2

I host my own irc server, but I would like to serve it using tor hidden service, I already have a tor .onion site using vbox, and it is not the same approach to setup for an irc server, at least it is not working to me.

I read already tons of docs and nothing get to the point, I just need a simple setup and bit by bit I will build a better security, but I need to get it basically functioning.

I have the irc server already set locally and it works fine, but I have no idea how to put this behind tor hidden service.

p.s. I have no hostname and no fixed IP address, but it seems not to be a problem, since I connect using my local IP address. Example: 192.168.1.2:6697

Here is what I have so far in my torrc

#HiddenServiceDir /home/<user>/hidden_service/
#HiddenServicePort 9050 127.0.0.1:9050 # I use as a proxy with firefox sometimmes

HiddenServiceDir /home/<user>/irc_hidden_service/
HiddenServicePort 6667 127.0.0.1:6667
HiddenServicePort 6697 127.0.0.1:6697 # I have SSL (openssl) installed

Some errors:

* Looking up 2lqozw5sy566nuts.onion
* Looking up 192.168.1.2
* Connecting to 192.168.1.2 (192.168.1.2:6697)
SOCKS Read error from server.
 Proxy traversal failed.
* Stopped previous connection attempt (1814)

I use as reference the following docs but I'm looking to something more simple and practical:

[EDIT] I'm using Tor>=2.3.x

6
  • does connecting to the ircd from the localserver work by running, for example openssl s_client -connect 127.0.0.1:6697?
    – cacahuatl
    Aug 1, 2016 at 17:04
  • Yes. works perfectly. I'm using inspircd, first start the daemon and then I'm able to connect to 127.0.0.1:6697 or 192.168.1.2:6697 with any client like BitchX, Hexchat,.. Aug 1, 2016 at 17:09
  • So you're using transparent proxying, right, and 192.168.1.2 isn't your real LAN address? Otherwise that's your problem...
    – cacahuatl
    Aug 1, 2016 at 17:14
  • Okay wait SOCKS Read error from server. says it's not Transparent Proxying, which means something is incredibly broken on your client config....
    – cacahuatl
    Aug 1, 2016 at 17:17
  • Yes, I think so. something is missing or broken! I comment my lines in torrc file, it is not working at all. Aug 1, 2016 at 17:28

1 Answer 1

2

This is unrelated to the onion service, there is a problem with your client configuration. It is not properly using SOCKS5/SOCKS4a's remote hostname functionality.

The problem is that you're resolving the ".onion" address, then connecting to the resolved IP over SOCKS5 (a classic "DNS leak"). Normally this should result in some kind of NXDOMAIN resolve failure but for some reason your DNS is resolving it, I assume it's set it /etc/hosts or something similar.

You should do two things:

First you need to catch the DNS request with Tor, Tor will map the .onion to a "cookie" IP address. To perform resolves over Tor, you'd need to setup a DNS port for Tor. To di this set DNSPort 53 in your torrc and set your /etc/resolv.conf file to contain nameserver 127.0.0.1.

Second you need to set AutomapHostsOnResolve 1 in your clients torrc, this is the option that will translate .onion to a "cookie" IP. Then any requests to connect to the "cookie" IP over SOCKS will be translated back to a connection to the appropriate .onion address.

Or

Alternatively you could use an IRC client that does SOCKS properly from the start. I'm not going to make specific endorsements.

4
  • I set my own DNS, that's why it try to resolve. I'm reading a lot about dns leak and how to prevent it to happen. I followed your instructions and got the same errors, but it help me out to see that this instructions is being used to Tor<2.3.x and I'm using Tor>=2.3.x, then I made a few adjustment and it works now. I follow this doc -> trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/irssi. I will accept your answer because its is right, and i was my bad not telling about my tor version. Aug 3, 2016 at 3:20
  • Out of interest, where did you get a Tor version that old from? Is someone distributing that?
    – cacahuatl
    Aug 3, 2016 at 3:36
  • I'm not sure, but I was running an old Debian (my first setup). But this new setup I did with Ubuntu 16.04. Aug 3, 2016 at 9:41
  • Just a side note. To try to protect from any sort of DNS leak, u can setup a DNS over HTTPS proxy like cloudflared. Of course, the leak must be solved, but this way at least the leak will be unreadable by ISP. Above it you can also setup a local simple nameserver like BIND or dnsmasq, or even something more advanced as pihole.
    – Hikari
    Dec 31, 2020 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .