- tor-relays - lists.torproject.org

FW: RE: Re: Re: QUESTION: OBFS4 on secondary IP and NAT
by C. Pe. 05 Aug '25

05 Aug '25

Seems I only answered to George, instead of all, sorry. ---------------------------------------- Betreff: FW: RE: Re: [tor-relays] Re: QUESTION: OBFS4 on secondary IP and NAT Von: C. Pe. <peca-relay(a)mailfence.com> An: George Hartley <hartley_george(a)proton.me> Datum: 05.08.2025, 14:41:41 I am of course not the expert here. However - NoAdvertise and NoListen are usually combined in two consecutive ORPort statements. This is done to in fact to tell Tor to "listen to ip:port A, but advertise ip:port B", so there definitely is an advertisement of the relay. A relay works fine with that and the "relay piece of a bridge" (so to say) also works well. But yes, there indeed IS some hassle with the bridge distribution (see also my other post, which still waits moderator approval). Question remains: Is that a known "shortcoming" for pluggable transports, or is there a special way needed to configure this properly? So we seem to have two issues with bridge setup, NAT and binding to specific IP: 1. Not possible to properly advertise/distribute obfs4 external IP, if obfs4 port binding to internal IP. 2. In such cases, bridge distribution does not happen. I have, based an observation from another bridge without NAT, even the impression, that specifying a specific IP instead of 0.0.0.0 or [::] in the ServerTransportListenAddr causes a bridge distribution "none". Maybe a bug? C. On August 5, 2025 at 4:46 AM, George Hartley <hartley_george(a)proton.me> wrote: Is this not the purpose of NoAdvertise? You use that flag if you want a private bridge (for example, to give to your friends). Using both NoAdvertise and NoListen on an OBFS4 bridge behind NAT can make BridgeDB treat your bridge as “no distribution.” Because NoAdvertise strips the bridge descriptor from publication, and NoListen prevents the ORPort from binding on your public interface, BridgeDB can’t see or test your bridge. As a result, it marks its distribution status as “None.” The easiest fix is to forward your ORPort through NAT and remove (or at least temporarily disable) those flags so your bridge descriptor is published and reachable. Once BridgeDB can reach and verify your ORPort, it will resume distributing your bridge normally. If you’d like more control, you can also set a specific BridgeDistribution method (for example, moat) in your torrc. Regards George On Tuesday, August 5th, 2025 at 3:46 AM, Gary C. New via tor-relays <tor-relays(a)lists.torproject.org> wrote: I'm seeing a similar issue with a recently configured OBFS4 bridge using NAT, NoAdvertise, NoListen, and distribution status displaying as "None." On Sunday, August 3, 2025 at 12:36:37 PM MDT, C. Pe. via tor-relays <tor-relays(a)lists.torproject.org> wrote: Is there maybe another issue with rdsys being "stuck" ? I have again a new/renewed bridge in distribution status "None" since some days and https://bridges.torproject.org/status?id=<fingerprint> shows for all bridges the last testing two days ago (According to your below statement, updates should appear latest after 4h) Thanks & regards, C. Am 31.07.2025 um 13:12, meskio via tor-relays <tor-relays(a)lists.torproject.org> schrieb: You can always check if the bridgeline distributed by rdsys is correct by visiting: https://bridges.torproject.org/status?id=<your hashed or not fingerprint> This should display one bullet point per IP/transport, so in your case two, one for IPv6 and another for IPv4. Take into account that it might take up to 4h for this page to be updated when you do changes. -- Sent with https://mailfence.com Secure and private email _______________________________________________ tor-relays mailing list -- tor-relays(a)lists.torproject.org To unsubscribe send an email to tor-relays-leave(a)lists.torproject.org -- Sent with https://mailfence.com Secure and private email -- Sent with https://mailfence.com Secure and private email

2 1

Usefulness of independent Snowflake network?
by Jonah Aragon 27 Jul '25

27 Jul '25

Hi all, I’ve spent some time setting up a standalone Snowflake network this week, mainly for my own practice. Basically what I have is: - A Snowflake broker working with domain fronting on a CDN other than CDN77, and of course Amp Cache. - Two Snowflake bridges, https://metrics.torproject.org/rs.html#search/Triplebit%20transport:snowfla… - A handful of proxies with high-speed/no-NAT connections configured to use this network instead of the default. And everything works perfectly in stable Tor Browser. I was mostly curious about what the performance would look like, and of course it is better since I’m the only one using it :) I was thinking that a potential use could be to have a Snowflake network that has no browser extension proxies or proxies behind NAT, only standalone daemons on high-performance networks from operators willing to contribute. My theory is that there are some people who would benefit from a Snowflake bridge with performance more in line with obfs4 or WebTunnel, which may or may not really be true. What I’m wondering is, do you think this is a concept worth pursuing, or do I just leave it as a weekend experiment? Obviously a big advantage is lost by having fewer proxies compared to the current Snowflake network, which would make it easier to enumerate. I think a big advantage gained as a bridge operator is being able to publish the bridge line publicly and take advantage of domain fronting without actually proxying Tor traffic through a CDN. I can change the IPs of my bridges by swapping out proxies, without bridge users needing to update their bridges in their client, which seems like a win. What I don’t know: - Could this actually provide the same or greater value than just contributing more standalone Snowflake proxies to the public network? - Is this worthwhile compared to simply running WebTunnel bridges? - Is there one other relay association perhaps willing to volunteer to run a bridge on this network, and are there other relay associations or individuals willing and able to contribute only high-performing and standalone proxies to it? Let me know what you think! Best, Jonah

1 0

Re: webtunnel bridges for the telegram distributor
by George Hartley 24 Jul '25

24 Jul '25

Thanks, I agree that obfs4 looks like "random data" so it is relatively easy to block with middle-boxes or deep packet inspection. George On Monday, July 21st, 2025 at 1:19 PM, meskio <meskio(a)torproject.org> wrote: > Quoting George Hartley (2025-07-18 05:32:28) > > > > Russia is extending their Tor block[0]. Currently, they block Fully > > > Encrypted >Protocols like obfs4 on some mobile networks[1]. > > > > Does this also apply to obfs4 bridges with timing and packet-size obfuscation > > enabled on both client and server side (iat-mode=2)? > > > Yes, is not that they are detecting obfs4 as a protocol, but they block anything > that looks like random and they can't recognize. > > > -- > meskio | https://meskio.net/ > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > My contact info: https://meskio.net/crypto.txt > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Nos vamos a Croatan.

1 0

facing out the moat bridge distributor
by meskio 23 Jul '25

23 Jul '25

tl;rd: if you have a bridge configured with "BridgeDistribution moat" remove this config option from torrc so it can be reassigned to another distributor or replace "moat" by "settings". In December we shutted down bridgedb[0] and stopped distributing "moat" bridges. The distributor that the Tor Browser uses automatically "settings"[1]. We hold the existing moat bridges without being distributed as they were still used by people around the world. So censors can't find them and users can still use them without getting blocked. As the usage of those bridges has declined now we decided to redistribute those bridges and automatically assign them either to the "settings" or "telegram"[2]. The only bridges that are not automatically reassigned are the ones with a configuration "BridgeDistribution moat". rdsys will not assign to any distributor bridges that have "BridgeDistribution" assigned to an unexisting distributor. If you run such bridge please remove the BridgeDistribution config line in torrc or change it an existing distributor so your bridge get distributed. If you want to hold your bridge undistributed is better to configure it with "BridgeDistribution none". Thank you. [0] https://blog.torproject.org/making-connections-from-bridgedb-to-rdsys/ [1] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/blob/main/doc/dis… [2] https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/233 -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

