- tor-relays - lists.torproject.org

Odd network activity
by awffelwaffels 04 Mar '22

04 Mar '22

I see on every exit node I check on the metrics page, a massive bump in bandwidth used without a change in exit probability. Is this perhaps an attacker squeezing the bandwidth of the network so people are more likely to use their malicious nodes?

5 9

Tor Relay Meetup #Fosdem Notes
by gus 04 Mar '22

04 Mar '22

Hello, Last Saturday, a group of 30 - 40 operators joined the Tor Relay Operator meetup. Thank you all for joining the event! Our next online meetup will happen on March 5th, 2000 UTC. Gus ## Fosdem Meetup Notes * Bridges campaign update: "When we started the campaign on November 17, 2021, the Tor network had approximately 1,200 running bridges. The Tor network now has 2470 running bridges, i.e., the number of Tor bridges has almost doubled!" https://blog.torproject.org/wrapping-up-bridges-campaign/ * Gamification project update: - Survey Insights for Tor Relay Operators: https://gitlab.torproject.org/tpo/community/relays/-/issues/31 * EOL 0.3.5 removal: "Tor 0.3.5.x is unsupported beginning tomorrow, 02/01/2022. We should contact the relay operators still on it where possible to get them upgraded and then after a couple of weeks (4 maybe) remove the remaining relays from the network (see: #56 (closed) for previous work in that area)." https://gitlab.torproject.org/tpo/network-health/team/-/issues/171 * New texas relay operator group? are there others? CCCS? "We are just a small provider trying to help out the community. We believe that privacy is a fundamental right for everyone. We hope to make the internet a better place by deploying privacy based tools for everyone to use.Checkout stormycloud.org for additional information." * torservers.net reanimation continues. New website (feedback welcome) is online: https://torservers.net/ Thanks Leibi, qbi and others for the work! ### Q&A session * Who runs Tor relays today? Do we need more transparency? (no mic) * Yes, we need more transparency. Gus describes a proposed "community mapping" exercise where we learn who has links / connections to other relays. * Best providers for exit nodes? * For exits, I can recommend terrahost.no They are based in Norway, have unmetered offers and allow exits with a reduced policy in their Terms of Service * See: https://community.torproject.org/relay/community-resources/good-bad-isps/ * Would recommend avoiding hetzner, ovh, frantech, buyvm, there are too many relays there already. * Are there any plans for AS-aware tor circuit creation? (Kristian - lokodlare) Not currently -- the AS-aware Tor designs (like Raptor and following) are cool but have a bunch of big open questions and unresolved potential vulnerabilities too. So, a great research area, but comes with too many security tradeoffs currently. For a cool recent attack paper in the area, check out: https://www.freehaven.net/anonbib/#tempest-pets2018 * Are there plans on improving tor prometheus metrics? (more metrics: uptime, bandwidth, ...) It turns out the DNS metrics we had were buggy and not so useful. So there is some work to improve the accuracy / usefulness of the current metrics. https://gitlab.torproject.org/tpo/network-health/team/-/issues/175 * is C tor dead in terms of new features like this? (all dev capacity goes into rust only?) C tor is going to be deprecated over time, but the Arti roadmap involves not getting to relays for years, so there will be an interim period where we're wishing we could deprecate the C-Tor relay side yet there is no Arti relay side replacement yet. * will arti implement the control spec (compatibility with stem) no, at least not as it currently is. arti wants to be a library you can link in * Is the GeoIP location implementation for relays based on ASNs or actual country-based IP blocks. One relay operator's server is located in Japan but the AS seems to be American so the location is listed as the US. We switched from Maxmind GeoIP to IPFire in the past year. * Are there instructions for how people can report bugs to IPFire? Yes, look at https://forum.torproject.net/t/tor-relay-search-showing-location-of-some-re… We had an example where a relay operator requested a change from IPFire, and it seems to have gone surprisingly smoothly and easily. * MCH: There will be a real in-person hacker con this summer, MCH https://mch2022.org/, with at least one Tor relay operator known attending and at least one Tor developer known attending. * Is running a Snowflake proxy as useful as a (obfs4) bridge? If you have a static IP address, maybe the obfs4 bridge is smarter? Since the Snowflake model involves having many transient proxies. * Are there timelines for IPv6 only Tor or Bridge families? tor 0.4.8.x will get MyFamily support for bridges according to Nick (C tor) https://gitweb.torproject.org/torspec.git/tree/proposals/321-happy-families… * Would it be a good idea to run a web-server on the same computer as a tor bridge? Because it would introduce collateral damage? Maybe yes in theory, but in practice these days no. Russia and China block bridges by IP address in a quite automated way and they don't seem to care what else is on that computer. Mostly these censors find bridges not by looking at network traffic, but by pretending to be users showing up to bridges.torproject.org. So the censors who try to build blocklists aren't even looking much at the addresses they block. * will arti implement the control spec (compatibility with stem) * Answer: I think I've heard that it probably won't, or at least not entirely * Is it bad to have too many exit relays in one country? And how many is too many? * Norway and the US and DE seems to be quite saturated already with exit relays: NO - 37, 481 MiB/s Tor metrics numbers US - 536, 4898 MiB/s DE - 329, 8206 MiB/s See: https://metrics.torproject.org/rs.html#aggregate/cc https://nusenu.github.io/OrNetStats/ * Getting fast relays in Japan is challenging because of how we measure bandwidth weights. Is sbws moving forward? How about a newer bwauth design to make use of better geo-relay-distribution? * Will rust tor solve the multiple CPU core issue (no more multiple tor instances required on a multi core machine)? Answer: Hopefully yes, arti is multithreaded, but not as fast as C tor yet * Is stem unmaintained? Yes. * Damian no longer working on stem? I believe that Damian is no longer actively developing stem, but that he is maintaining it, in the sense that if you submit a patch he might take it, or if you submit a security issue he'll probably look at it. * How far away are we from rust tor support relays? will that also be called arti or is arti just the tor client functionality? * How far away are we from a first tor browser alpha using arti? Arti roadmap says it should be "ready for production use" in september 2022, but that's without anti-censorship stuff and onion service support. * Russia has blocked Tor relays? Tor is now pretty essential for Russians. Is speed important there? Lower latency is really useful when you're using Tor. Compare Russia to China -- China grows its internal network capacity, but not its external network capacity, and over time it becomes more fun to use Chinese services in China, and less fun to use external services in China. Will Russia go that route? We'll see. Hopefully not for a while. * How to get more Tor advocacy in each of our local areas? Seems like you read about bad people using the internet but not enough about why Tor is important. * Who runs bw authorities? How could we get one in asia? They are the services that pick weights for relays in the consensus, so they are trusted in a similar way to how directory authorities are trusted. So, right now they're run either *by* the dir auth operators, or there's a 1:1 trust relationship from dir auth operator to bwauth operator. Putting a bwauth in Asia would probably just measure all the relays as slow. And part of that is because of our sub-optimal congestion control design in Tor right now, which Mike is working on. It seems wise to wait until Mike has his fix in place, and then we can understand how much of the "geographic diversity is slow" problemwe've fixed, and how much of it remains. * SysAdmin 101 workshop Gman discusses a proposed idea on teaching relay operators about how to sysadmin properly, how to make decisions about bare metal vs VM, how to get time synchronization working right, all of the things that relay operators need better intuition about. General consensus is yes this is a good idea and could benefit a lot of people. Gman requests suggestions for most important material and topics. https://gitlab.torproject.org/tpo/community/relays/-/issues/36 * What about raising the fast relay flag threshold? The reasoning being that if you remove the really slow relays from the network, then even though there are fewer relays, average circuit performance gets better? This is actually just one of dozens of ideas we have for improving performance, and the plan is to use Mike's framework for doing a proper experiment for each idea, and measuring whether it actually helps: I think gitlab link is https://gitlab.torproject.org/mikeperry/scalability-and-perf-board/-/issues There is a great wiki page too, listing e.g. what network characteristics to measure. Start here: https://gitlab.torproject.org/legacy/trac/-/wikis/org/roadmaps/CoreTor/Perf… and here: https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/Sponsor61/P… Idea for an agenda topic for next time: Mike's network-wide performance experiments, how to do experiments safely and productively on the live Tor network. -- The Tor Project Community Team Lead

