjjJjg8LiiZfo7KReZDpN78zJWxtR+Z57/XfXYDqJd 9FDJdYAm4qLa9wEzAUslEdrfGnokYJQQcI07eNqPFgnl4B80V4I= =N2Ia -----END PGP SIGNATURE-----

2 2

Could you post an i386 build for Trixie?
by Dawn Flood 26 Nov '25

26 Nov '25

Good Day, I am going to upgrade eventually to Debian Trixie 64-bit, but it would be so very wonderful if a i386 build with the most recent stable changes could be posted here with the appropriate updates to the 'Release' file (to include the i386 architecture): https://deb.torproject.org/torproject.org/dists/trixie/ Thanks so very much!! Dawn

3 5

OrNetStart AROI
by Michele Branchini 26 Nov '25

26 Nov '25

Hi there ! i was able to verify 19 out of 20 relays i operate on the OrNetStats website. sadly, the 20th has not passed the verification because i wrongly copy-pasted (tbh, that requestes some talent...) the fingerprint of that relay in the DNS. Now it is fixed, i have waited 24h, but still i can see the relay not verifying correctly... https://nusenu.github.io/OrNetStats/w/family/67ea5c7dbbbdc7c79990999b903c90… <-- family https://nusenu.github.io/OrNetStats/w/relay/91D66445EBE11BB058E9ED1ED92C7FE… <-- the relay itself I have also checked the relay family with https://aroivalidator.1aeo.com and there's all 20 seems verified correctly. ----------------------- "nickname": "TheShadowRoute19", "fingerprint": "91D66445EBE11BB058E9ED1ED92C7FED325F62E4", "valid": true, "proof_type": "dns-rsa", "domain": "antr.ax", "validation_steps": [ { "step": "DNS TXT lookup", "success": true, "details": "Found valid proof at 91d66445ebe11bb058e9ed1ed92c7fed325f62e4.antr.ax" } ], "error": null ----------------------- OrNetStats runs at which frequency ? Thanks, M.

2 1

Intentionally obtaining a MiddleOnly flag
by forest-relay-contact＠cryptolab.net 24 Nov '25

24 Nov '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. Is it possible to run a relay that is not an exit *or* guard? I found a host with an AUP that states that Tor exit, entry, and bridge relays are prohibited. After messaging their customer support, they mention that middle relays are fine as their only concern is to avoid bringing in customers who harm the IP reputation of their services. Of course, their AUP is a little silly and likely stems from a misconception of the Tor network, especially if they allow middles but not guards. I did ask them if they could change the AUP to be more in-line with their intentions. Although I doubt any harm would come from it if I did run just a regular non-exit, it might be a good idea for me to avoid it becoming a guard, just in case they end up prioritize an over-literal interpretation of the letter of their AUP. Is there a way to do this, without intentionally interfering with the relay's stability or performance? Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmkjYDIACgkQBh18rEKN 1gtD1w//ZUIYZmpqsuBF1sK56iMomZFBbqaf5L9ZRf+az034SVlVPvxtTGK95P87 wlkTF+VJzmkARPoH3tjsmBTl3VLtjnawUHstB7yrJ0QDfl7v9l2bEWZ5kMM1/aiB zDGrzoX8xN4Rq6VLFOkot0dB2nIy4MoQUkV0WYvKeHy+A0eQBgaObXXXEw86oNeX Vb2nO1fkEKLJZZgYyUsaIw7+duI1VWCAvHMz/sNk7sMXk5lNAFStrYYGdjlnqtZh wwQ0xFrRQhwlc9LS4FWjQRvSYMHxL8kFvzqKs98l/gGx1AZTXszW8BFf+rYWWTDY aICpMuqF72vtZZuLoaiCYuPro+SRcRbaC+zyt6GqkAbTzqok5wrr3D/gIJAV7vnH xpghje2y7+6JdssckMwtWanfQvE7yo3eVHrbxgwlrwL46UfdRphHiH5T1kaNE+hu Xxl9SSZj61iyk/k7P2rgihTFdhRFxgRPzviDrhd8neaE7dKp33mmWPr1mgM6vrK8 tb2a3Z6tWoPhxZcRAe6hFJDpqmZjOFO6JeTr6FngkG7R2ZlfGz/auB80dY7KETW4 cYEBwgbZ5qukDFfA3LwnLhKDNmQXpgHZET+vY40Cyl8uKtFt4hnlhllbvnP4NwVQ IYLYlKrRttEAempYGbvwTfyH7vqDCK6sin1i+IiXCuY/cP+r1II= =c7AV -----END PGP SIGNATURE-----

