Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
I'm running a web server behind TOR which should only be reachable by an .onion address I've set up.
But sometimes I'm worried that the public IP of the server can get leaked somehow. Is the webserver also accessible by the IP if someone can get access to that information?
No, correctly-configured Tor hidden services are not accessible by direct IP connection. When setting up a hidden service, you set up your web server to only listen to traffic from the local machine, which will come from the Tor client:
You need to configure your web server so it doesn't give away any information about you, your computer, or your location. Be sure to bind the web server only to localhost (if people could get to it directly, they could confirm that your computer is the one offering the hidden service).
You then point your Tor configuration file to your local IP address and the port on which your server is running (which doesn't have to be the same as the port that appears to clients).
Communication between clients and hidden services is always done through two circuits to a rendezvous point, never directly over the normal Internet.
The difference between .onion URLs and normal URLs, is that the normal URL is simply a "human readable pointer" points to a network location... on the other hand, a .onion URL is actually the only address you should be accessing it from. The secure part about Tor is that it masks the server IPs as well.
A government or "knowledgable individual" can tell things from the IP and submask like your ISP (and depending on your ISP's usage, potentially an area) via the subnets they provide you, and so Tor would obviously like to hide that from the person. The .onion address they provide you is part of Tor's protocol going into their network.
A Tor "url" is merely a generated sequence of characters they assign you based on your public key.
As a webserver host, the incoming packets should show whether they were direct IP connections or Tor-routed connections. You can probably block the direct IP connections to avoid some sort of detection.
Yes, if it is improperly set up. This article states that the FBI was able to access an onion website via direct IP address. From the article...
Due to a misconfiguration of the server hosting the TARGET WEBSITE [Playpen], the TARGET WEBSITE was available for access on the regular Internet to users who knew the true IP address of the server
“Basically, Playpen must have set their [child pornography] site to [a] default [web server setting], meaning if you typed in the IP address you could see the Playpen site,” Thomas White, a UK-based activist and technologist, explained in an encrypted chat. “Whereas if they set another default like ‘server not found,’ then you could only access Playpen by typing the correct .onion address.” This means that law enforcement could verify that an IP address belonged to a specific site.
An FBI Agent, acting in an undercover capacity, accessed IP address 192.198.81.106 on the regular Internet and resolved to TARGET WEBSITE,” the document continues. That address pointed to a server in North Carolina, hosted by a company called CentriLogic.
The FBI was tipped off about Playpen’s IP address by a foreign law enforcement agency, as noted in other, redacted versions of the warrant. This recently unsealed version includes detail on how that IP address was left exposed.
It is not clear how the foreign law enforcement agency discovered Playpen's real IP address in the first place. But the main administrator of the site, who the FBI suspects is Steven Chase from Florida, was clearly aware of the problem and actively trying to fix it, according to the search warrant application.
The concern you're rising here is "will it be able to detect a clearnet address of a darknet server" - so it's must be protected by firewall. And the most effective technique here is to separate the service in a VM/LXC and make it not routed to the clearnet or run a service under a specific username and prohibit any clearnet activites for this username. It's done via firewall - both ways