3 3

Your opinion about tor-node.org
by Martin Gebhardt 03 Mar '22

03 Mar '22

Hello all, I don't know who of you is familiar with this, I just came across it a few weeks ago. It's about tor-node.org. It is probably a person who collects funds for the operation of Tor infrastructure. Nothing wrong with that and I applaud that. What you might find objectionable, but I don't, are the sponsors.They are marketplaces that make their money from drug dealing and other illegal sales. I don't mind that, anything is better than buying your addictive substance from windy guys at the train station. But what bothers me is the transparency. I also believe that using Tor is an act of anonymity. But running Tor infrastructure is an act of transparency. I am very interested in knowing who is working on our project. Unfortunately, the operator can't come forward here either, because then his anonymity towards the marketplace scene would be over. On the one hand, the operator justifiably wants to remain anonymous. Just to protect his sponsors. On the other hand, however, this leads to the fact that he can not reveal himself as an relay owner within the operators. The operator can also not disclose to his sponsors what happens with their money. Because then the sponsors would know which relays are operated and then it is over with the anonymity. Without wanting to imply it, I think that this can also simply be a fraud against the sponsors. I wouldn't care about that either. But I do not think that this is the case and assume that relays are operated. What do you think about it? For me, it's a breach of the principle of transparency, which I'm sure most of you here agree with. I would like to emphasize that I welcome every supporter of the network and I am glad about every single relay. But do we as a community welcome this kind of relay operators? Feel free to express your opinion. -- Martin

5 8

new BridgeDB version using rdsys
by meskio 28 Feb '22

28 Feb '22

Hello, I have just deployed a new version of BridgeDB[0]. Now BridgeDB uses rdsys[0] as backend so it has changed how bridges are managed internally, but all the user facing pieces are (almost) the same. The distributors (email, https[1] and moat) hasn't changed and should work as before. If you are a bridge user you should not see any difference. The bridges you are already using should stay working and requesting new bridges should work as before. The move to rdsys implies that all the bridges might have changed their distribution mechanism. If you are bridge operator you might see your bridge having a different distributor mechanism in the coming hours, if you had configured your bridge with the "BridgeDistribution" option your distribution mechanism should not change and stay on what you configured. There are more few more distribution mechanisms now, this is the full list: * https. The web interface of bridgedb[0]. * moat. The API used by Tor Browser to request bridges directly from the settings. * email. Bridges distributed by bridges(a)torproject.org. * telegram. Bridges that will be distributed by the telegram bot @GetBridgesBot. * settings. A new API used to autoconfigure the circumvention mechanism depending on your geolocation. * reserved. Bridges reserved for experiments or future needs. People with bridges assigned to telegram and settings will not see much usage of their bridges yet, as those are projects we are working on but will be soon in use. If you notice any problems with the bridge distribution don't hesitate to open an issue[2] or contact me. [0] https://bridges.torproject.org [1] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/ [2] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

questions about raspberry pi bridges
by potlatch 22 Feb '22

22 Feb '22

Greetings, I've operated both relays and bridges for more than a decade but I'm new to the raspberry pi. I think it a real possibility for future bridge deployment en mass. I have several questions that I can't seem to work through: 1.) The tor package I get from the repository is 0.4.2.7 (obsolete). I thought it was because the pi machine had raspian for the os. So, I downloaded and installed 32-bit ubuntu server 20.04.3 instead (https://ubuntu.com/downloads/raspberry-pi) It made no difference. I changed to a new SSD to make sure all was virgin. How do I upgrade to current version of Tor for this bridge? 2.) Some of my bridges have (and some do not have) /var/lib/tor/stats folders. I am interested in the 'why' of this and also how I can install that capability on all bridge relays. The stat printout is in units of '8' and I'm sure the Russians, Egyptions, etc. do not use bridges in unit neat units. What am I reading in bridge-stats? 3.) Does Tor project state somewhere in it's docs that it's a terrible idea to give a bridge a nickname such as 'TorCuba'? It should!! potlatch Sent with [ProtonMail](https://protonmail.com/) Secure Email.

4 5

Unexpected classification with my guard relay
by Security GMVSES 22 Feb '22

22 Feb '22

Dear Mr./Mrs., As I really like the Deep Web field, and wanted to know about Tor, I decided to create a guard relay, which is this one: https://metrics.torproject.org/rs.html#details/037F39EF786C0623A059553869C0… I did all the configurations required, but after a couple of weeks, this relay is not considered a guard relay (entry relay) yet. I am contacting you because I don't understand why my relay is not considered as a guard relay (entry relay), since I already have the following flags: Fast, HSDir, Running, Stable, V2Dir, Valid. My configuration is: Nickname securitses ContactInfo securitses(a)gmail.com ORPort 443 ExitRelay 0 ExitPolicy reject *:* SocksPort 9050 AccountingStart day 0:00 AccountingMax 30 GBytes BandwidthRate 301 KBytes BandwidthBurst 350 KBytes ControlPort 9051 HashedControlPassword <Hashed_password> Thank you, Yours sincerely, Javier

4 3

snowflake incoming UDP ports
by Toralf Förster 22 Feb '22

22 Feb '22

I do simply run here ~/devel/go/src/snowflake/proxy/proxy &>>/tmp/snowflake-proxy.log & and was wondering if I have to open special UDP inbound ports ? From the stats snowflake iseems to be working: 2022/02/18 19:29:59 In the last 1h0m0s, there are 13 connections. Traffic Relayed ↑ 192 MB, ↓ 192 MB. 2022/02/18 20:29:59 In the last 1h0m0s, there are 21 connections. Traffic Relayed ↑ 451 MB, ↓ 451 MB. 2022/02/18 21:29:59 In the last 1h0m0s, there are 9 connections. Traffic Relayed ↑ 236 MB, ↓ 236 MB. but b/c I do have a rather restrict inbound firewall rule set I'm wondering about that. -- Toralf

3 4

Reduced exit and not IPv4 exit traffic at all
by yl 21 Feb '22

21 Feb '22

Hello all, how can I used a reduced exit policy and don't allow any IPv4 exit traffic? The following line in the top of all the ExitPolicy lines in torrc seems not to work. ExitPolicy reject 0.0.0.0:* What is the order I needed here, first "reject" and then accept or the other way around? Reduced Exit policy like here: https://gitlab.torproject.org/legacy/trac/-/wikis/doc/ReducedExitPolicy Webtropia was a bit unhappy lately when UCEprotect listed the whole /24 for some reason I still don't understand. But then I thought, why not disable IPv4 exit traffic, there is so many IPv6 resources that a IPv6 only Exit should still be fine. Thanks yl

5 8

TorWeather replacement features
by nusenu 20 Feb '22

20 Feb '22

Hi, I'm currently working on a TorWeather replacement (mainly using a byproduct of another project) that should be helpful for relay operators to get notifications about their relay downtimes and other issues. I believe such a service will contribute to a more healthy tor network and better informed operators leading to less relays running on old vulnerable and end-of-life tor versions. For those that did not have the chance to use TorWeather in the past before it died due to lack of a maintainer: It was a simple software as a service for relay operators that allowed them to subscribe for email notifications in case their relay dropped out of consensus (and a few more use-cases). The service will be for the operator of the relay(s). Subscribing and notifications will be aggregated by operators, meaning if multiple relays from a single operator go down at the same time, it will produce a single notification only (instead of one per relay). If a new relay gets added by an operator no additional steps are required to get notification for the newly added relays. You can rate the items below with these levels: (off-list replies are fine as well) 1 = must have 2 = should have 3 = nice to have The system will use the email address in your CIISS email field, which implies it is public. How important are private (non-public) ways to subscribe to notifications for you? (non-public email address) TorWeather used to have an option where the operator was able to specify after what amount of downtime they would get a notification. I would simply go with a single static value: "2 consensus are missing your relays" (2 hours) -> notify. How important are configurable downtime periods to you and what timeframe would you choose? I'm primarily focusing on notifications about "changed to the worse" (i.e. up -> down; ok -> eol). How important are recovery notifications (i.e. down -> up) to you? What would be the next most useful/important notification use-case for you after - relay dropped out of consensus - relay is running a vulnerable/end-of-life tor release - relay lost guard/exit flag The first notification method will be email. How important would be matrix as a second notification method to you? Would you use one or multiple notification methods at the same time? kind regards, nusenu -- https://nusenu.github.io

