Tor connects to private obfs4 bridge, but torbrowser fails

I setup a private bridge (Tor and tested it with Tor Browser (6.0.2) successfully.

When I enabled obsf4 (0.0.3) in the bridge, Tor Browser (both 6.0.2 and 6.5a1) fails connecting with a "general SOCKS server failure":

13/07/2016 15:07:46.200 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
13/07/2016 15:07:46.200 [NOTICE] Opening Socks listener on 
13/07/2016 15:07:47.500 [NOTICE] Bootstrapped 5%: Connecting to directory server 
13/07/2016 15:07:47.500 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 
13/07/2016 15:07:47.500 [WARN] Proxy Client: unable to connect to x.x.x.x:443 ("general SOCKS server failure") 
13/07/2016 15:07:54.800 [NOTICE] Closing no-longer-configured Socks listener on 
13/07/2016 15:07:54.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
13/07/2016 15:07:54.800 [NOTICE] Closing old Socks listener on 

However, Tor connects well to the bridge via command line:

~# tor usebridges 1 bridge "obfs4 x.x.x.x:443 BRIDGEFINGERPRINT"
Jul 13 12:15:30.697 [notice] Tor v0.2.7.6 (git-605ae665009853bd) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.2h and Zlib 1.2.8.
Jul 13 12:15:32.000 [notice] Bootstrapped 20%: Asking for networkstatus consensus
Jul 13 12:15:32.000 [notice] new bridge descriptor 'name' (fresh): $BRIDGEFINGERPRINT~name at x.x.x.x
Jul 13 12:15:34.000 [notice] Bootstrapped 100%: Done
Jul 13 13:15:33.000 [notice] new bridge descriptor 'name' (fresh): $BRIDGEFINGERPRINT~name at x.x.x.x
Jul 13 14:15:34.000 [notice] new bridge descriptor 'name' (fresh): $BRIDGEFINGERPRINT~name at x.x.x.x

Moreover, when I configure torbrowser to connect to obfs4 bridges configured automatically, it works.

This is my bridge torrc:

ORPort 443
Address x.x.x.x
Nickname name
BridgeRelay 1
PublishServerDescriptor 0
SocksPort 0
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed
ExtORPort auto

I followed the official documentation in setting up the bridge. update: The official obfs4proxy setup doc has moved to the wiki

  • Please delete obfs2 in the ServerTransportPlugin above. obfs4proxy does not support it and it may be the root of your problem. – Jens Kubieziel Jul 14 '16 at 20:41

You can edit your ClientTransportPlugin or ServerTransportPlugin for obfs4proxy to include a -logLevel followed by one of ERROR,WARN,INFO, or DEBUG, an -enableLogging=true flag to enable logging, and a further -unsafeLogging=true flag which removed the address scrubbing. For example:

ClientTransportPlugin obfs3,obfs4,scramblesuit exec /usr/local/bin/obfs4proxy -enableLogging=true -logLevel INFO managed
Bridge obfs4 IP:Port Fingerprint Cert
UseBridges 1

This will log to a file located at $TOR_PT_STATE_LOCATION/obfs4proxy.log, which by default would be pt_state/obfs4proxy.log under your DataDirectory.

See: obfs4proxy/main.go:315

  • In the client, what file should I edit? Adding theClientTransportPlugin options at the end of the obfs4 line in tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults makes Tor Browser crash (graciously). Same editing tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc – blau Jul 14 '16 at 7:26
  • Added an example config that works for me, you should be editing the torrc-default existing ClientTransportPlugin line such that those options get added to the arguments passed to obfs4proxy – cacahuatl Jul 14 '16 at 19:53
  • @canonizingironize I deleted the obfs2 entry in your posting. obfs4proxy does not support it and it's also not safe to use. – Jens Kubieziel Jul 14 '16 at 20:40
  • ACK, Jens. That line is copied verbatim (except for the path to obfs4proxy) from the Tor Browser torrc-defaults, would it be worth making a ticket to remove it from Tor Browser too if it's not safe? – cacahuatl Jul 14 '16 at 22:09
  • Thank you C.I. and Jens. Logging obfs4proxy on Tor Browser showed that the connection was reset by the server. Logging on the server I found out my error: the PORT in the bridge line that you use with the client is the obfs4 port and not the Tor node port. BTW, -logLevel DEBUG blocks obfs4proxy from starting. I also corrected the docs link in my original question, as it was moved. Thanks! – blau Jul 15 '16 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.