- tor-relays - lists.torproject.org

Is Tor Actually "Blocked" In Russia, or Are Some Users Unblocked for now?
by Neel Chauhan 06 Dec '21

06 Dec '21

Hi tor-relays@, While I don't live in Russia, nor are my parents from Russia (they're from India), today, I noticed these articles that some people noticed Tor is blocked in Russia (sorry for being late): https://ntc.party/t/ooni-reports-of-tor-blocking-in-certain-isps-since-2021… https://forum.torproject.net/t/tor-blocked-in-russia-how-to-circumvent-cens… Yet, when I look at Tor Relay Status, I noticed many relays hosted on Russian residential ISPs are still online, and only a few aren't: Moscow City Telephone: *https://metrics.torproject.org/rs.html#search/as:AS25513 Rostelecom: * https://metrics.torproject.org/rs.html#search/as:AS12389 * https://metrics.torproject.org/rs.html#search/as:AS42610 * https://metrics.torproject.org/rs.html#search/as:AS34168 Vimpelcom: * https://metrics.torproject.org/rs.html#search/as:AS8371 * https://metrics.torproject.org/rs.html#search/as:AS8402 MTS: * https://metrics.torproject.org/rs.html#search/as:AS60496 I didn't notice a big reduction in "relay" users on Metrics: https://metrics.torproject.org/userstats-relay-country.html?start=2021-09-0… But did see an increase in "bridge" users: https://metrics.torproject.org/userstats-bridge-country.html?start=2021-09-… And most Ooni results still show Tor can connect fine: https://explorer.ooni.org/search?until=2021-12-06&since=2021-11-29&probe_cc… I feel it could be possible it's one of the two: * Most likely, the censorship rollout is in stages. Some users are blocked but other's aren't, where it wasn't rolled out is still unblocked. * Less likely, but Russia found people could use pluggable transports, like HTTPS obfs4 bridges and maybe they found blocking Tor itself is ineffective, or trying to block "meek" users ended up blocking Microsoft and ASP.NET/Azure-based webapps. Disclaimer: I work at Microsoft, but not on Azure as of now. I did however interview for a position in the Azure umbrella (not on the CDN however). -Neel Chauhan

2 1

Re: [tor-relays] tor-relays Digest, Vol 131, Issue 2
by Ali Druno 06 Dec '21

06 Dec '21

Hi! I've also noticed suddenly 3-5x more bridge users using the one I run with a concrete difference in Russian connections highly increased in number of unique users compared as the others countries which are looking stable. (Sorry for my bad English, I hope it was comprehensible enough) Have a nice week! Nils Le lun. 6 déc. 2021 à 13:00, <tor-relays-request(a)lists.torproject.org> a écrit : > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Snowflake's package for FreeBSD available (Vin?cius Zavam) > 2. Is Tor Actually "Blocked" In Russia, or Are Some Users > Unblocked for now? (Neel Chauhan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 5 Dec 2021 19:30:38 +0000 > From: Vin?cius Zavam <egypcio(a)googlemail.com> > To: undisclosed-recipients:; > Subject: [tor-relays] Snowflake's package for FreeBSD available > Message-ID: > < > CA+Kr6DNtCC6-iQ7Et71UyTkqArcB_ruO4CcY8nMUm278BJaeyg(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > ol?! :) > agora temos um pacote para instalar Snowflake em FreeBSD. aproveitem! > > tl;dr; we now have a package to install Snowflake on FreeBSD. enjoy! > > since the 14th of Nov 2021 we have a port that builds a Snowflake package > that can be installed on FreeBSD. it gives us all 3 different > features/functions that we can use Snowflake for: > > - client > - proxy > - server > > don't know Snowflake yet? > > - https://snowflake.torproject.org/ > - https://community.torproject.org/relay/setup/snowflake/ > - > > https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… > > if you are using the "latest" branch of pkg, try it out! the package is > called "snowflake-tor" > > # pkg update -f > # pkg install -U snowflake-tor > > wanna checkout the source of its port? > > - > > https://cgit.freebsd.org/ports/commit/?id=057c0c3c0645c0b237bb2a96dda440e04… > > did you know about the "Run a Bridge" campaign? > > - https://blog.torproject.org/run-a-bridge-campaign/ > > that's it! stay safe and have a great one > obrigado ]=) > > > -- > Vin?cius Zavam > keybase.io/egypcio >