5 6

torrc, unit files, confusion
by Martin Gebhardt 19 Feb '22

19 Feb '22

Hello together, I've gotten myself stuck in a situation that I can't get out of. The following: I have a working relay. You can find the config for it in the attachment [1]. I want to move parts of the config. So I use %include. I don't do anything else than moving parts of the working config to other files. There are no changes at all. But, tor does not start anymore.In the attachment [2] you can find the config with %include. The folder structure is the following: ├── info.html ├── rc.d │ ├── contact.rc │ ├── family.rc │ └── nickname.rc ├── torrc └── torsocks.conf No matter what I do, I can't get it to enable debug logs when I start tor from the unit file. This is unchanged, but I attached it anyway [3]. Anyway, I start tor as root, then everything works [4]. I have no idea where something should be wrong with the permissions. I have also recursively set the permission of /etc/tor/ to the user debian-tor, but it doesn't help. When I do the following: cat rc.d/* >> torrc && sed -i /include/d torrc && systemctl restart tor Everything works fine again. My system: Linux privacy 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64 GNU/Linux Tor version 0.4.6.9. Tor is running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1k, Zlib 1.2.11, Liblzma 5.2.5, Libzstd 1.4.8 and Glibc 2.33 as libc. Tor compiled with GCC version 10.2.1 Maybe I'm still too tired to figure it out. But please, can someone give me some advice where to look further? Or at least tell me how to get a debug log when I start tor from the systemd-unit. Then I would surely get further. Thanks for your attention and help. -- Martin

3 3

New relay has a problem - Re-used IP blocked in consensus?
by Olaf Grimm 17 Feb '22

17 Feb '22

Hello Tor community! I have some identical new relays, but only one of them has a problem. My intention was an IPv6 problem, so there ist IPV6 diabled at all. Fingerprint: 3F1AE2170CAD31B5694BD9052A2A29E5793BDC1F IP: 107.189.14.123 Ports open: 22, 80, 9001 Test from outside by scanner: ok UFW firewall open ports set to: 22, 80, 9001 torrc: No IPv6 configuration enabled. The same configuration about all relays. With Nyx I can see built circuits, but the relay does not appear in the metrics, but other relays already show strong traffic. Debian system updates are possible, the HTTP frontpage is displayed at the given IP address, DNS 'unbound' ok because updates are possible. Unbound is set to 127.0.0.1 only. Here some logs from Nyx (copy like displayed): 11:18:41 [INFO] find_my_address(): Unable to find our IP address. 11:18:41 [INFO] address_can_be_used(): Address '::1' is a private IP address. Tor relays that use the default DirAuthorities must have public IP addresses. 11:18:41 [INFO] tor_getaddrinfo(): (Sandbox) getaddrinfo succeeded. 11:18:41 [INFO] get_address_from_interface(): Could not get local interface IP address. 11:18:41 [INFO] get_interface_address6_via_udp_socket_hack(): connect() failed: Cannot assign requested address 11:18:41 [INFO] address_can_be_used(): Address '::' is a private IP address. Tor relays that use the default DirAuthorities must have public IP addresses. 11:18:41 [INFO] get_address_from_config(): No Address option found in configuration. 11:18:39 [INFO] update_consensus_router_descriptor_downloads(): 0 router descriptors downloadable. 0 delayed; 6795 present (0 of those were in old_routers); 0 would_reject; 0 wouldnt_use; 0 in progress. I can not find what is wrong, but I see "::" what is IPv6. In Debian /etc/sysctl.conf IPv6 is disabled. net.ipv6.conf.all.disable_ipv6 = 1 Can you help me? Please check the IP in the consensus. Blocked? Olaf

3 2

Help a newbie
by chuck＠relay-security.org 15 Feb '22

15 Feb '22

I have a problem. This relay was running fine until I changed the nickname. After making the change, I ran “tor --verify-config” just to make sure, and then ran “sudo systemctl restart tor@default” I see it running, but the syslog shows: Feb 14 23:31:46 tor1 tor[592]: Feb 14 23:31:46.000 [info] should_delay_dir_fetches(): Delaying dir fetches (Hibernating or shutting down) Feb 14 23:31:47 tor1 tor[592]: Feb 14 23:31:47.000 [info] should_delay_dir_fetches(): Delaying dir fetches (Hibernating or shutting down) Feb 14 23:31:47 tor1 tor[592]: Feb 14 23:31:47.000 [info] should_delay_dir_fetches(): Delaying dir fetches (Hibernating or shutting down) Feb 14 23:31:48 tor1 tor[592]: Feb 14 23:31:48.000 [info] should_delay_dir_fetches(): Delaying dir fetches (Hibernating or shutting down) and on and on .… What have I done wrong? The fqdn is https://tor1.relay-security.org

1 0

Tor installation from Source
by nikoloskid＠pm.me 11 Feb '22

11 Feb '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, My relay is running on Raspberry OS so the updates are a little late for some packages, so my relay is running on obsolote version 0.3.5.15, I installed Tor from source and tor --version gives me Tor version 0.4.6.10. Tor is running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1d, Zlib 1.2.11, Liblzma N/A, Libzstd N/A and Glibc 2.28 as libc. Tor compiled with GCC version 8.3.0but tor(a)default.service is still running on 0.3.5.15 (I have restarted the service multiple times)... Regards, Daniel Nikoloski Sent with ProtonMail Secure Email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsBzBAEBCAAGBQJiBMpiACEJEAutNI6WgEWAFiEE/jRLdx96gF2z0p05C600 jpaARYCzgQf5AXlzmz1cV38y+/4DMFGMwV74+2acsiAhw8dml1/In34debY1 JgoP6CP+GugKMPAq7JQPvhRF2eVrTYdSN9h0OFrZE3OT45YZWR7uU38MzXd0 NorjBu9lALsE321ocL80igKd+0nXgOofQoWyelaLMRc1YCP8BQLXqv7JLAee 0eZLaHyX8u3OdgyE/ejpbb+7tKzXSkSQZ7vh6e0BEcmQZFXfzEbTuS6jzGQk x8OOYZmF7t4Q1m54NffydyXbQv7hUPYaRFwyMLwdonRl51GFATr+G6vMQqkf QsxxvRQflJ0ANv0cw9oUieMCYXyzrb3oNf9avOucHP477CG6UjwV3A== =m7jC -----END PGP SIGNATURE-----

3 2

Legal bases
by Martin Gebhardt 10 Feb '22

10 Feb '22

Hello all, I would like to read about experiences with local laws of various countries. So far I run my exits in Austria, Germany and the Netherlands. I have found a provider for me that also covers the following countries and has no problem with Tor exits: - Poland - Australia - Singapore - France My goal is to have a unified website for each country, where you can find links to official websites of the countries with "traffic passing " laws. For AT, DE and NL these are known to me. For the other countries not. Now before I start searching and messing around with translators, I hope someone here has experience in one or more of these countries and can provide with paragraphs. I am grateful for any hint. -- Martin

1 0

Re: [tor-relays] snowflake vs bridges (vs node)
by Fran 08 Feb '22

08 Feb '22

Thanks meskio, this helped a lot to clarify things. So I thought of trying to run a bride and a snowflakeproxy on one VM with individual IP addressing in v4 and v6 for each by adding secondary addresses to to the WAN interface. But after compiling the go binary I fail to find out how to tell snowflake which IP to bind to/use. For the bridge this can be achieved with: Address <IPv4> Address <IPv6> OutboundBindAddress <IPv4> OutboundBindAddress <IPv6> (and maybe to be save also set OutboundBindAddressPT, OutboundBindAddressExit and OutboundBindAddressOR) But for snowflake I'm missing the options: Usage of ./proxy: -broker string broker URL (default "https://snowflake-broker.torproject.net/") -capacity uint maximum concurrent clients -keep-local-addresses keep local LAN address ICE candidates -log string log filename -nat-retest-interval duration the time interval in second before NAT type is retested, 0s disables retest. Valid time units are "s", "m", "h". (default 24h0m0s) -relay string websocket relay URL (default "wss://snowflake.bamsoftware.com/") -stun string broker URL (default "stun:stun.stunprotocol.org:3478") -summary-interval duration the time interval to output summary, 0s disables retest. Valid time units are "s", "m", "h". (default 1h0m0s) -unsafe-logging prevent logs from being scrubbed -verbose increase log verbosity Could be solved with VRFs/namespaces but would involve bridging, veths...too snowflaky for me (same goes for containers). So I guess I'll just keep the bridges and make then relays one day. Thanks for all who helped! best fran On 2/7/22 11:12, meskio wrote > Yes, there are many differencies. snowflake does make the traffic look like > webrtc (like a video conference) and obfs4 makes the traffic look like random > noise. Also the clients use different mechanisms to discover the relays. > > If you run both in the same IP address and the censor has a way to discover one > but not the other both of them will be blocked at once. So you are making it > easier for the censor to discover them and block them. That is why we don't want > people to run both in the same IP address.

2 1

cases where relay overload can be a false positive
by s7r 07 Feb '22

07 Feb '22

Hello, One of my relays (guard, not exit) started to report being overloaded since once week ago for the first time in its life. The consensus weight and advertised bandwidth are proper as per what they should be, considering the relay's configuration. More than this, they have not changed for years. So, I started to look at it more closely. Apparently the overload is triggered at 5-6 days by flooding it with circuit creation requests. All I can see in tor.log is: [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [68382 similar message(s) suppressed in last 482700 seconds] [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [7882 similar message(s) suppressed in last 60 seconds] This message is logged like 4-5 or 6 time as 1 minute (60 sec) difference between each warn entry. After that, the relay is back to normal. So it feels like it is being probed or something like this. CPU usage is at 65%, RAM is at under 45%, SSD no problem, bandwidth no problem. Metrics port says: tor_relay_load_tcp_exhaustion_total 0 tor_relay_load_onionskins_total{type="tap",action="processed"} 52073 tor_relay_load_onionskins_total{type="tap",action="dropped"} 0 tor_relay_load_onionskins_total{type="fast",action="processed"} 0 tor_relay_load_onionskins_total{type="fast",action="dropped"} 0 tor_relay_load_onionskins_total{type="ntor",action="processed"} 8069522 tor_relay_load_onionskins_total{type="ntor",action="dropped"} 273275 So if we account the dropped ntor circuits with the processed ntor circuits we end up with a reasonable % (it's >8 million vs <300k). So the question here is: does the computed consensus weight of a relay change if that relay keeps sending reports to directory authorities that it is being overloaded? If yes, could this be triggered by an attacker, in order to arbitrary decrease a relay's consensus weight even when it's not really overloaded (to maybe increase the consensus weights of other malicious relays that we don't know about)? Also, as a side note, I think that if the dropped/processed ratio is not over 15% or 20% a relay should not consider itself overloaded. Would this be a good idea? Sending to tor-relays@ for now, if some of you think of this in any way we can open a thread about it on tor-dev@ - please let me know if I should do this.

3 5

Genereal queations about MyFamily
by Martin Gebhardt 07 Feb '22

07 Feb '22

Hello, I am running some servers in the Tor infrastructure for research reasons and my own (mainly political) interest. I have a few questions, the answer to which would help me a lot at the moment. 1. can someone explain to me how the fingerprint of a Family is created? For example, I have 7 exit relays in a Family, and can't remember how that came about. 1. 2. to simplify the torrc, would it not be advantageous to enter in "MyFamily" not all fingerprints, but only that of the Family as such? Are there already suggestions for this with the developers? If not, which Git would be the most suitable to place my suggestion? I know, then everyone could "join" a family, since another node does not explicitly also include the one in the config. But there will be a solution for that. Like with AROI from nusenu. I explore various possibilities to deanonymize. My motives are solely dedicated to the Tor project. I have configured a bridge and I know that it is also possible to restrict exits. For example via the country code. I have also done that successfully, but: 2. 1. I don't manage to configure a bridge _and_ a fixed exit. 2. 2. also here I would welcome a feature to specify the fingerprint of a family as forced exits instead of single fingerprints or countrycodes. Also here the question like in 1.2, where could I place this then best. All this does not necessarily provide an advantage in anonymization, but it makes research much easier. And before someone says that i don't need that... there is a lot that i don't need and that doesn't serve the purpose of a software, you are not forced to configure it let alone recommend it. I'm just talking about possibilities that should facilitate the research. -- Martin

3 4

snowflake vs bridges (vs node)
by Fran 07 Feb '22

07 Feb '22

Hey, I just saw, that it's possible to run snowflake[1] not only as browser plugin, but also standalone. So I am wondering what makes more sense, run a bridge with obsf4 or run a snowflake instance instead of a bridge. Or would it even make sense to install both on one server? And generally, what's more needed atm: bridge, non-exit, exit or snowflake? Thanks! fran [1] https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…

5 6

ExitNodes Directive Evaluated Dynamicly or Bootstrap Only?
by Gary C. New 06 Feb '22

06 Feb '22

All: Is the ExitNodes Directive evaluated Dynamicly or only during Bootstrap? What happens if an exit in the ExitNodes list is down when selected? Respectfully, Gary— This Message Originated by the Sun. iBigBlue 63W Solar Array (~12 Hour Charge) + 2 x Charmast 26800mAh Power Banks = iPhone XS Max 512GB (~2 Weeks Charged)

1 0

Outdated GeoIP DB
by Martin Gebhardt (Die LINKE.) 06 Feb '22

06 Feb '22

Hi, in the past I had already written with someone about it. At that time the entries were not up to date. There was a Gitlab issue about this, but I can't find it now. Anyway, the data is not up to date again. Example: https://apps.db.ripe.net/db-web-ui/query?searchtext=89.58.17.76 vs https://metrics.torproject.org/rs.html#details/6A0A9C3B3381C89CCB85C64BBCF6… The IP address is currently located in Austria. But in the metrics Germany is displayed. This is a "correct" but outdated information. Since I don't know if this can have any effects on the routing, which I don't assume, but is theoretically possible, I just want to target it again.

6 6

Relay operators meetup @ FOSDEM
by Stefan Leibfarth 04 Feb '22

04 Feb '22

Greetings relay operators, the next Tor relay operators meetup will be online @ FOSDEM. Date: 2022-02-05 Time: 1500 UTC Room: https://lecture.senfcall.de/rin-2tx-xcy-g5r No need for a registration or anything else, just use the room-link above. There will be a agenda, but everyone is free to bring up additional questions or topics at the meeting itself. Looking forward to meeting you Leibi [0] https://fosdem.org/2022/fringe/

3 2

Recommended IPv6 Configuration
by t.duellmann+torrelays＠gmail.com 03 Feb '22

03 Feb '22

Dear list, I read here [1] that IPv6 is on the rise and support for it is growing. Are there any recommendations or best-practices how to configure a Tor relay with IPv6? Alternatively, could anybody who got it set up already, post their experiences and maybe even the relevant parts of their torrc? Thanks! [1] https://blog.torproject.org/state-of-ipv6-support-tor-network/