webtunnel bridges for the telegram distributor
by meskio 21 Jul '25

21 Jul '25

Hello, Russia is extending their Tor block[0]. Currently, they block Fully Encrypted Protocols like obfs4 on some mobile networks[1]. For a while, WebTunnel has been a good alternative, but since June, Roskomnadzor has enumerated some WebTunnel bridges and blocked them by domain name[2]. Bridge operators can bypass this block by creating a new subdomain or using a new domain for their WebTunnel bridge. We are working on multiple solutions for this problem. And one of them is to start distributing WebTunnel bridges over Telegram[3]. In the past, our Telegram distribution bot has proved to be fairly resistant to the attempts to enumerate bridges made by the Russian censor. But to be able to do that, we first need to have enough bridges assigned to that distributor. We are looking for a minimum of 30 bridges assigned to this distributor. If you are in the capacity to host a WebTunnel bridge, please do so! You can follow the documentation on the Community portal[4] and configure your WebTunnel bridge with this option in your torrc: BridgeDistribution telegram Or if you're using our Docker container, you will need to add the lines below to your .env file: OBFS4_ENABLE_ADDITIONAL_VARIABLES=1 OBFS4V_BridgeDistribution=telegram It is ok if your WebTunnel bridge is on the same IP address of another existing WebTunnel bridge as long as is in a different subdomain name, for example www1.example.com. As the censor is blocking the bridges by domain name and not by IP. Please avoid hosting your bridge with Hetzner, Digital Ocean, OVH and do not use Cloudflare DNS, as there are reports of these are being targeted and blocked by DPI[5]. Thank you. [0]https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/i… [1]https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/i… [2]https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/i… [3]https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/158 [4]https://community.torproject.org/relay/setup/webtunnel/ [5]https://github.com/net4people/bbs/issues/490 -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

5 6

new OBFS4 bridges with bridge distribution method "None" since a couple of days
by C. Pe. 15 Jul '25

15 Jul '25

Dear experts, according to the documentation, a new obfs4 bridge should get a bridge distribution method assigned after running a day. The two bridges listed below are running since more than a week and both still show "none" as bridge distribution method. (Probably due to that, they even don't get up to speed) Attempting to manually set the method in torrc does not change the situation... https://metrics.torproject.org/rs.html#details/76ADDDFD1C70D60BE6F524B111A3… https://metrics.torproject.org/rs.html#details/4FB2FA7B6678169B609B771F240B… Thanks in advance for any advice. C. -- Sent with https://mailfence.com Secure and private email

2 1

Add CGNAT 100.64.0.0/10 to Default Exit Relay Reject Policy
by admin＠likogan.dev 06 Jul '25

06 Jul '25

Hello, I've noticed that the non-publicly routable CGNAT subnet of 100.64.0.0/10 is not in the default exit policy reject list like 192.168/16 and 10/8 are. This range is not publicly routed, and should never need to be accessed from a Tor exit. Tailscale and other ISPs use this block. How many exit relays connected to a Tailscale network are unknowingly exposing all of their other Tailscale devices to the Tor network? ISPs may be less willing to allow exit relays if there are bots using Tor to toy with the ISPs 100.64/10 range. Maybe there is something I am missing for it to not be included? Thanks, Likogan.Dev