1 0

Snowflake's package for FreeBSD available
by Vinícius Zavam 05 Dec '21

05 Dec '21

olá! :) agora temos um pacote para instalar Snowflake em FreeBSD. aproveitem! tl;dr; we now have a package to install Snowflake on FreeBSD. enjoy! since the 14th of Nov 2021 we have a port that builds a Snowflake package that can be installed on FreeBSD. it gives us all 3 different features/functions that we can use Snowflake for: - client - proxy - server don't know Snowflake yet? - https://snowflake.torproject.org/ - https://community.torproject.org/relay/setup/snowflake/ - https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow… if you are using the "latest" branch of pkg, try it out! the package is called "snowflake-tor" # pkg update -f # pkg install -U snowflake-tor wanna checkout the source of its port? - https://cgit.freebsd.org/ports/commit/?id=057c0c3c0645c0b237bb2a96dda440e04… did you know about the "Run a Bridge" campaign? - https://blog.torproject.org/run-a-bridge-campaign/ that's it! stay safe and have a great one obrigado ]=) -- Vinícius Zavam keybase.io/egypcio

1 0

Recent rejection of relays
by Georg Koppen 02 Dec '21

02 Dec '21

Hello everyone! Some of you might have noticed that there is a visible drop of relays on our consensus-health website.[1] The reason for that is that we kicked roughly 600 non-exit relays out of the network yesterday. In fact, only a small fraction of them had the guard flag, so the vast majority were middle-only relays. We don't have any evidence that these relays were doing any attack, but there are attacks possible which relays could perform from the middle position. Therefore, we decided we'd remove those relays for our users' safety sake. While we were already tracking some of the relays for a while, a big chunk of them was also independently reported by a cypherpunk and nusenu helped analyzing the data. Thanks to both of them from our side. Foe what it is worth: a large part of those relays did not set any valid contact info and/or when we tried to contact some of the relays' operators the emails bounced. However, we sometimes need to have ways to reach relay operators, be it for debugging purposes or for helping them with relay misconfiguration. Thus, please set a valid contact info when running relays. Finally, anyone running relays: try to get connected to the community so we can build some trust among each other. That seems to be an essential part in our long-term strategy to fight bad relays trying to enter our network. Georg [1] https://consensus-health.torproject.org/graphs

10 16

Relays running an unsupported (EOL) Tor version
by Georg Koppen 01 Dec '21

01 Dec '21

Hello! Relays running unsupported Tor versions is a problem we have never really dealt with in a systematic way in the way. Some of you might recall that we (with the help of volunteers) tried back in 2019/2020 to get operators, running an unsupported Tor version, to upgrade[1] but then we dropped the ball. Alas. We just started that process again by contacting every relay operator running an outdated Tor version (any version not 0.3.5.x or 0.4.5.x or 0.4.6.x or 0.4.7.x) by email where possible. Additionally, we created a wiki page outlining the current process and things we still need to figure out.[2] On that page we plan to make statistics related to the EOL relay removal available as well, including the final list of relays we'll reject. Thus, stay tuned. Feedback, as always, is very much welcome! We plan to keep this topic on our radar this time while refining the process as we go. Meanwhile, if you are running a relay with an unsupported Tor version, please upgrade for the sake of our users' safety. If you need help, join us on #tor-relays or #tor-relays:matrix.org if you use Element. Thanks, Georg [1] https://blog.torproject.org/removing-end-life-relays-network [2] https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Relay-EOL-pol…

2 4

Rerouting exit relays detected - EXNODE35037
by nusenu 24 Nov '21

24 Nov '21

BadExit: Rerouting exit relays detected (1) The following exit relays are routing their traffic back into the tor network: nickname: EXNODE35037 First seen: 2021-11-22 15:00:00 Consensus weight: 1 AS: ITL LLC OR IP address: 195.123.220.84 Exit addresses: 185.220.101.138 195.123.220.84 https://atlas.torproject.org/#details/E6FBCC437A708ADC396FDE12ACF7E333BEC02… -- https://nusenu.github.io

2 1

Mystery with Exitnode 4273E6D162ED2717A1CF4207A254004CD3F5307B (176.10.99.200)
by Tschador 23 Nov '21

23 Nov '21

Hi, in the last few days I noticed a curiosity with the Exitnode 4273E6D162ED2717A1CF4207A254004CD3F5307B: Every time I call 'https://www.startpage.com', the URL in the Browser changes to 'http://localhost/'. Other browser: same effect. Other sites - no problem. Other Exitnodes - no problem with 'https://www.startpage.com' and other sites. What's going on there …? Regards

2 2

Massive CPU load on high capacity guard node
by failing.flyaway443＠mailer.me 20 Nov '21