3 2

Exit relays abused to attack Google services
by UDN Tor 02 Feb '22

02 Feb '22

Google is now sending abuse reports complaining of DDoS attacks against their services. While they believe the IPs are participating in a botnet, it is clear that they are Tor exit relays. I don't know why they are sending us the report after the attacks have ended. Besides, since Google services are unusable over Tor, this should not have caused them much damage. I suspect the attacker is trying to get relays shut down by triggering Google reports that would scare off the ISPs. If you are an ISP and you have received the same report, please let me know. I'd like to know if this was global or if we've been "selected". > From: ddos-reports(a)google.com > To: abuse(a)urdn.com.ua > Subject: [#zMto] DDoS from your IPs to Google from 2022-01-28 to > 2022-01-31 > Date: Tue, 01 Feb 2022 20:22:42 +0000 > > We observed IPs under your control participating in DDoS attacks > targeting Google services, including a prolonged DDoS attack from > January 28-31 against the Google Search Console. > > The attacks were Layer 7 / HTTP request floods. Your participating > IPs are listed below, along with the stop time in UTC and targeted > Google IPs. We request that you enforce your Acceptable Use Policy > against these customers. > > +-----------------+-----------------+----------+---------------------+ > | Source | Destination | DestPort | Time_UTC | > +-----------------+-----------------+----------+---------------------+ > | 193.218.118.62 | 142.250.180.227 | 443 | 2022-01-31 15:55:01 | > | 193.218.118.90 | 142.250.180.195 | 443 | 2022-01-31 15:53:28 | > | 193.218.118.100 | 172.217.19.99 | 443 | 2022-01-31 14:43:09 | > | 193.218.118.101 | 142.250.180.227 | 443 | 2022-01-31 17:32:54 | > | 193.218.118.125 | 142.250.180.227 | 443 | 2022-01-31 15:55:28 | > | 193.218.118.145 | 142.250.180.195 | 443 | 2022-01-31 15:55:30 | > | 193.218.118.147 | 142.251.39.35 | 443 | 2022-01-31 15:41:36 | > | 193.218.118.155 | 142.250.180.195 | 443 | 2022-01-31 13:45:43 | > | 193.218.118.156 | 142.250.180.227 | 443 | 2022-01-31 15:57:52 | > | 193.218.118.158 | 142.250.180.227 | 443 | 2022-01-31 18:41:34 | > | 193.218.118.167 | 142.250.201.195 | 443 | 2022-01-31 15:56:53 | > | 193.218.118.182 | 142.251.39.3 | 443 | 2022-01-31 17:31:57 | > | 193.218.118.183 | 142.250.180.227 | 443 | 2022-01-31 17:42:40 | > | 193.218.118.231 | 142.250.180.227 | 443 | 2022-01-31 17:43:08 | > +-----------------+-----------------+----------+---------------------+ > > Note we believe some of these IPs are part of the Meris or Dvinis > botnets. If you are a residential Internet service provider, it is > possible that your customers' routers themselves have been > compromised. You should research the Meris botnet and take > appropriate actions to have them secure their CPE (customer-premises > equipment). > > -- > Security Reliability Engineering :: Google :: AS15169

4 3

reminder: tor 0.3.5 reaches end of life on 2022-02-01
by nusenu 02 Feb '22

02 Feb '22

Reminder: tor 0.3.5 reaches it's end of life on 2022-02-01 (in 3 weeks from now). Over 700 relays - about 7% of the network's guard capacity currently still run this soon unsupported tor version. https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… kind regards, nusenu -- https://nusenu.github.io _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 1

Introduction message from me :)
by Miryam Webb 01 Feb '22

01 Feb '22

Hello all, I am a new relay operator and I am glad to make your acquaintance. Currently my nodes are not processing traffic because they are being rejected by the directory nodes but I hope that gus will reply soon and that we can get this working. I have been administrating linux servers for more than 8 years but I have no experience with running tor nodes. So if you have tips and tricks a noob should know feel free to write me. :) Miryam

3 2

OVHcloud does not allow Tor exit relays on VPS/cloud services
by Neel Chauhan 01 Feb '22

01 Feb '22

Hi, I was running a pair of Tor exit relays on OVH, and when I sent an response, I got this as a reply: === As provided in our Service Specific Terms, Anonymization services, such as TOR, are not permitted on OVHcloud's VPS or Public Cloud services. We request that you immediately cease utilizing your current subscriptions as a TOR exit node. Failure to comply with this request may result in the suspension and/or termination of your servers and/or account in accordance with our Terms of Service. https://us.ovhcloud.com/legal/service-specific-terms === It seems OVH does not allow Tor exit relays on "cloud" or "VPS" subscriptions anymore. In the past when I used OVH for exits I had no issues, so they must have changed their TOS. I am assuming OVH dedicated servers are fine. I guess I'm moving the two exit relays to Terrahost. Terrahost is more expensive but I already have exits there and they are excellent. I never had a great experience with OVH. -Neel

2 1

wrong iptables rules? / no inbound traffic in nyx
by ax8eaz7z3g 27 Jan '22

27 Jan '22

Hi! I noticed that after I have set up my ip(+6)tables up to filter unwanted incoming traffic all "inbound" and "directory" connections in nyx disappeared, only lot of "outbound" connections are there. I am running exit relay (IPv4+IPv6) on ORPort 443 and DIRPort 80. Is there someone willing to check my iptable rules? I am starting to lose it... > My iptables: > -P INPUT DROP > > -P FORWARD DROP > > -P OUTPUT DROP > > -A INPUT -i lo -j ACCEPT > > -A INPUT -p tcp -m conntrack --ctstate NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT # SSH running there > > -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT # allow incoming comm to ORPort > > -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT # allow incoming comm to DIRPort > > -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # allow all already established incoming connections > > -A OUTPUT -o lo -j ACCEPT # allow all outgoing connections > > -A OUTPUT -o eth0 -j ACCEPT > My ip6tables: > > -P INPUT DROP > > -P FORWARD DROP > > -P OUTPUT DROP > > -N ICMPv6_IN > > -N ICMPv6_OUT > > -A INPUT -i lo -j ACCEPT > > -A INPUT -p tcp -m conntrack --ctstate NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT # SSH running there > > -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT # allow incoming comm to ORPort > > -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT # allow incoming comm to DIRPort > > -A INPUT -p ipv6-icmp -j ICMPv6_IN #pass all icmpv6 related traffic to new chain > > -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # allow all already established incoming connections > > -A OUTPUT -o lo -j ACCEPT > > -A OUTPUT -p ipv6-icmp -j ICMPv6_OUT #pass all icmpv6 related traffic to new chain > > -A OUTPUT -o eth0 -j ACCEPT # allow all outgoing connections > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 3 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 4 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 129 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j ACCEPT > > -A ICMPv6_IN -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j ACCEPT > > -A ICMPv6_IN -j DROP > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 129 -j ACCEPT > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j ACCEPT > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j ACCEPT > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j ACCEPT > > -A ICMPv6_OUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j ACCEPT > > -A ICMPv6_OUT -j DROP Thank you all for any replies! Have a nice day. Bye

2 2

We need bridges with iat-mode set to 1 and especially 2 as well!
by juckiuscaesar＠web.de 27 Jan '22

27 Jan '22

5 9

tor prometheus metrics -> expected label value, got "INVALID"
by Fran 24 Jan '22

24 Jan '22

Hej, I just found out about the integrated prometheus exporter in tor - yay, thanks for that! I can scrape it with curl: $ curl http://<ip>:9035/metrics # HELP tor_hs_rdv_num_total Total number of rendezvous circuit created # TYPE tor_hs_rdv_num_total counter tor_hs_rdv_num_total{onion=<onionv3adr>} 4 # HELP tor_hs_app_write_bytes_total Total number of bytes written to the application # TYPE tor_hs_app_write_bytes_total counter tor_hs_app_write_bytes_total{onion=<onionv3adr>,port=80} 15211 # HELP tor_hs_intro_num_total Total number of introduction received # TYPE tor_hs_intro_num_total counter tor_hs_intro_num_total{onion=<onionv3adr>} 4 # HELP tor_hs_rdv_established_count Total number of established rendezvous circuit # TYPE tor_hs_rdv_established_count gauge tor_hs_rdv_established_count{onion=<onionv3adr>} 1 # HELP tor_hs_app_read_bytes_total Total number of bytes read from the application # TYPE tor_hs_app_read_bytes_total counter tor_hs_app_read_bytes_total{onion=<onionv3adr>,port=80} 319667 # HELP tor_hs_intro_established_count Total number of established introduction circuit # TYPE tor_hs_intro_established_count gauge tor_hs_intro_established_count{onion=<onionv3adr>} 18 Which looks like proper data for me. Unfortunately prometheus thinks otherwise. In the prometheus webGUI under "/targets" it complains: > expected label value, got "INVALID" The Prometheus config part is: - job_name: tor_metrics metrics_path: /metrics static_configs: - targets: - <server1>:9035 - <server2>:9035 Servers are running Debian 11, Prometheus 2.32.1 and tor 0.4.6.9-1~d11.bullseye+1 I searched the relays mailinglist and tried to find something in the internet, unfortunately not very successfully. Any ideas? Thanks a lot! fran

2 3

All relays rejected
by lists＠redpanda.bz 23 Jan '22

23 Jan '22

Hi @all, i operate family https://yui.cat/family/BD0630FF0D6E61A906A4D69340B5B1F4FC805498/ and all of my nodes are getting rejected. I have a valid contact info set in my torrc, as MyFamily for all the nodes i operate and all the nodes are running on tor 0.4.6.9 but i recieve: http status 400 ("Fingerprint and/or ed25519 identity is marked rejected -- if you think this is a mistake please set a valid email address in ContactInfo and send an email to bad-relays(a)lists.torproject.org mentioning your fingerprint(s)?") response from dirserver I sent an email already to the bad-relays list but maybe anyone of you got an idea?

