- tor-relays - lists.torproject.org

relay not receiving very much traffic
by Markus Klock 19 May '14

19 May '14

Hello!I deployed a new tor-relay about 2 months ago. It runs on a server with 2 Quad-cores, 8GB RAM and 1Gbit connection.However, I have still not received very much traffic to it, it almost never goes above 10Mbit.This is the server traffic the last 2 months:http://best-practice.se/dump/tor-ralay.PNG Is this normal or may I have configured something wrong?Last time I had a relay running I received 100Mbit+ traffic... Markus

5 11

Advertised Bandwidth
by Spencer Neitzke 19 May '14

19 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, My advertised bandwidth is much slower than what it should actually be. I am running on a network that easily achieves 2gbps, although atlas is reporting 4.15mb/s. Have I misconfigured something? Nickname - ServerX5690 -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v0.5.1 Comment: http://openpgpjs.org wsBcBAEBCAAQBQJTeZXmCRAgZfyIs5JzlAAABhkH/0GeOwtqo1sE5aT7jQVT taaOKZmJiIgDfBA0KQZdq8WLAkT2V61wiOHcWf6PXIouvY/Tt3n+aWs85v4n cs5Rahj83MYZArKIm9wQ34hEkYu6Fku9HVIVZBWpPcFC6aZgKDk9xgKo4qO1 +OjxsoE8liY0WYVr9BabWKsN3+kiwWDQUk/Et48xPk6YyFJLj0Bjqa951SQf J7lTjitrfxYqPn6GHiz9njhO/szHOP24aLJR5jIagBbGJzlxeQ686C4ptDVM DuZjeTqmN6ZmVWZv5M44FdJknfUigRnUerWVBjfrVuHGU5pnSVf6owSduOX4 U+kK3PlbOrk+0zfQiyJBeuU= =A0nS -----END PGP SIGNATURE-----

3 4

Re: [tor-relays] relay not receiving very much traffic
by Markus Klock 19 May '14

19 May '14

Well, I *am* the network admin :) This server is directly connected to our backbone and is not being throttled in any way. AS1653 is our upstream and they like the Tor-project, no throttles there either :) How often does tor/atlas mesure bandwith? /Markus ________________________________ Från: zwiebel(a)quantentunnel.de<mailto:zwiebel@quantentunnel.de> Skickat: ‎2014-‎05-‎18 23:11 Till: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Ämne: Re: [tor-relays] relay not receiving very much traffic _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Re: [tor-relays] relay not receiving very much traffic
by Markus Klock 18 May '14

18 May '14

Yeah, I have no problem pushing 850Mbit and more via iperf and wget from speedtest-servers. /Markus ________________________________ Från: zwiebel(a)quantentunnel.de<mailto:zwiebel@quantentunnel.de> Skickat: ‎2014-‎05-‎18 22:11 Till: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Ämne: Re: [tor-relays] relay not receiving very much traffic _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

One server, Two open tor connections
by Kurt Besig 18 May '14

18 May '14

Hi all, I'm currently running a Linux relay on one LAN machine. I recently set-up a dual boot win7/Ubuntu 14.04 LTS machine, also on the LAN. For now I'd just like to browse the tor network on the second machine and not run a relay on it for the present. I'm concerned my ISP might give me problems if my bandwidth gets too crazy. So, other than editing my /etc/tor/torrc to open a control port and forwarding the control port, is there anything else required to simply browse tor? When I installed tor on the second machine's Ubuntu install I added the tor repositories to my sources.list and updated, upgraded, and installed tor though apt-get.