20 Nov '21

Hello Everybody, my relay is now almost two weeks old and has the following flags: Fast, Guard, Running, Stable, V2Dir, Valid. I lost the HSDir flag because I had to restart the Tor process, my downtime was just a few seconds, maybe that's why I kept the Guard flag. I was expecting a drop in traffic when I got the Guard flag (as mentioned in the FAQ), but the opposite happened. At the moment there are around 15000 active connections, over 11000 inbound and just 4000 outbound. I looked at the connections in Nyx, and it seems that my relay is indeed used as a Guard node (most of the IPs are "scrubbed" and the outgoing connections are to middle nodes). Before I got the Guard flag, I had around 5000 connections at the same time and was relaying traffic at peaks of 55MB/s. My server is connected to a Gigabit link. It's not a regular VPS, I have a dedicated CPU with two cores and dedicated 8GB RAM. Traffic is unlimited. The problem is that I'm now relaying traffic at ~25MB/s, and whenever there are spikes of over 30MB/s the CPU load on both cores (!) is very high. I'm still moving ~5TB per day, that's a lot, I know. But there would be even more possible with the internet connection of my server. My Server has two dedicated CPU cores of an AMD EPYC 7702, but unfortunately I only get the base frequency of 2GHz inside the VM, not the boost frequency of 3,35GHz (misleading information on the hoster's website). I could relay way more traffic if there wouldn't be this issue with the CPU load. This is the bottleneck, the 1Gbit link is guaranteed. I read in the FAQ that a modern CPU with hardware acceleration is able to relay traffic @~500Mbit in both directions. The EPYC 7702 supports AES-NI. I checked this, it is activated in my VM. I'm running Debian 11 Bullseye and tweaked the networking capabilities with some instructions I found from torservers.net (mnostly sysctl.conf tweaks) There is no additional software installed that uses lots of ressources, just a few tools. Here is a screenshot of Glances during a traffic peak (I set the Tor process to +10 on purpose): https://i.ibb.co/8brmZkf/glances.png The average CPU load is ~1.50, this is still ok for a dual core, but it should stay below 2.0 (at least it should not go above 2.0 for more than a few minutes). Does anyone here have an idea what I could do? Since the load on both cores is pretty high, I don't think it makes much sense to set up a second relay on the same server. Of course I could throttle the traffic, but is there anything else I can do? I rented this rather expensive server to help the Tor network with a really fast Guard node... Thank you everyone for your time and responses! Have a great weekend! Best Regards, Elias

3 3

relayor v21.2.0-rc is released: prometheus exporter support
by nusenu 19 Nov '21

19 Nov '21

Hi, relayor v21.2.0-rc is released. relayor is an ansible role that helps you with running tor relays with minimal effort (automate everything). https://github.com/nusenu/ansible-relayor#main-benefits-for-a-tor-relay-ope… NOTE: This release contains a backwards incompatible change, if you upgrade from an older release please read the upgrade guide before upgrading. https://github.com/nusenu/ansible-relayor/wiki/Upgrade-Guide-from-version-2… This version of relayor uses MetricsPort (when enabled) via TCP on 127.0.0.1. This is less safe then using unix sockets because all processes on the system get access to tor's prometheus metrics since there is no authentication supported. When MetricsPort gets unix socket support, relayor will switch to that safer option. https://gitlab.torproject.org/tpo/core/tor/-/issues/40192 Changes since relayor v21.1.0: * major new features: * add support for tor's prometheus exporter (MetricsPort) * this is a relayor beta feature requiring tor >=0.4.7.2-alpha) #217 * generates prometheus scrape, nginx reverse and htpasswd config files on the control node for easy copy paste into your prometheus/nginx configuration * every tor instance gets an id label (IPv4_ORPort) * support arbitrary torrc options #192 * fix broken debian tag - reported by @jn9999 #224 * fix broken link - PR by @jn9999 #223 * README: * make clear that we do not remove previously managed tor instances on config change - reported by @tsekityam * update OfflineMasterKeys link * make apt update_cache configurable * drop support for Debian 9 * increase min. ansible version 2.9.23 -> 2.9.27 kind regards, nusenu -- https://nusenu.github.io

1 0

Help Censored Users, Run a Tor Bridge
by gus 18 Nov '21

18 Nov '21

Hi everyone, We're launching a campaign to get more obfs4 bridges and help censored Tor users. The campaign will run from November 17 to January 7, 2022. You can read all the details below, including our special reward kits for participants: https://blog.torproject.org/run-a-bridge-campaign/ Join us and help censored users! Gus -- The Tor Project Community Team Lead

1 0