- tor-relays - lists.torproject.org

TransPort: Convert iptables to pf
by diffusae 28 Dec '16

28 Dec '16

Hello! Does anybody know how to convert this to pf rules in FreeBSD: iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040 I' running a Tor client in a jail on a different IP and want to route only the .onion traffic through. The DNS stuff is working fine, but I can't find a solution for the above iptables rule, which is working. I like transparently do DNS and Routing for .onion traffic on the network. I looked into the wiki and also find some pf rules, which are routing all the traffic though Tor, but this only works locally. The machine is on FreeBSD 11.0-STABLE. Tor is running in a jail with cloned loopback interface (lo1) and has also a private IP address on the main NIC. Maybe you have some hints. Thanks a lot Regards,

5 11

Relay is missing Running flag in the consensus
by Dmitrii Tcvetkov 28 Dec '16

28 Dec '16

Hello, I have a problem with one[1] of my exit relays: about a week ago this relay lost its Running flag, but it was running all the time. I upgraded Tor on this relay to 0.2.9.7-rc from "tor-devel" FreeBSD port and restarted it. Relay was and still is accessible from outside via ports 80 and 443. FreeBSD version is 11.0-RELEASE-p2. After about 24 hours running on new version I decided to check votes from bwauth on detailed page here[2]. Back then the relay had votes for Running flag from maatuuska, dizum and dannenberg. I've checked the relay's ability to open connections to bwauths and it couldn't connect to longclaw - connection timed out, all other bwauths are reachable from the relay. Test was performed by command "openssl s_client -connect <bwauth ip>:443". Ipfw and pf are disabled on the server, there are only tor, ssh and local_unbound running, unbound uses my recursive DNS resolver on another server. DNS queries are resolved fine. Then I saved /var/db/tor directory and started Tor with fresh identity[3], but in about 6 hours it showed similiar symptoms: only maatuska, dizum and dannenberg were voting for it, so I switched back to old identity[1] since. In December 23th I decided to downgrade Tor version back to 0.2.8 from FreeBSD port "tor" and I enabled info level logging. The relay was running since with version 0.2.8.11, at the moment still only 3 bwauth are voting "Running" flag for it: maatuska, dizum and dannenberg. All bwauths except longclaw are accessible from the server. All bwauths are accessible from my neighbour relays in the same datacenter[4][5]. Log info.log has size of 200 megabytes at the moment, first concerning message is: Dec 23 11:54:23.000 [warn] Cannot make an outgoing connection without a DirPort. messages during relay startup, but they disappear eventually: # grep -c 'outgoing connection without a DirPort' info.log 19 They don't look like a reason for the problem. Another anomaly is huge amount of messages like Dec 23 11:54:24.000 [info] router_pick_published_address: Success: chose address '85.143.213.44'. ... Dec 26 13:58:31.000 [info] router_pick_published_address: Success: chose address '85.143.213.44'. # grep -c router_pick_published_address info.log 1653449 I upgraded Tor to version 0.2.9.8 from FreeBSD port "tor". The flood of router_pick_published_address doesn't reproduce with new version. I can compress the log file to 2 mb file with xz -9 and publish it, though I don't want to do it right away because of the warning: Dec 23 11:54:20.000 [warn] Your log may contain sensitive information - you're logging more than "notice". Don't l og unless it serves an important reason. Overwrite the log afterwards. as I don't really know what exact info I should scrub from it. Currently relay is running with identity[1] and version 0.2.9.8 with info logging. Traceroute to longclaw: 17:05:15-root@bsd1 ~ # traceroute 199.254.238.53 traceroute to 199.254.238.53 (199.254.238.53), 64 hops max, 40 byte packets 1 192.168.240.102 (192.168.240.102) 0.084 ms 0.088 ms 0.059 ms 2 192.168.240.5 (192.168.240.5) 0.664 ms 0.180 ms 0.105 ms 3 85.143.208.1 (85.143.208.1) 1.035 ms 1.437 ms 3.960 ms 4 185-47-53-25.customer.comfortel.pro (185.47.53.25) 0.759 ms 0.615 ms 0.645 ms 5 81-27-254-184.rascom.as20764.net (81.27.254.184) 1.507 ms 1.213 ms 1.300 ms 6 80-64-96-225.rascom.as20764.net (80.64.96.225) 12.082 ms 11.974 ms 11.867 ms 7 xe-9-2-0.bar1.Stockholm1.Level3.net (213.242.110.113) 11.781 ms 11.575 ms lag-127-401.ear1.Stockholm2.Level3.net (213.242.110.41) 12.083 ms 8 * * * 9 63-235-41-149.dia.static.qwest.net (63.235.41.149) 112.242 ms 115.032 ms 117.349 ms 10 * * * 11 65.116.154.6 (65.116.154.6) 182.361 ms 182.780 ms 185.128 ms 12 208.99.210.41 (208.99.210.41) 181.991 ms 182.831 ms 182.524 ms 13 208.99.192.65 (208.99.192.65) 181.698 ms 182.007 ms 182.437 ms 14 204.8.32.86 (204.8.32.86) 185.968 ms 185.809 ms 185.945 ms 15 wren.riseup.net (198.252.153.1) 181.940 ms 181.907 ms 181.890 ms 16 * * * 17 * * * Please tell what I can do to understand a reason of the problem. P.S. During compress attempt of the log memory of the server was exhausted: xz and tor processes were killed. So log is containing information since Dec 23 11:54:20 UTC till Dec 26 13:58:39 UTC. I'll compress logs on another machine. [1] 1836695E7DFE2F80B13A9884431759B5DD19F1DA [2] https://consensus-health.torproject.org/ [3] 9E2833F5F95421B52A5336F66B063E471725F011 [4] 2C2CD992B785F09752278260DCD8D6D6242BB87A [5] 7F350D9EAD6C74730FB13862308BE60FA9B19678