3 2

DigitalOcean starting Exit node crackdown
by Shawn Nock 15 May '14

15 May '14

Hello friends, As I recall, there are several exits running on DigitalOcean's infrastructure. This is presented FYI: Background: I've run an exit on DigitalOcean for about a year without issues (lost track of uptime duing heartbleed key regen). It wasn't hidden (the droplet name was 'tor-exit') and it had valid reverse DNS and the standard informational page was hosted there. At the time of droplet creation, tor exits were not prohibited by their ToS. I've mentioned to DigitalOcean staff during support tickets that it was a Tor exit. Today the exit was shutdown, the message received was this: >Hello > >We do see that you are running an exit node for the TOR network. > >Unfortunately we are unable to resume services to this droplet and ask >you that you please not run any other TOR exit nodes. > >Please get back to us as soon as possible so we can resolve this. > >Thanks >Support I sent the following response: >Hello, > >My droplet has been running for months (perhaps a year) with no >significant incidents. It is well managed, allows only a strict subset >of traffic to exit and the very few complaints that have been lodged >have been dealt with quickly and professionally (as said by your >support team). The droplet has been configured to limit the rate of >traffic below the droplet's monthly network transfer quota. > >It's well established that under US law ISPs are excluded from >liability under the safe-harbour provisions of the DCMA for any >copyright infringing traffic. More generally, the probability under US >law that an ISP would be held liable carrying user-generated traffic is >extremely low. Tor exits have been operated by Universities, Churches, >and corporations (large and small) for slightly more that 10 >years. During this time not a single criminal or civil complaint has >been brought against an operator's ISP (to my knowledge). > >While it is surely your right to operate your business in the manner of >your choosing; I politely request an explanation for your apparent >policy against Tor exit nodes. If there is some way I might change the >parameters of the exit to suit a policy against specific traffic (to >certain IP blocks, port ranges); I'd surely comply. > >Finally, in this time where repressive regimes are cracking down on >Internet traffic and persecuting their countrymen and where free access >to the internet is nearing the stature of 'human right': if your policy >is indeed a general one against all Tor exits, I urge you to reconsider >your policy. It would be a great service to tens-of-thousands of Tor >users (refugees, political activists, religious minority, abused >spouses, law enforcement, &c) to revise your policy to allow >well-maintained exits to remain on your network. > >I appreciate any attention you could give to this serious matter. -- nock(a)aphr.asia (OpenPGP: 0x6FDA11EE 3BC412E3)

5 7

Malicious or crappily configured exit node
by u 15 May '14

15 May '14

Hello! referring to https://trac.torproject.org/projects/tor/wiki/doc/badRelays, i sent this also to tor-assistances@tpo. Never got an answer though :( Now and then, I use Icedove with TorBirdy under Debian. While connecting to port 465 on my usual mailserver, using SSL, I sometimes get an SSL certificate alert. The certificate presented is not my usual certificate at all (which works without adding an exception), but one for cab.cabinethardwareparts.com, pretending to be my mailserver. [1] I've searched a bit for information on that exit node and found: http://torstatus.rueckgr.at/router_detail.php?FP=0cc9b8aa649881c39e948e70b6… This node has flags: fast, stable, guard... I tried it several times and the behaviour was repeatedly the same. Last time it happened was 10 days ago. Then again today. I'm not quite sure where to report this (that is how this e-mail ends up on tor-relays :) ), nor how to avoid this exit node. Is there a way to do that? Thanks, u. [1] http://pix.toile-libre.org/upload/original/1399232278.png screenshot of the certificate

5 6

Re: [tor-relays] How to handle an abuse report
by tor＠t-3.net 15 May '14

15 May '14

Does the user appear to be bypassing attempts to block/ban him from the site/chat in question? If not, depending upon what you are looking at, one possible response is along the lines of: This is 2-way participation in an internet chat forum by 2 users who are at odds with one another. The quoted content may be ugly, but it does not appear to qualify as site or network abuse. Ch'Gans wrote: >Everything went well so far, until today. Someone, let's call this >person/group "A", reported an abuse to Hetzner. A TOR User, "B", is >spamming chat/forums with vociferous insults and disrespectful messages, >I got a copy of few of them and the insults from B are as bad as the >ideas defended by A, but I'm not here to judge anyone...