2 1

Terraform to deploy Tor Relays
by Andrew Smith 19 Jan '22

19 Jan '22

Hi I wanted to share a project that I've been working on which allows deploying of Tor relays through terraform. The code and documentation is here: https://github.com/andrewmichaelsmith/terrator The focus is on running on cloud hosting providers, currently supported cloud services are digitalocean, vultr and heztner. It works - I'm using it to run some tor relays right now. There are some limitations (documented on github) though and it is still very much a work in progress. As a bit of background, after reading the call to deploy more bridges <https://blog.torproject.org/tor-censorship-in-russia/> I got thinking how useful it could be to deploy a number of bridges by simply editing a config file and pushing 'go'. After a bit of tinerking - torraform <https://github.com/andrewmichaelsmith/terrator> was born. Personally I have this hooked up to Github and Terraform Cloud (both free), meaning I can simply edit 1 file in a git repo to create new relays. Keen to hear feedback or questions! Thanks -- Andy Smith http://andrewmichaelsmith.com | @bingleybeep

2 2

IPV6 address keeps changing every 2-3 days
by Quentin Campbell 19 Jan '22

19 Jan '22

Hi, I'm running a non-exit relay on a home British Telecom broadband connection (FTTC, 20Mb up/80Mb down). Its IP addresses (IPV4 & IPV6) are allocated dynamically. The IPV4 address can remain the same for weeks. However the IPV6 address seems less stable and lasts no more than 2 or 3 days before changing. A consquence of this is that Tor Metrics (atlas) shows a lot of downtime for the node. When I see that the node is down I restart the (UBUNTU) NetworkManager although the host should pick up the new address eventually without doing that? I would like to run a stable node with as little downtime as possible. Any suggestions on how I might improve things; in particular can I automate the checking and restart of the network/TOR whenever the IPV6 address changes? Do I really need to do this? On that last point, I thought that TOR nodes handled more gracefully the issue of dynamic address changes? Is there any source of info on this for dynamic IPV6 addresses? Thanks, Quentin

3 2

Tor related talks @ rC3
by nusenu 17 Jan '22

17 Jan '22

in chronological order: ------------------------------------------------------ title: Towards a more Trustworthy Tor Network when: 2021-12-28, 17:00 CET where: https://streaming.media.ccc.de/rc3/csh primary target audience: - Tor user - Tor relay operators - onion service operators - and everyone that cares about Tor ------------------------------------------------------ title: The Tor Project - State of the Onion when: 2021-12-28, 18:00 CET where: https://streaming.media.ccc.de/rc3/csh ------------------------------------------------------ -- https://nusenu.github.io

2 3

DNS Timeouts - I think the threshold for overload needs raising
by AMuse 16 Jan '22

16 Jan '22

Hi all! I'm operating a TOR Exit on dedicated hardware. The load average is low (0.07) and the network load is fine (120Mb/sec out of a 1Gb/sec link). Connections aren't being dropped, and for all I can see things are fine. However, on the TOR Metrics relay search, my exit consistently shows as "Overloaded" due to DNS failures. >From my logs, I never go above 2% in DNS failures and from the debugging I've done so far it looks like most of the failures are in IPv6 lookups not returning an AAAA record because the destination site has no AAAA configured. Could whoever runs the "Overloaded" flag consider upping the overload limit to 2% or so? Or, can we tune out ipv6 and ipv4 failures separately maybe? This was never an issue until I configured my relay for v6. =========== Jan 15 19:57:45.000 [notice] General overload -> DNS timeouts (65) fraction 1.0619% is above threshold of 1.0000% Jan 15 20:07:45.000 [notice] General overload -> DNS timeouts (67) fraction 1.0124% is above threshold of 1.0000% Jan 15 20:17:45.000 [notice] General overload -> DNS timeouts (71) fraction 1.1275% is above threshold of 1.0000% Jan 15 20:27:45.000 [notice] General overload -> DNS timeouts (94) fraction 1.4003% is above threshold of 1.0000% Jan 15 20:37:45.000 [notice] General overload -> DNS timeouts (72) fraction 1.2000% is above threshold of 1.0000% Jan 15 20:47:45.000 [notice] General overload -> DNS timeouts (75) fraction 1.2517% is above threshold of 1.0000% Jan 15 20:57:45.000 [notice] General overload -> DNS timeouts (70) fraction 1.1605% is above threshold of 1.0000% Jan 15 21:07:45.000 [notice] General overload -> DNS timeouts (92) fraction 1.6028% is above threshold of 1.0000% Jan 15 21:17:45.000 [notice] General overload -> DNS timeouts (73) fraction 1.3290% is above threshold of 1.0000% Jan 15 21:27:45.000 [notice] General overload -> DNS timeouts (73) fraction 1.2907% is above threshold of 1.0000% Jan 15 21:37:45.000 [notice] General overload -> DNS timeouts (65) fraction 1.0095% is above threshold of 1.0000% Jan 15 21:47:45.000 [notice] General overload -> DNS timeouts (83) fraction 1.2635% is above threshold of 1.0000%

2 2

New non-exit relay - DirPort question
by Richard Menedetter 16 Jan '22

16 Jan '22

Hi all I installed a non-exit relay 5 days ago. Works actually quit nicely. I was awarded the stable flag. (Also had briefly the HSDir flag, but lost it after a restart. Too early for the Guard flag.) So I think everything looks good. I have DirPort 9030 in my config. It is shown in nyx and the tor process listens there. But the relay search page says: Dir Address none It looks like this on my server: tcp 0 0 0.0.0.0:9030 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:9001 0.0.0.0:* LISTEN tcp6 0 0 :::9001 :::* LISTEN Why is it not shown and used by TOR? And what is directory for anyways? Why is it not listening und using IPv6 additionally to IPv4? Did I need to configure something additionally to get it running? Some TOR nodes show a port there. Anything to consider for new relay operators? I have limited the network traffic to 15 MB/s, so 240 MBit/s (bidirectional) so I should be well below my allowance. CU, Ricsi

3 3

Re: [tor-relays] Home Tor Middle Relay Blacklisted
by zorc 13 Jan '22

13 Jan '22

> Fellow Tor Operators: > > After about 9 months of running Tor as a Middle Relay from my home network, I'm beginning to experience signs of my public semi-static IPv4 address being blacklisted with 403 Forbidden errors from Reuters and Venmo. I've confirmed by successfully accessing both sites with my mobile internet connection. > > I'm not surprised that Venmo is blacklisting, but extremely surprised I'm being blocked by Reuters. You would think such a organization would be a proponent of free speech. I wouldn't be surprised if Reuters used Tor in some capacity. It doesn't make sense. > > When Googling my public semi-static IPv4 address, it appears in several Tor blacklists. That being said, I'm at the point that, at a minimum, I will have to ask my ISP to freshen my public semi-static IPv4 address. > > Previously, when speaking with my ISP, they mentioned offering a static IPv6 address at no cost. I'm wondering if that offer was with the expectation that I would have to give up my existing IPv4 semi-static address? If they provided both IPv4 and IPv6 addresses, at no cost, I'd like to run a Tor Bridge using the?semi-static?IPv4 address and configure my existing Middle Tor Relay to use the new static IPv6 address. That way, I'll be able to browse unimpeded through the?semi-static?IPv4 address and not have to be concerned with the static IPv6 address being blacklisted. > > Are other Tor Operators experiencing similar issues? Will I continue to experience blacklisting issues, even after migrating to a Tor Bridge? What are best practices in moving an existing Tor Relay to a new address, while avoiding the loss of flags? > > As always, I appreciate the feedback. > > Respectfully, > > Gary? Hi Gary, I'm having a similar experience. My main solution is (somewhat ironically I guess) to use a VPN. The sum of the two work reasonably well. When the VPN is blocked by something, my residential IP is usually not. What I also did once is directly contact a service I am paying for, and tell them to please use the Tor exit list instead of the Tor all-relays list if they really need. After some back and forth, this site started working again, although I never heard anything back from them whether this was indeed due to my enquiry. Maybe this could work for Reuters too if you explain to them how Tor is helping especially journalists? As for the IPv6, my understanding is, that currently IPv6-only relays are not possible, i.e. your IPv4 would still show up on the blocklists. In addition, it would also show up as a Tor relay, i.e. your bridge would become blocked too. Not 100% sure on this, so someone please correct me if I'm wrong. Cheers, zorc PGP 64c416e08f0575609d6212c075c6b8e01967b659 Sent with ProtonMail Secure Email.