1 1

Sybil Attack on 2025-11-20 - please setup your AROIs :)
by nusenu 23 Nov '25

23 Nov '25

Hi, as some of you might have noticed, yesterday 2025-11-20 someone added ~900 new tor relays to the tor network. They used nickname schemes from other operators: * NTH * prsv * Quetzalcoatl * for-privacy.net * relayon * DFRI * bauruine ... For this reason I wanted to encourage every operator, especially the large once to setup their AROI. Here is a howto: https://nusenu.github.io/OrNetStats/aroi-setup Why? You get nice timeseries graphs of your relays. example: https://nusenu.github.io/OrNetStats/artikel10.org.html And it helps to **automatically** tell false-friends apart especially since families have become so large that we can no longer use that as a good signal because family must be splitted if they become too large for the descriptor limit. A good example is nothingtohide.nl, all of their relays have a proper AROI configuration and they verify properly: https://nusenu.github.io/OrNetStats/w/contact/aa738469b86e5ea8838d95eb2b8e6… Here are 3 examples of large relay operators where AROI verification fails (partially): If you are one of them or if you know them please ping them if you can: * quetzalcoatl-relays.org https://nusenu.github.io/OrNetStats/w/contact/b32573fcfbc780a4b9ef03425f676… * emeraldonion https://nusenu.github.io/OrNetStats/w/family/34933fa4f34ef248c8484749587002… * prsv.ch https://nusenu.github.io/OrNetStats/w/contact/65a4a24bfc53c4c6c0d312ce29ab7… kind regards, nusenu -- https://nusenu.github.io

7 8

Bridge Operation IPv6 only - possible?
by Jan Scherer 23 Nov '25

23 Nov '25

Hi there, I have two questions regarding bridge operations: Is it possible to run an obfs4 Bridge with external-reachable IPv6 only? I've tried to setup a "Node" on a seperate host, but in the same network as my relay. (VLAN-seperated) The idea was to open all external ports required for the tor part (on IPv4 and IPv6) and assign one different IPv6-Address as External obfs Port. I generally thought this could be beneficial, as with every firewall restart I get new IPs and potentially evade blocklists. From what I read there is a higher demand of bridges at the moment due to russian and chinese "ip whitelisting" attempts. Overall, the Networking Scheme would look like this (from Firewall-View) -------- WAN Source Target IP-Ver Port Desc. WAN Tor-Relay IPv4/6 30003 Allow Incoming Relay-Traffic WAN Tor-Bridge IPv4/6 30004 Allow Incoming Bridge-OR Traffic WAN Tor-Bridge IPv6 56120 Allow Incoming Bridge-Obfs4 Traffic -------- DMZ Source Target IP-Ver Port Desc. Tor-Relay "WAN" IPv4/6 * Allow Outgoing Relay-Traffic Tor-Bridge "WAN" IPv4/6 * Allow Outgoing Tor/Bridge Traffic -------- The Bridge is starting but freezes in a state before any major bootstrapping happened. (see Logs attached) I can see outbound and inbound traffic on the tor ports (30004), but not on the bridge ports. I assume the Tor part is "partially" working. In the Log: Is the last line [notice] Opened Extended OR listener connection (ready) on 127.0.0.1:50652 - is that an internal Port or the port that I want to be 56120? Maybe someone could give me hint if this frankenstein construct is even supposed to work (like having a bridge with only public IPv6 Adress) and If there are any security constraints. Second Question: Should I exclude my own relay as Guard? Other thoughts: To improve privacy for the bridge even more, i thought about adding a second Interface to the VM, and work with IPv6 ULA and NAT for the needed Tor Connection. E.g. Pick any GUA from the External Availabe IP-Range and NAT it to ULA "fc55:c737:c747:c757::cafe" and do also Outbound NAT to the GUA again to not confuse the peers. But this is for another time. Last point, maybe it makes you smile about my stupidness.. I took alot of thought into physical security of my server, last Step was to trigger a Bitlocker-Lock, when the Chassis is opened. Unfortunetaly, the Chassis_Intrusion Implemetation of the Board is not great, so I ended up with connecting the Chassis Switch onto the CLR_CMOS Header. "Perfect Solution". When you open up the chassis, the system immediately resets and due to PCR Missmatch, the drive cannot be decrypted. I have removed any "Recovery Options" from bitlocker, so no 40 Digit Number you may enter in this case. If not planned, during a normal boot the TPM + Key-File + Pin would be needed to unseal the drive. I'm using TSME as additional layer of protection, so all of my ram is enrypted and cold boot attacks are not an option anymore. The measured performance impact was only about 6% in my case. It can be enabled in the Bios. To prevent DMA Attacks, I disabled USB-Support, Audio, SATA and there is even no free PCIe Slot or any other interface on the Board. Reason for all of this is that I may want to spread some more relays, and I cannot guard them or ensure that they are 100% safe from physical tampering, so I want them to just go down immediately when someone messes with them. If you have any more thoughts/improvements, let me know. After this long mail, I'm pretty sure you will all sleep well! Best regards and a nice start into the week! Joker