1 0

Fwd: [tor-talk] Fwd: Ops request: Deploy OpenVPN terminators
by grarpamp 15 May '14

15 May '14

to list, not me. ---------- Forwarded message ---------- From: Mirimir <mirimir(a)riseup.net> Date: Wed, May 14, 2014 at 11:58 PM Subject: Re: [tor-talk] Fwd: [tor-relays] Ops request: Deploy OpenVPN terminators On 05/14/2014 09:07 PM, grarpamp wrote: >> On Tue, May 13, 2014 at 5:48 PM, Jeroen Massar <jeroen(a)massar.ch> wrote: <SNIP> >> <user - ovpn - torcli> -- <exit torrelay or_ip - localhost - ovpn_ip> -- world > >> That "ovpn" part on the left is easily detected by any party in the >> middle doing > > No. Understand the diagram. It is not detectable by anyone > between torcli and torrelay, because that is just normal > tor. > >> Note that you are running IP over TCP over Tor (which is over TCP). > > Of course. Unless of course, as suggested before, some operators > choose the method of binding/routing their exit over an ip different > from their OR_IP, then it would just be native tor and native TCP. > >> The performance of that will be very bad. Tor network is already >> overloaded enough as it is. > > No it won't, I've tested it, it works just fine. The only issue is the > exit ip may change. So the exit operator is expected to block > access to ovpn_ip from anything other than their associated or_ip, > and the user is expected to config their client to use only the > associated exit per whatever 'world' usage session they have in > mind. It's not supposed to be point-click easy, only possible. That's a very cool idea :) Using $5/mo VPS, there could be a large pool of exit IPs for each Tor exit. <SNIP> ----------

1 0

Thinking about deploying a new node
by Lance Hathaway 15 May '14

15 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 So, every now and then, somebody asks what the best use of a node would be--bridge, relay, or exit. And yes, this is one of those requests. This would be a VPS from VPS Nodes. I checked the list of good and bad ISPs, and they don't seem to be listed. So I asked them directly how they felt about Tor, and this was the response: "While we don't specifically disallow Tor by name, it does come under the ToS as it is commonly used to launch large scale DDOS and SPAM campaigns and is therefore not allowed on our network for that reason. rDNS is provided as standard, you need to have a valid FQDN A record associated with the IP address that is assigned to your container. As far as SWIP, I would have to pass the request on to management as they are the only ones with that access." Seems pretty clear to me that they're not in favor of having an exit on their network. (I brought up the reduced exit policy and asked specifically about SWIP so that I could handle most of whatever abuse complaints come in, but they wouldn't provide anything further than this response.) That leaves bridge or standard relay. My question is, given 3TB of monthly bandwidth and a 100Mbps (shared) uplink, would it be better to run as an entry/middle node, or as an obfs3/scramblesuit bridge? (If there are other suggestions for trying to talk VPS Nodes into allowing an exit node, I'm all ears--though it may be better left with somebody with more experience talking to ISPs.) Thanks in advance, -Lance -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBCgAGBQJTdCUCAAoJEECmBqfoBgXnV2EQAKcP+K+b698oExGXuI3C5FLh YOGU6z1XQy6C/ERkcNxqTfSbqF/5Izm1ey+1qzr41keVUQ1CKkPgGWbgz/plnCbu ZJf3riJrYucg27RHCSioz3ZBt8NV7d8msRrJAVsUoZy90MyghxYTXH6faGBrLNdw tUnhT9IhSp2C46/JBlPa02FM3Aa4JXggnuhxmUNzpCsNun12D+U3AXefStOjo2GC a9CnXFxxmvHURm7CRlXm7VDMyXZYtWWvBny3ndXhAwdp1EXJ67cjcxdml7PNRYqD 6OOWbfc70i6f8f5YhFFvcsLBlxBaTFTLBWz3J7SQPbVk6W8x8Av3rSvfky7wGyW7 qdbB1UI2FvsIVVCzr8e5bZxjxxUIABMm3Dpg5P+d0y7m7Gts9QhfLtgDMDZHwTYO bbsaDjJO7hUlFFd029PPW6PkH1dSD6pIjkE78ZAX57+5ZBk6JeMhOl8uWeqvbkbz KlOJJ34w0dVLCYiSF+q/BT2tlRMYVjUnQpbWHoxIZNcqBF4bzHdh0O5p/Fg0LSwD GFMOeRpMIDe6oJhU9xo/rdEVjIUGA9rRCBalT2N9fD3XhMQRGm4z/4e41A+YOE61 00BqybYG3Cof87QGqvZEv7zg8w0iU1n2LT52MvpfnQC15QoDvq8GA8C4wAoNpdQv Te15KnmiIweVAXjZBzZ1 =PeIP -----END PGP SIGNATURE-----

2 1