2 1

Bridge showing offline
by Eddie 12 Jan '22

12 Jan '22

Looking at tor metrics, one of my bridges is showing as off-line: B080140DC1BAB5B86D1CE5A4CA2EF64F20282440 However, the log isn't showing any issues: Oct 14 00:00:28.000 [notice] Tor 0.4.5.8 opening new log file. Oct 14 00:00:28.000 [notice] Configured hibernation. This interval began at 2021-10-14 00:00:00; the scheduled wake-up time was 2021-10-14 00:00:00; we expect to exhaust our quota for this interval around 2021-10-15 00:00:00; the next interval begins at 2021-10-15 00:00:00 (all times local) Oct 14 01:49:40.000 [notice] Heartbeat: Tor's uptime is 124 days 6:00 hours, with 0 circuits open. I've sent 907.23 GB and received 922.28 GB. I've received 63052 connections on IPv4 and 8375 on IPv6. I've made 512684 connections with IPv4 and 100974 with IPv6. Oct 14 01:49:40.000 [notice] While not bootstrapping, fetched this many bytes: 1801791624 (server descriptor fetch); 175792 (server descriptor upload); 221750347 (consensus network-status fetch); 10974 (authority cert fetch); 19905655 (microdescriptor fetch) Oct 14 01:49:40.000 [notice] Heartbeat: Accounting enabled. Sent: 140.52 MB, Received: 140.69 MB, Used: 281.21 MB / 200.00 GB, Rule: sum. The current accounting interval ends on 2021-10-15 00:00:00, in 22:10 hours. Oct 14 01:49:40.000 [notice] Heartbeat: In the last 6 hours, I have seen 14 unique clients. Initially I thought of a previous issue I had with IPv6 connectivity, but don't think this is the problem here as the 2nd bridge on the same server is showing on-line. Also an IPv6 port scan shows the ports for both bridges as accessible. Ideas ?? Cheers.

5 8

Home Tor Middle Relay Blacklisted
by Gary C. New 10 Jan '22

10 Jan '22

Fellow Tor Operators: After about 9 months of running Tor as a Middle Relay from my home network, I'm beginning to experience signs of my public semi-static IPv4 address being blacklisted with 403 Forbidden errors from Reuters and Venmo. I've confirmed by successfully accessing both sites with my mobile internet connection. I'm not surprised that Venmo is blacklisting, but extremely surprised I'm being blocked by Reuters. You would think such a organization would be a proponent of free speech. I wouldn't be surprised if Reuters used Tor in some capacity. It doesn't make sense. When Googling my public semi-static IPv4 address, it appears in several Tor blacklists. That being said, I'm at the point that, at a minimum, I will have to ask my ISP to freshen my public semi-static IPv4 address. Previously, when speaking with my ISP, they mentioned offering a static IPv6 address at no cost. I'm wondering if that offer was with the expectation that I would have to give up my existing IPv4 semi-static address? If they provided both IPv4 and IPv6 addresses, at no cost, I'd like to run a Tor Bridge using the semi-static IPv4 address and configure my existing Middle Tor Relay to use the new static IPv6 address. That way, I'll be able to browse unimpeded through the semi-static IPv4 address and not have to be concerned with the static IPv6 address being blacklisted. Are other Tor Operators experiencing similar issues? Will I continue to experience blacklisting issues, even after migrating to a Tor Bridge? What are best practices in moving an existing Tor Relay to a new address, while avoiding the loss of flags? As always, I appreciate the feedback. Respectfully, Gary— This Message Originated by the Sun. iBigBlue 63W Solar Array (~12 Hour Charge) + 2 x Charmast 26800mAh Power Banks = iPhone XS Max 512GB (~2 Weeks Charged)

2 1

Overloaded relay - need help with how to debug using MetricsPort
by nottryingtobelame 09 Jan '22

09 Jan '22

The page linked to by the "overloaded" alert on my relay's Relay Search page mentions using MetricsPort for troubleshooting, but it provides no information on how to actually use it. I posted about this issue on Reddit and no one has replied with a viable guide to help me out, though one user was able to find a page showing at least the syntax for MetricsPort. I also reached out to network-report(a)torproject.org and have not received a reply. I found discussion about the implementation of MetricsPort on the Tor Project github but it would be nice if the Tor Project officially documented this, especially since it is suggested in the guidance for resolving this problem. At any rate, my relay is 4.5 years old and I've never had a problem with it being overloaded until now. It is on a Raspberry Pi 4 (4 GB) and that doesn't appear to be anywhere near maxing out CPU or memory usage. The only change I have made is putting it behind a pfSense hardware firewall, but the firewall itself is not maxing out in CPU or memory usage or even storage. So, any help that anyone can provide is greatly appreciated! Thanks in advance!

1 0

Strange thing happening in metrics
by David Hu 09 Jan '22

09 Jan '22

Hello awesome people, I have been running a Tor relay for a while with bandwidth progressively increasing. However in Tor Metrics, it shows like the attached (i.e. consensus weight decreased some, and middle probability as a consequence decreased as well). How is it supposed to happen?

3 2

Leaving tor
by Jonas 07 Jan '22

07 Jan '22

Grüezi, I run a large number of bridges, which hopefully only the tor project can see them and confirm they are mine. I know they are used because I can see the traffic utilization over time. Hopefully they were helpful, especially to people in Russia over the past few weeks. After being harassed by multiple paranoid people over the bridges along with accusations of all kinds, I give up. I do not need this drama. The servers on which the bridges run are good for a while, but I am dropping out of the mailing lists, forum, and matrix. Eventually the bridges will go away too. Merci vilmal and herzlichen glückwunsch! Jonas

2 1

General overload -> DNS timeouts
by Intrepid Ibex 07 Jan '22

07 Jan '22

Hi everybody, I am new to tor (as server operator) and try to support the network by operating an exit node. Machine is running Ubuntu 20.04 - Tor 0.4.6.8. nyx is giving me a notive every 10 minutes or so: [NOTICE] General overload -> DNS timeouts (6) fraction 1.4742% is above threshold of 1.0000% DNS on this machine however works perfectly. I told my tor browser to use my specific exit node, everything works fine. Node is running since 4 days now. Load is as expected. Thanks in advance for any help! Ibex \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

13 25

Tor relay struggling with circuit creation (CPU Limit)
by GANDI24325_TOR 07 Jan '22

07 Jan '22

Hi Tor relay community, I have recently made a new tor relay, and all is going well however I use NYX to mointor it and over the last day it has been giving the warning message seen below in the nyx mointor, the relay had been running fine for it's first 4 days of life but now shows this message for nealry 30 hours now (scrolling through logs) Also the nyx mointor shows a CPU usage of 80-90% so I know this is the limiting factor and have no issue with it as this server is just free VPS that I am donating so ideally would like it to pump out as much data in/out as possible, but my question is, Do I need to change my torrc to fix this error or will the tor network realize overtime how much traffic is best for this node? Useful information: https://metrics.torproject.org/rs.html#details/448E2528A4AC58A7531EC950AAF0…: GANDI24325second the relay in quesiton, with this website showing everything as fine Family: https://metrics.torproject.org/rs.html#search/family:BC77562EF192F0A580F54D…: the other two relays are working fine Contact info: GANDI24325_TOR [at] protonmail (dot) com Addtional info: If I haven't provided enough infomation/if you want the torrc I can help Thanks in advance for any help Warning messages: 09:10:10 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [2012 similar message(s) suppressed in last 120 seconds] │ 09:09:09 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [1467 similar message(s) suppressed in last 60 seconds] │ 09:08:08 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [628 similar message(s) suppressed in last 60 seconds] │ 09:07:08 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [518 similar message(s) suppressed in last 120 seconds] │ 09:05:57 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [10092 similar message(s) suppressed in last 2820 seconds] │ 08:19:05 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [13039 similar message(s) suppressed in last 120 seconds] │ 08:18:04 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. │ [11034 similar message(s) suppressed in last 60 seconds] │ 08:17:04 [WARN] Your computer is too slow to handle this many circuit creation requests! Please │ consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. ─┘ [7335 similar message(s) suppressed in last 60 seconds]

