IRC Server behind a tor hidden service?

Question

I host my own irc server, but I would like to serve it using tor hidden service, I already have a tor .onion site using vbox, and it is not the same approach to setup for an irc server, at least it is not working to me.

I read already tons of docs and nothing get to the point, I just need a simple setup and bit by bit I will build a better security, but I need to get it basically functioning.

I have the irc server already set locally and it works fine, but I have no idea how to put this behind tor hidden service.

p.s. I have no hostname and no fixed IP address, but it seems not to be a problem, since I connect using my local IP address. Example: 192.168.1.2:6697

Here is what I have so far in my torrc

#HiddenServiceDir /home/<user>/hidden_service/
#HiddenServicePort 9050 127.0.0.1:9050 # I use as a proxy with firefox sometimmes

HiddenServiceDir /home/<user>/irc_hidden_service/
HiddenServicePort 6667 127.0.0.1:6667
HiddenServicePort 6697 127.0.0.1:6697 # I have SSL (openssl) installed

Some errors:

* Looking up 2lqozw5sy566nuts.onion
* Looking up 192.168.1.2
* Connecting to 192.168.1.2 (192.168.1.2:6697)
SOCKS Read error from server.
 Proxy traversal failed.
* Stopped previous connection attempt (1814)

I use as reference the following docs but I'm looking to something more simple and practical:

• https://www.torproject.org/docs/tor-hidden-service.html.en
• https://www.torproject.org/docs/faq.html.en#CellSize
• http://freehaven.net/anonbib/topic.html#Tor_20Performance (lots of reading)

[EDIT] I'm using Tor>=2.3.x

Answer 1

This is unrelated to the onion service, there is a problem with your client configuration. It is not properly using SOCKS5/SOCKS4a's remote hostname functionality.

The problem is that you're resolving the ".onion" address, then connecting to the resolved IP over SOCKS5 (a classic "DNS leak"). Normally this should result in some kind of NXDOMAIN resolve failure but for some reason your DNS is resolving it, I assume it's set it /etc/hosts or something similar.

You should do two things:

First you need to catch the DNS request with Tor, Tor will map the .onion to a "cookie" IP address. To perform resolves over Tor, you'd need to setup a DNS port for Tor. To di this set DNSPort 53 in your torrc and set your /etc/resolv.conf file to contain nameserver 127.0.0.1.

Second you need to set AutomapHostsOnResolve 1 in your clients torrc, this is the option that will translate .onion to a "cookie" IP. Then any requests to connect to the "cookie" IP over SOCKS will be translated back to a connection to the appropriate .onion address.

Or

Alternatively you could use an IRC client that does SOCKS properly from the start. I'm not going to make specific endorsements.