1 0

Tor relays on Android / Termux / Orbot
by ajxtaylor＠gmail.com 26 Jun '25

26 Jun '25

I'm trying to run a relay on my old Pixel 5 phone. Does anyone have recommendations or experience with this? It looks like Orbot won't be able to support running relays well since upstream support for it was removed: https://github.com/guardianproject/orbot-android/issues/1319#issuecomment-2… I tried Orbot anyway, and noticed my advertised bandwidth seems to come out to around only 2 MiB/s. I don't know what the limiting factor is: * I have power and ethernet plugged into it and it has nearly 1000 Mbps connection (as tested by my router's speed test, and I have a fiber internet connection). * In developer options I can see I'm using 4.8 / 7.8 GB RAM. * Not sure how to check CPU usage. The phone always feels cold though, so I doubt its using much CPU. * I know Android used to be limited to 1024 connectors / file descriptors, but I believe Pixel 3XL and above have that limit changed to 32768. * Max bandwidth / relay bandwidth are set to 40 MBytes (per second) in the custom torrc setting I'm trying out tor in Termux as an alternative. My one issue with Termux so far is it can't detect its own IPv6 address. The logs show it detects some other IPv6 address that doesn't show up as being assigned to my phone according to my router, and Tor logs say the ORPort isn't reachable on that address. I tried manually adding my phone's IPv6 address (according to my router) into the torrc ORPort config, and that worked, but might stop working once the IP rotates. (And side note, Orbot was able to detect the IPv6 address correctly.) I'm guessing Tor can't auto-detect it because of limitations of Termux. Network config isn't available within Termux unless the phone is rooted, as can be seen by attempting to run `ifconfig` and according to this reddit thread: https://www.reddit.com/r/termux/comments/1arucf7/ipv6_trouble/

1 0

New Tool: Tor Relay Leaderboards, Operator Metrics, & Network Health
by Tor at 1AEO 25 Jun '25