2 1

Some questions about the uptime requirement
by David Hu 06 Jan '22

06 Jan '22

Hello Tor Relay operators, I am hosting a rather new Tor relay and my uptime is only about 13 hours, while I would like to contribute to Tor by continuing as a relay (NOT an exit one though because of frequent abuse of exit relays and my ISP won't allow it). My question is that I am going to another location for vacation for 3 days and my relay would probably not be up during that time. Does that forfeit my chance to be chosen by clients forever? Thank you! Regards, David

2 1

TOR Metrics showing relay as down but logs show it is apparently active
by Tor Geheimschreiber 05 Jan '22

05 Jan '22

Not sure if this is the correct list on which to ask but a new node created just over 7 days ago is now being shown on Tor Metrics (atlas.torproject.org) as being down. However local logs show heartbeat activity and some directory activity. A port scan of the IP address shows: -- cut here Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-05 14:22 GMT Nmap scan report for [redacted] Host is up (0.018s latency). Not shown: 997 closed ports PORT STATE SERVICE 22/tcp filtered ssh 8085/tcp open unknown 9001/tcp open tor-orport Nmap done: 1 IP address (1 host up) scanned in 1.27 seconds -- cut here /var/log/tor/notices.log shows: -- cut here Jan 05 00:00:34.000 [notice] Tor 0.4.6.9 opening new log file. Jan 05 02:45:49.000 [notice] Heartbeat: Tor's uptime is 6 days 8:42 hours, with 3189 circuits open. I've sent 337.09 GB and received 332.67 GB. I've received 64461 connections on IPv4 and 13628 on IPv6. I've made 106191 connections with IPv4 and 36300 with IPv6. Jan 05 02:45:49.000 [notice] While not bootstrapping, fetched this many bytes: 104491070 (server descriptor fetch); 5940 (server descriptor upload); 11006113 (consensus network-status fetch); 1211313 (microdescriptor fetch) Jan 05 02:45:49.000 [notice] Circuit handshake stats since last time: 632/632 TAP, 172332/172332 NTor. Jan 05 02:45:49.000 [notice] Since startup we initiated 0 and received 0 v1 connections; initiated 0 and received 17 v2 connections; initiated 0 and received 0 v3 connections; initiated 2 and received 11816 v4 connections; initiated 113167 and received 63288 v5 connections. Jan 05 02:45:49.000 [notice] Heartbeat: DoS mitigation since startup: 0 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 0 same address concurrent connections rejected, 0 connections rejected, 0 single hop clients refused, 0 INTRODUCE2 rejected. Jan 05 08:45:49.000 [notice] Heartbeat: Tor's uptime is 6 days 14:42 hours, with 131 circuits open. I've sent 341.77 GB and received 337.28 GB. I've received 66326 connections on IPv4 and 13652 on IPv6. I've made 108563 connections with IPv4 and 37174 with IPv6. Jan 05 08:45:49.000 [notice] While not bootstrapping, fetched this many bytes: 108020255 (server descriptor fetch); 8064 (server descriptor upload); 11383626 (consensus network-status fetch); 1232744 (microdescriptor fetch) Jan 05 08:45:49.000 [notice] Circuit handshake stats since last time: 193/193 TAP, 57579/57579 NTor. Jan 05 08:45:49.000 [notice] Since startup we initiated 0 and received 0 v1 connections; initiated 0 and received 17 v2 connections; initiated 0 and received 0 v3 connections; initiated 3 and received 11912 v4 connections; initiated 115806 and received 65008 v5 connections. Jan 05 08:45:49.000 [notice] Heartbeat: DoS mitigation since startup: 0 circuits killed with too many cells, 0 circuits rejected, 0 marked addresses, 0 same address concurrent connections rejected, 0 connections rejected, 0 single hop clients refused, 0 INTRODUCE2 rejected. -- cut here Any pointers on how to investigate the problem further would be welcome. Thanks, Quentin

2 1

Maybe the next step in russian Tor discrimination
by Tor Relays 03 Jan '22

03 Jan '22

Hello, i have a relay at profitserver.ru at their Chelyabinsk location and recently the relay fell out of the consensus. I can ping all authorities with IPv4 and IPv6 and torproject.org is not blocked. I opened the ControlPort and tried to manually create circuits to the authorities. extendcircuit 0 authoritynickname getinfo circuit-status I observed that i can successfully create circuits to no more than three authorities and it seems to change to which authorities i can create circuits. The unsuccessful circuits stay in EXTENDED but never reach BUILT until Tor gives up eventually. Currently no other of my russian relays are affected. I am not an expert with the ControlPort but i hope this is proving what i tried to prove. Here is the conversation with the support: me: Hello, I am running a (non-exit) Tor relay on the VPS and it stopped working a few weeks ago. I can ping the Tor authorities IP addresses but when i try to manually create a Tor circuit it seems to timeout 6 out of 9 times which indicates some blocking attempts on your (or your upstream providers) side. I have a couple of other Tor relays in russia and i have never seen routinely failing manually created circuits to the Tor authorities. Do you block Tor or do you otherwise mess with Tor traffic? support agent: Hello, i can't say something about TOR network, now. We have black box from government, which can control traffic, and perhaps block TOR. Ourselves don't block TOR me: Thanks for your answer. The TSPU from Roskomnadzor that is doing Deep Packet Inspection? I feel with you and all the russian citizens... :( Good luck support agent: Maybe it's a black box If this is indeed their blackbox messing with Tor traffic then it is quite subtile because it does not block torproject.org and pings to the authorities are going through. The relay suddenly was online for one consensus in the last weeks and i can still use it when i manually set it as a Guard in my Tor client. So if you run a relay in russia and you experience weird stuff with it then you may not only want to check if you can reach the authorities by ping but you may want to try to manually craft a circuit to all of them. Hope that helps anyone Cheers

5 4

running a bridge
by carl box 02 Jan '22

02 Jan '22

4 3

Relay operators meetup @ rC3
by Stefan Leibfarth 29 Dec '21

29 Dec '21

Greetings relay operators, the annual Tor relay operators meetup will be tomorrow (28th) at 2200 UTC+1. No rC3 ticket required, I'll post the public link here as soon as it's available. Looking forward to meeting you Leibi

4 4

[Censorship in Russia] More of my bridges got blocked
by spaceoddity＠disroot.org 29 Dec '21

29 Dec '21

Hello Tor people, just me chipping in about recent event. Today, I discovered that somewhere around Dec, 22, all three of my recently launched bridges have been censored on at least one network (MegaFon Moscow AS25159). Metrics show a drastic traffic drop in the range of Dec, 21-23 for all three bridges. Investigating further, I discovered (using tcptraceroute/nc) that all three hosts started responding with RSTs to all of their open ports (not only bridge ports but SSH and other recently opened ports too). NATd source IP address was unchanged from my usual one in every case. One of the bridges had distribution method set to HTTPS, and the other two were distributed via Moat. All ran recent Tor 0.4.6.8 Docker image. NB: One of the bridges has incorrect 'First seen' date on the metrics portal - it displays '2021-12-25' despite being launched several days prior. To summarize: 1. Bridge blocking happens via the common 'fast RST' method 2. It happened relatively quickly (all bridges are less than 10 days uptime by now). 3. Somehow, all three of my recently launched bridges were blacklisted despite using different ASs/hosters/countries for each. Is it a coincidence, or it's because Moat prefers to hand out newer bridges first, or due to something else entirely? Also, I can not rule out that some step in my distribution chain was compromised -- I gave out these bridges privately to a few friends. -- Best regards, Space Oddity.

3 4

Incorrect "first seen" info
by a tor op 28 Dec '21

28 Dec '21

I notice that the "first seen" info on my obfs4 bridge status page on tor atlas / metrics all of a sudden is incorrect, by years. Not sure if it's something that introduced itself with latest update or what. The various graphs on traffic and users are still correct through. A tor op

3 3