1 0

AROI Using proof:dns-rsa Not Getting Verified
by algo7 23 Nov '25

23 Nov '25

Hi there, I am trying to setup AROI for my exit relays following the guide here: https://nusenu.github.io/OrNetStats/aroi-setup I am using the DNS TXT records option. I already waited for more than 1 day; however, it seems like it's not getting verified for some reason. Here is the link on OrNetStats to my relay family. https://nusenu.github.io/OrNetStats/w/family/fb5e3cc1855a01ef74fc0843f63e3d… Relay Fingerprints: 2B51193205D091CC80B904D65721FF8DCBE51C96 61137FAC08E0AE62165D18FE8855CCCA26B6D631 Any help will be greatly appreciated. Thanks.

6 5

Running a relay and bridge on the same /24
by forest-relay-contact＠cryptolab.net 23 Nov '25

23 Nov '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. I have several relays that each have two IPv4 addresses. One of them is used for an exit and the other is used to do recursive DNS lookups with Unbound, since some nameservers block Tor. The second IPv4 is not used for any other services. Often, both IPs are on the same /24, and sometimes they are even on the same /31 (for example, 203.0.113.38 and 203.0.113.39). Would there be any issues with running a bridge on the second IP? It has never been on the consensus or even connected to the Tor network. Regards, forest -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmkfVoUACgkQBh18rEKN 1gszdRAAyHUWkCH8Z54OMzyAmL/vU2jGNBSoSB/6EiaPaRoVhEj7AvboUeHYVzPk FA/9QKfYgkkHMJD6XHybbPxwAp9fQRJMmA3BOMYv5UES/KoMf3okbbh48xNnzT64 nQdw82FnFzuegfqCLymoBZULNBJdSr8vYAOi8JRCyt7igVvg/+tYCRCG1u1Sh5+P HogmmIhq4wQE329W9H/UmzBVLID1Zca+qAdvyVIdB95j/MxCz12TpIIcF0D6GsIj 41bjGJnQxbia2jyko/TMmgjNHwkE2oZhNpPclKSpVGwPbsplc62HRiX58Eucsr1B JKg3OSAKGzpz2pXYeTSClmNKmzL2vozSifd0vpRRAi3IXKQk/bKhG7St1bJH4LcT tH3w7pRZlbz2HnjLD2SKB/zau0axqaOOvPO9aCXi2Y2fSrvxjgLggtyIBy5szWZK 6s2HDCRMl6QS+FxMSB3ynincSoLildVEODzAOtzVoRWqlFAANr91/BfzSiWugaAj UPQX7CKJrsa3VOPjI3wi1qx36wQXXgWZ27o2/QSvqu0MiEF2ivuDwjRsNCyeDvu8 5J0SEQQ0aI1RdA4lUybcSUC3jUqlp3789ILEH90sOyXzAzgVT1HQ0ATHNit5oUkU K8FIYPWmFgNvpBybv4dErAnVMj/5p6yNP/KLr5PKr5wvJx9qp0k= =m7B2 -----END PGP SIGNATURE-----

2 1

tor log - Recommended versions are: 0.4.9.3-alpha (only)
by Felix 21 Nov '25

21 Nov '25

Hi, could someone please confirm: Nov 21 19:56:02.000 [warn] Please upgrade! This version of Tor (0.4.8.21) is obsolete, according to the directory authorities. Recommended versions are: 0.4.9.3-alpha Cheers, Felix

