3

Can I pick and choose what sites a user can access via my exit node? For instance I might be very pro-facebook, but I probably have no interest in helping to conceal the identity of people downloading child-porn or engaging in other things I might find morally objectionable.

For instance, could I advertise that if you want facebook or news sites, you can use my exit node, but all other traffic is restricted?

4 Answers 4

4

Yes and no.

Can I pick and choose what sites a user can access via my exit node? For instance I might be very pro-facebook, but I probably have no interest in helping to conceal the identity of people downloading child-porn or engaging in other things I might find morally objectionable.

The point of Tor is to make everyone anonymous online; unfortunately, that means masking the bad guys as well as the good. If you setup a firewall infront of your exit to block websites, you will most likely receive the "bad exit" flag and no one will use your node.

However, if you setup a firewall, block all sites but the ones you want, and then configure your exit policy properly (eg allow facebook IP's, then reject *:*) you will not receive the bad exit flag. The problem with this is that compiling a list of all IP's used by a given service (eg. Facebook) can be rather tricky. There's no guarantee that their gateways won't change and you'll need to take some measure to ensure that your exit policy and firewall rules remain valid.

An example exit policy (for Facebook and Google) can be found below:

ExitPolicy accept 173.252.110.27:80
ExitPolicy accept 173.252.110.27:443
ExitPolicy accept 74.125.0.0/16
ExitPolicy reject *:*
0

You can go in different directions when it comes to blocking the access to different sites.

  1. As Sam wrote in his answer you can set a special ExitPolicy in your torrc. This allows other Tor clients to use your relay as exit and reach those sites.
  2. Use some filtering tool to block the access to certain sites or
  3. modify the content of some sites

The last two are considered bad practise. As soon as someone notices that you are doing this your relay will receive the BadExit flag. Now your relay can't be used for exit traffic (or Tor traffic in general) anymore.

So the recommended way is 1. (setting ExitPolicy).

0

About advertising: yes, of course you can.

About technically doing it: You should not restrict sites in Tor itself (but you can do so with ExitPolicy), but you can set up a different layer restricting the access from your computer to these sites. It will get restricted for your Tor exit node as well.

2
  • so Tor will notice that I'm not blocking everything, just everything but facebook? and my my exit node will still remain valid?
    – TruthOf42
    Feb 13, 2014 at 14:05
  • 1
    Your exit node will likely receive the "bad exit" flag for blocking like this; you can still use bad exits with a bit of configuration, but most people (read, "everybody") won't.
    – user5
    Feb 13, 2014 at 14:18
0

If you block sites in any way except using ExitPolicy, e.g. through firewall rules, a transparent proxy, broken DNS or something else, then you're liable to get the BadExit flag, then nobody will use your exit node. This is counter-productive, so be careful not to do it.

Some exit node admins don't deliberately block any sites themselves, but their upstream providers do some of these things, and get the BadExit flag that way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .