- tor-relays - lists.torproject.org

how important is configuring DNSSEC root trust anchor for 'unbound' running on an exit node?
by Dhalgren Tor 03 Oct '15

03 Oct '15

Is it important to configure the DNSSEC trust-anchor for an instance of 'unbound' running on an exit node? I put a lot of work into setting up a new exit and want to take a break, but just noticed this item. 'unbound' was built from source rather than installed from a distribution, so this step must be performed manually. The relay resides in the high-quality German LeaseWeb network and the risk of DNS mischief appears low.

1 1

excessive bandwidth assigned bandwidth-limited exit relay
by Dhalgren Tor 03 Oct '15

03 Oct '15

Have a new exit running in an excellent network on a very fast server with AES-NI. Server plan is limited to100TB so have set a limit slightly above this (18000000 bytes/sec) thinking that bandwidth would run 80-90% of the maximum and average to just below the plan limit. After three days the assigned bandwidth for the relay is going up instead of moderating--looks like the measurement system has a problem in this case. Just dropped the limit to 16500000 to stay below 100TB with maximum load. A good number appears to be around 65000 to 70000, but 98000 was just assigned. What can be done to extract proper rating from measurement system? Tried setting TokenBucketRefillInterval to 10 milliseconds for more exact control but this has not helped. Should an IPTABLES packet-dropping limit be established? Can the rating system be fixed?

7 28

replace BandwidthRate with "traffic control" on busy routers
by Dhalgren Tor 03 Oct '15

03 Oct '15

Routers running at or near a BandwidthRate setting offer terrible latency and induce connection time-outs. Refuse all DIR-port requests with "HTTP/1.0 503 Directory busy, try again later ". 'tc' ingress filter is dramatically better for rate-limiting. For case and 'tc' example see final post https://lists.torproject.org/pipermail/tor-relays/2015-October/007901.html initial post https://lists.torproject.org/pipermail/tor-relays/2015-October/007863.html

1 0

Onionoo down?
by Geoff Down 03 Oct '15

03 Oct '15

A query using Globe stalls at the 'processing - please wait' stage, so I assume the problem is actually with Onionoo. GD -- http://www.fastmail.com - Same, same, but different...

4 4

how reliable is the advertised vs consumed bandwidth on tor metrics
by jensm1 02 Oct '15

02 Oct '15

I just stumbled over this (https://metrics.torproject.org/bandwidth-flags.html) graph at tor metrics, which shows advertised exit bandwidth to be around 40Gbit/s and consumed exit bandwidth around 20Gbit/s. This would mean that we have about twice as much exit bandwidth than we need, which I strongly doubt. So now I'm curious about what causes this disparity. Thanks!

2 1

doesn't Tor 0.2.7.3_rc like IPv6 ?
by Toralf Förster 29 Sep '15

29 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Looking at the daily traffic stats got from my ISP I had an Incoming of 50 GB/day and Outgoing of 1.6 GB with version 0.2.6.10 whereas the -rc now gives 8 GB Incoming and 0.06 Outgoing. Anybody with similar experiences ? - -- Toralf, pgp key: 872AE508 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlYJjuYACgkQxOrN3gB26U5DngD/VSJ00A9sstKQ2PNPYrJcJNFZ b+m0SJ4BJK84b9Tt3kwA/jcbLwkgiteMjCTqBRRmAEti8SQtSolvY24wP0GR7Luv =HFDD -----END PGP SIGNATURE-----

4 5

Library Freedom Project
by Kenneth Freeman 29 Sep '15

29 Sep '15

This institutional support for the Tor Project is extremely important. https://en.wikipedia.org/wiki/Library_Freedom_Project The Tor Browser and Intellectual Freedom in the Digital Age https://journals.ala.org/rusq/article/view/5704/7092

1 0

IP and SWIP for a Tor exit node
by starlight.2015q3＠binnacle.cx 27 Sep '15

27 Sep '15

>> (2) SWIP/RWHOIS + ARIN/RIPE >> >> SWIP'ing is a bit exotic though some ISPs provide it. >> Be sure to use a PO box in the contact info rather than >> your real address if you obtain this. > >This would be for privacy reasons, right? i.e. to avoid >advertising my own address? yes >What if I put there my university address? >(I am a PhD there and we can receive mail. . . Sure, that would work perfectly. >> Looked at Aruba offerings, check this out >> >> https://serverdedicati.aruba.it/server-dedicati/basic-1-3.aspx >> >Thanks very much for the advice. I will start >with the small VPS one, see how Aruba behaves >in terms of handling complaints and abuse >reports and if all goes well I will consider >the option above. If you do, try to find out exactly what CPU it will have and whether you can choose if more than one type exists; check them against this list: https://en.wikipedia.org/wiki/List_of_Intel_Atom_microprocessors Several newer Atom CPUs have AES-NI instruction support. With AES-NI a 1.6 GHz will "punch above its weight" as a Tor relay. AES supports increases performance for Tor relays by about 2.5 times clock-cycle-for-clock-cycle. >Thank you for taking the time of looking into it. Your are welcome, good luck!

1 0

IP and SWIP for a Tor exit node
by starlight.2015q3＠binnacle.cx 27 Sep '15

27 Sep '15

>I have bought some credit on Aruba. . . Looked at Aruba offerings, check this out https://serverdedicati.aruba.it/server-dedicati/basic-1-3.aspx For 15 euros/month you can have a dedicated dual-core 1.6GHz with 100MBPS unmetered traffic. This will make a rather nice exit node for the cost and will run better than a typical VPS where one has no control over system load. Even with the low clock-speed, network processing latency will be very good. Probably is an Atom or maybe a Celeron CPU and the it will probably run at close to 100%--not a problem. If one 'tor' instance does not use more than 30-40% of the 100MBPS due to limited CPU, fire up a second relay. Up to two relays can run on a single IP address. But if one 'tor' instance runs at 50-60% of bandwidth or better it would make sense to stick with just the one. Non-exit relays typically load at 25-35%; is the intentional design of the bandwidth allocation system. However due to the relative shortage of them, exits run more like 80% of useable bandwidth as determined by the BWauths.

2 1

IP and SWIP for a Tor exit node
by starlight.2015q3＠binnacle.cx 27 Sep '15

27 Sep '15

(1) In the guide it is advised to "Get a separate IP for the node. . . You have the right idea. Tor-exit node IPs end up on all sorts of black-lists and it's best to segregate exit traffic from all other traffic. Try pulling up a few exits using http://multirbl.valli.org and you will see this. In particular, Tor exits usually test positive on http://www.abuseat.org/ (aka the Spamhaus CBL) as all sorts of infectious malware bot(s). (2) SWIP/RWHOIS + ARIN/RIPE SWIP'ing is a bit exotic though some ISPs provide it. Be sure to use a PO box in the contact info rather than your real address if you obtain this. What happens is that the handful of IP addresses assigned to your server get their own WHOIS sub-record listed first before the ISP address-block record. Has the advantage many abuse complaints will go directly to you instead of first to the ISP. At one time some residential ISPs SWIP'ed their customers by default, but this produced all kinds of problems and complaints so the practice is gone. Not necessary if you can manage a constructive dialog with the abuse department of the ISP. Start with an email to the address that http://www.abusix.org/ lists for the IP and ask them what procedures they might have where you can have abuse reports forwarded directly to you and/or have the IP noted as a Tor Exit / VPN / Proxy in whatever system they have for handling abuse reports. Most abuse reports are automated spam from WordPress blogs complaining about brute-force password attacks and automatic malware-detecting honeypots. If you hear from a real person it will be extraordinary.

2 1