2 1

Re: [tor-relays] [tor-talk] 33c3 and tor?
by Nicolas Braud-Santoni 28 Dec '16

28 Dec '16

On Mon, Dec 26, 2016 at 08:56:04AM -0500, Roger Dingledine wrote: > On Tue, Dec 20, 2016 at 02:37:19PM +0100, fatal wrote: > > And will there be a tor relay operators meetup? > > [...] > I think there is no separate relay operators meeting, so relay > operators are welcome in this workshop space too. I was made to spontaneously organise one (after I asked a certain Moritz if there would be one) on day 3 (Thursday), 10pm : https://events.ccc.de/congress/2016/wiki/Session:Tor_Relays_Operators_Meetup We currently have hall C.2, which can host ~50 people, but I will try to organise a larger venue based on the success of tomorrow's meetup. Best, and hoping to see you there, nicoo

1 0

TransPort: Convert iptables to pf _ nat
by Felix 27 Dec '16

27 Dec '16

>>> scrub in all >>> nat pass on $ext_if from $NET_JAIL to any -> $IP_PUB >>> rdr pass on $ext_if proto tcp from any to $IP_PUB port $PORT_TOR_JAIL -> >>> $IP_JAIL_TOR port $PORT_TOR_JAIL >> >> That looks good. >> >> There is no "pass out quick" or "pass out on" statement? > > Sure, there is. > pass out on $ext_if proto { tcp udp icmp } all modulate state Remove 'pass' form 'nat pass' if the packet shall flow through the 'pass out' rule after 'nat'. Otherwise it will pass out without respect to any rule. [] https:// www.freebsd.org/cgi/man.cgi?query=pf.conf&sektion=5#end -- imho, looking forward to 33C3 :)

1 0

George Shuklin relays: please specify MyFamily in torrc
by nusenu 26 Dec '16

26 Dec '16

Hi George Shuklin, thanks for running tor relays. Please do not forget to set the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator. If you need help with the MyFamily option let us know. thanks, nusenu https://github.com/nusenu/ansible-relayor https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan…

1 0

neelc.org relays: MyFamily update required
by nusenu 26 Dec '16

26 Dec '16

Hi Neel, one of your relays got a new key, please do not forget to update your MyFamily setting. thank you, nusenu https://atlas.torproject.org/#search/69.126.169.33 https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… +---------------------+----------------+---------------+ | first_seen | IP | MyFamilyCount | +---------------------+----------------+---------------+ | 2016-08-10 01:00:00 | 89.187.144.122 | 4.0000 | | 2015-04-15 18:00:00 | 107.181.174.84 | 4.0000 | | 2016-09-05 22:00:00 | 108.29.79.159 | 4.0000 | | 2016-12-17 17:00:00 | 69.126.169.33 | 2.0000 | +---------------------+----------------+---------------+

2 2

Re: [tor-relays] 2bithacker.net relays: MyFamily fixed.
by nusenu 25 Dec '16

25 Dec '16

Chip Marshall: > Should be all fixed up now, thanks for the headsup. yes it is fixed now, thanks! +-------------+----------------+ | nickname | eMyFamilyCount | +-------------+----------------+ | 2bitsgsin01 | 12.0000 | | 2bitusnyc02 | 12.0000 | | 2bitusnyc01 | 12.0000 | | 2bitdefra01 | 12.0000 | | 2bitgblon01 | 12.0000 | | 2bitinblr01 | 12.0000 | | 2bitcator01 | 12.0000 | | 2bitusnyc03 | 12.0000 | | 2bitussfo01 | 12.0000 | | 2bitnlams02 | 12.0000 | | 2bitussfo02 | 12.0000 | | 2bitnlams03 | 12.0000 | +-------------+----------------+

1 0

Minimum requirements for becoming a guard
by Rana 25 Dec '16

25 Dec '16

What are the absolute minimum requirements for becoming a guard? [I am not asking about being trustworthy which I am obviously not, only about bandwidth etc. :)]

2 1

FW: Merry Christmas from President Obama and the First Lady
by I 25 Dec '16

25 Dec '16

1 0

Multiple Tor Instances
by Dakota Hourie 24 Dec '16

24 Dec '16

Hi Everyone, Would anyone be able to point me in the right direction to be able to run multiple instances of tor for a multi core cpu. Tor version is 2.9.8 on Ubuntu 16.04. Thanks -- Dakota Hourie --

5 7