25 Jun '25

Hi All, Wanted to share an update on a new Tor metrics site we've launched: https://1aeo.com/metrics (updates every 30 min!) It builds on Allium (originally from git.jordan.im/allium, now end-of-life) and adds several new features—all powered by Tor Onionoo API (and more soon!) and open source for anyone to use, self-host, or build on. New Features - screenshots and some plain text Tor relay email list friendly versions below: - Operator Leaderboard (by AROI): See the top contributors across bandwidth, consensus weight, relay count, uptime, OS diversity, and geographic spread. Celebrating everybody's contributions! - Enhanced Operator Pages (by AROI): Quickly spot issues and compare operator setups across the Tor network. - Network Health Overview: Across all of Tor, show breakdowns of relay counts, bandwidth, uptime, operator diversity, AS and geo distribution, version compliance, and more. Goals: - Provide operators with new visibility into their relays and network-wide trends - Easily answer common questions without referring back to specifications and many page long text files - Push the boundaries of what “vibe” coding can do We’d love your feedback—especially through GitHub issues for tracking requests, bugs, or incorrect data: https://github.com/1aeo/allium/issues What’s Next: - Add support for consensus health parsing and other Onionoo endpoints (e.g. bandwidth stats) - Incorporate charts/graphs - Improve historical data tracking Hope it’s helpful, and open to suggestions from the community! Credits: Beyond Jordan's great open source work on Allium, many of the top operators have been reviewing and sharing feedback, AROI definition from Nusenu, Onionoo data, and many others! Top 5 Operators by Bandwidth (AROI) Rank Operator Relays Bandwidth Consensus Weight Guard/Mid/Exit Count Countries Platforms ----- -------------------------- ------- --------- ----------------- -------------------- --------- --------- 1 nothingtohide.nl 294 60.4 Gbit/s 6.61% 34 / 8 / 252 1 294 non‑Linux 2 quetzalcoatl‑relays.org 574 57.3 Gbit/s 3.80% 0 / 0 / 574 10 1 3 1aeo.com 566 53.3 Gbit/s 3.44% 293 / 273 / 0 2 1 4 prsv.ch 349 52.5 Gbit/s 4.26% 217 / 57 / 75 20 2 5 artikel10.org 128 30.2 Gbit/s 3.47% 0 / 0 / 128 1 1 Network Heavyweight Rankings Rank Operator Relays Net. Wt. Bandwidth G/M/E Countries---- ------------------------- ------ -------- ------------- --------- ---------- 1 nothingtohide.nl 294 6.55% 60.0 Gbit/s 34/8/252 1 2 prsv.ch 353 4.38% 51.3 Gbit/s 214/52/87 19 3 quetzalcoatl-relays.org 574 4.00% 58.1 Gbit/s 0/0/574 10 4 artikel10.org 128 3.47% 30.3 Gbit/s 0/0/128 1 5 1aeo.com 614 3.27% 54.2 Gbit/s 308/306/0 2 6 tor.r0cket.net 144 2.54% 28.2 Gbit/s 0/24/120 1 7 shadowbrokers.eu 32 2.25% 16.4 Gbit/s 3/0/29 3 8 applied-privacy.net 104 2.14% 21.3 Gbit/s 0/0/104 1 9 for-privacy.net 86 1.83% 20.1 Gbit/s 43/0/43 2 10 relayon.org 112 1.27% 17.5 Gbit/s 41/7/64 2 Exit Authorities Rank Operator Exits Exit % Tot. Auth. Exit BW Countries---- ------------------------- ------ ------- ----------- ------------ ---------- 1 nothingtohide.nl 252 14.44% 6.55% 51.1 Gbit/s 1 2 quetzalcoatl-relays.org 574 10.52% 4.00% 58.1 Gbit/s 10 3 artikel10.org 128 9.13% 3.47% 30.3 Gbit/s 1 4 tor.r0cket.net 120 6.69% 2.54% 26.9 Gbit/s 1 5 shadowbrokers.eu 29 5.71% 2.25% 15.7 Gbit/s 3 6 applied-privacy.net 104 5.64% 2.14% 21.3 Gbit/s 1 7 digitalcourage.de 30 2.95% 1.12% 9.2 Gbit/s 1 8 nos-oignons.net 54 2.78% 1.06% 11.3 Gbit/s 1 9 for-privacy.net 43 2.64% 1.83% 10.8 Gbit/s 2 10 prsv.ch 87 2.07% 4.38% 10.4 Gbit/s 19 Diversity Masters Rank Operator Relays Score Bandwidth Countries Platforms Unique AS---- ------------------------- ------ ------ ------------- ---------- ---------- ---------- 1 tor(a)zgato.ru 81 92.5 6.6 Gbit/s 26 1 39 2 prsv.ch 353 61.0 51.3 Gbit/s 19 2 20 3 Safe-mail 33 51.5 4.2 Gbit/s 16 1 18 4 your@e-mail 22 48.5 1.4 Gbit/s 13 1 21 5 nobody(a)tor.org 23 35.5 1.6 Gbit/s 8 1 18 6 a-n-o-n-y-m-e.net 17 35.5 1.9 Gbit/s 11 1 12 7 peca-relay 20 32.0 1.8 Gbit/s 10 2 9 8 freiraum 14 31.5 769.2 