3 2

Short Knowlegde Sharing for DNS-Security
by providedlan＠arcor.de 21 Nov '25

21 Nov '25

1 0

New Relay Running Tor 0.4.9.3-alpha
by Tor Relay 21 Nov '25

21 Nov '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 To: tor(a)server-data.servebeer.com Subject: New Relay Running Tor 0.4.9.3-alpha – Fingerprint 29C57CA8D7E54CA674EA4CB88229F44815C2C207 (Unique in Italy) Hello Tor Project team, I am running a new relay on Tor 0.4.9.3-alpha. The relay is currently unique in Italy and fully operational. Fingerprint-Family: 29C57CA8D7E54CA674EA4CB88229F44815C2C207 Location: Bari, Italy IP: 109.116.219.235 Best regards, Tor Relay Operator -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5VwZ/q+VistGhWLUZTaefuiKQfUFAmkfqJcACgkQZTaefuiK QfUP6w/+LG7m/lcixbi1eZearrC2EaUnsuTWMsGDXX4nb7mM/ruehm6I82315oc5 iJsy2dhBoETDB8GJ25dnlg2TditypJIkzDTX8A5grtw9Hy2/pI+tFMl8bBm9HNC4 czwiidG4e20YpS8bvoZPH+cCv7sJeveNVq1mWm7XlZ3V6CA87ZZHIYdTG1kGpBDX D8JrVf60S72eD4StvDnckx4DZ2I50D/AVjwB1Qs47n/nxhxxsRJW3ZWVGxvLbQjx JTLQRgXKG5BvdP8tQpuv8mRF+rxe9Zbq7SF+67fPslbpuuBIGzxe5FPwdNns/J4r Ob2QFdT521KRaleUdD+SS173xFblMYCBvi1vC7NZiHlCvD0KogEuEDTTTLYWn89M +mhThkeNWZT8HHIfwfmArkdgeGpxKhQyGmuIbUQBbcIATEyIhmGDS30yweEUNSG2 z+0zpFn04qI+Nj7YkBFDhM76d9rNjqlPloHgZCptIzmyulixO7Z2Oo5ipzRQlz8f sYdA5TEkp68JvnPSW1/xnnEnrd4A8A8rAEe/qr5conBaegxIbRGfN83szD5G1aUN CfN/HvWQXGE8HTB5YMInwWnMRC1YRMZQ52YQV+Kb7wH9qI3FYvswYmfXPwks/kpO qH/dTAjLe0QPLYrw6TmgBHqbWCJMhvqOQuk0vviF2+RiQxY9ckc= =KWyG -----END PGP SIGNATURE-----

1 0

Accelerated depreciation of older versions?
by Nick Weaver 20 Nov '25

20 Nov '25

Was there an explicit decision made or an announcement about more rapid deprecating older server versions with the "Not recommended" flag? My test relay (tor.icsi-berkeley.org <http://tor.icsi-berkeley.org/>, I use it as my own guard on some tests) was running 0.4.8.18, and I noticed today that it had gained the "Not Recommended" flag which meant my client(s) would not connect to it as the choice of guard. I updated to 0.4.8.20 (as 0.4.8.21, although technically available, wasn't announced or linked to at the time on the Tor website). It lost the "not recommended" flag but regained it again as the current consensus now only has 0.4.8.21 and 0.4.9.3-alpha as acceptable versions. (so, well, update again)? Was this a deliberate decision or in response to a problem patched in 0.4.8.21 (and not announced as high enough severity to require immediate updating?) Is this going to be a policy going forward that relays should be updated within <12 hours of patch announcement? (also, tor26 basically likes everything BUT 0.4.8.21 because that hasn't gotten added to it, I think the Tor network might be disrupted if there is no agreement at all between the 3 authorities selecting recommended version, I think there could be a situation where there is no consensus on "recommended versions" if this isn't fixed) As of time of writing, from https://consensus-health.torproject.org/ moria1 client-versions 0.4.8.19, 0.4.8.20, 0.4.8.21, 0.4.9.3-alpha moria1 server-versions 0.4.8.20, 0.4.8.21, 0.4.9.3-alpha tor26 client-versions 0.4.8.4, 0.4.8.5, 0.4.8.6, 0.4.8.7, 0.4.8.8, 0.4.8.9, 0.4.8.10, 0.4.8.11, 0.4.8.12, 0.4.8.13, 0.4.8.14, 0.4.8.15, 0.4.8.16, 0.4.8.17, 0.4.8.18, 0.4.8.19, 0.4.9.1-alpha, 0.4.9.2-alpha, 0.4.9.3-alpha, (Strikethrough: 0.4.8.20, 0.4.8.21 ) tor26 server-versions 0.4.8.4, 0.4.8.5, 0.4.8.6, 0.4.8.7, 0.4.8.8, 0.4.8.9, 0.4.8.10, 0.4.8.11, 0.4.8.12, 0.4.8.13, 0.4.8.14, 0.4.8.15, 0.4.8.16, 0.4.8.17, 0.4.8.18, 0.4.8.19, 0.4.9.1-alpha, 0.4.9.2-alpha, 0.4.9.3-alpha, (Strikethrough: 0.4.8.21 ) gabelmoo client-versions 0.4.8.19, 0.4.8.20, 0.4.8.21, 0.4.9.3-alpha gabelmoo server-versions 0.4.8.21, 0.4.9.3-alpha consensus client-versions 0.4.8.19, 0.4.8.20, 0.4.8.21, 0.4.9.3-alpha server-versions 0.4.8.21, 0.4.9.3-alpha -Nick

8 12