Mbit/s 10 1 10 9 FlashTor 11 31.0 289.5 Mbit/s 9 2 10 10 quetzalcoatl-relays.org 574 30.5 58.1 Gbit/s 10 1 9 Frontier Pioneers (Rare Countries) Rank Operator Rare Bandwidth Countries Specialization---- ------------------------- ----- ------------- ---------- ------------------------------- 1 freiraum 6 769.2 Mbit/s 6 AE, IN... 2 olokerunningtor 5 131.3 Mbit/s 5 AO, KE... 3 tor(a)zgato.ru 5 6.6 Gbit/s 4 EU, GE... 4 cembranutboys.com 3 211.5 Mbit/s 3 BZ, CW, TT 5 prsv.ch 8 51.3 Gbit/s 2 AM, TR 6 osservatorionessuno.org 2 1.2 Gbit/s 2 PT, TR 7 janfuger 2 193.4 Mbit/s 2 MK, TR 8 privacyhaven(a)duck.com 2 345.9 Mbit/s 2 IN, TR 9 email(a)airmail.cc 1 476.3 Mbit/s 1 AM 10 Safe-mail 1 4.2 Gbit/s 1 TR Network Veterans Rank Operator Relays Score Bandwidth Countries Platforms Specialization---- ------------------------------ ------ ------ ------------- ---------- ---------- --------------------- 1 tor(a)insc.de 1 6450 1.7 Mbit/s 1 1 6450 days * 1.0 2 tor-trouble 1 6105 198.7 Mbit/s 1 1 6105 days * 1.0 3 dennis 1 5469 66.8 Mbit/s 1 1 5469 days * 1.0 4 A1F1E776E110F29C 2 4884 51.4 Mbit/s 1 1 4884 days * 1.0 5 Jon Gjengset 1 4489 8.9 Mbit/s 1 1 4489 days * 1.0 6 Ranlvor 1 4248 44.2 Mbit/s 1 1 4248 days * 1.0 7 aholiday(a)yahoo.com 1 4096 931.8 Kbit/s 1 1 4096 days * 1.0 8 insomnia@orwell1984 1 4095 4.4 Mbit/s 1 1 4095 days * 1.0 9 tor(a)theyosh.nl 1 4082 79.7 Mbit/s 1 1 4082 days * 1.0 10 Ry4an Brase 1 4037 8.4 Mbit/s 1 1 4037 days * 1.0 On Monday, May 26th, 2025 at 11:44 PM, Tor at 1AEO via tor-relays <tor-relays(a)lists.torproject.org> wrote: > Couldn't find an updated single reference of Tor relay trackers. > Summarized up the main active trackers, as each varies slightly in data and presentation. > Please take a look and let me know if anything’s missing or needs updating. > > Tracker List: Table pasted below; screenshot attached > Also viewable on our blog (with working links): > https://1aeo.com/blog/navigating-tor-relay-trackers-measure-compare.html > > Our favorite: Allium – super easy to deploy, offers ASN and family-level summaries, and update interval is configurable (ours refreshes every 30 min): > https://1aeo.com/metrics/ > Source: https://git.jordan.im/allium/ > > Thanks for your input, and happy operating! > > > > Name > > Live May '25 > > Bandwidth > > Aggregate By Family or AS > > Top 10 > > Charts & Graphs > > Map/Geo Features > > Update Frequency > > Search & Filter > > Relay Details > > Historical Data > > Source Code > > Source Last Updated > > Tor Relay Search > > Yes > > Yes > > Yes > > Yes > > Yes > > No > > Continuously > > Nickname, Fingerprint, ASN, and more > > Bandwidth stats; Configuration; Uptime; Flags; Exit policy > > Bandwidth stats > > Partial > > 12/20 > > OrNetStats > > Yes > > Yes > > Yes > > Yes > > Yes > > No > > Monthly > > Operator > > Bandwidth, Configuration; Uptime; Flags; Exit policy > > Guard/Exit probability trends > > Partial > > 05/25 > > 0x7c0 Relay Metrics > > Yes > > Yes > > Yes > > Yes > > No > > No > > Hourly > > ASN; Families > > Bandwidth, Configuration; Uptime; Flags; Exit policy > > No > > Yes > > 06/24 > > Onionite > > Yes > > Yes > > No > > Yes > > No > > No > > On-demand > > Relays/Bridges search > > Bandwidth; Configuration; Uptime; Flags; Exit policy > > Bandwidth > > Yes > > 02/23 > > TorStatus > > Yes > > Yes > > No > > Yes > > No > > No > > ~15-minute > > Country; Flags; Contact > > Bandwidth, Configuration; Uptime; Flags; Exit policy > > No > > Yes > > 02/25 > > TorMap > > No > > — > > — > > — > > — > > — > > — > > — > > — > > — > > Yes > > 05/25 > > >

1 0

Request to redact reverse DNS (host name) for my relay
by Tor ITA Relay 24 Jun '25

24 Jun '25

Hello Tor Team, I am running a Tor relay and have noticed that the reverse DNS (host name) of my IP address is publicly shown on metrics.torproject.org. For privacy reasons, I would like to kindly request that the host name be redacted. Relay fingerprint: B8D94C8036FEE5253E32CA3158E916466191C407 Thank you very much for your time and support. Best regards, Gianluca

3 2