3
    HiddenServiceDir /var/lib/tor/hidden_service/site
    HiddenServicePort 80 tor.stackexchange.com

or

    HiddenServiceDir /var/lib/tor/hidden_service/site
    HiddenServicePort 80 151.101.129.69:80

I just tried the above configurations, neither worked, as expected. Is it possible to point an onion server to a site NOT being hosted locally?

|improve this question|||||
  • When I try to access the IP in the browser, I get a fastly error for unknown domain. Have you tried other websites? – SuperSluether Sep 17 '16 at 1:34
2

Technically, NO - in the abstract common case. In 80%+ cases setting up a Nginx reverse proxy will do the trick, but sites can be complicated, and they can use a wide set of subdomains and/or other domains. That's where the "NO" comes from: if you're not the site's maintainer, you can not "map them all". You either need to use a HTTPS CONNECT or SOCKS proxy on your hidden service - to catch All the requests that are started by visiting a website, but actually Tor has a SOCKS proxy built-in already, so you will be reinventing the wheel.

Speaking specifically about Tor.SE - I hope that SE community will run a gateway themselves, it's very actual nowdays

|improve this answer|||||
  • How about handling HTTPS sites? I'd love to be able to host a .onion hidden serivce, that forwards a HTTPS site. – seanlano Oct 24 '17 at 6:31
  • @seanlano do you run the site you're about to forward, or no? in other words - do you have it's ssl keys? – Alexey Vesnin♦ Oct 24 '17 at 17:24
  • No, I don't operate it - I just want to forward to it. I had a go using nginx as a reverse proxy, and it seems to work OK - but I'm not sure how to double-check nginx is actually using HTTPS (I realise the part over tor is not HTTPS because I won't have a certificate for it, so I have to trust my own tor node is not spying on me) – seanlano Oct 25 '17 at 2:44
  • well, you can generate the SSL certificates for your dot-onion address, but - unless something like emcSSL is used - the self-signed certificate will be looking "red lock" in a client browser, not green. The tor part is multy-encrypted twice: once from your hidden service to rendezvouz point and twice from the rendezvouz point to the client. NGinx works fine for using HTTPS when it's acting like a reverse proxy – Alexey Vesnin♦ Oct 25 '17 at 2:49
  • 1
    to triple-check it - use tcpdump and filter out the IP's of your remote HTTPS website you're tunneling - it should show you the https requests. Also attach your NGinx config to your question - I'll check it, and also it will add a great value to the public knowledge base, so if anyone will be looking for solution - he will have the config's posted – Alexey Vesnin♦ Oct 25 '17 at 3:11
1

You'll need a web server locally to either redirect to the external site, or set up a reverse proxy. Google 'nginx reverse proxy' and you should get the idea.

|improve this answer|||||
1

For reference, I did just this and forwarded a Hidden Service to my e-mail provider gateway.

This is running on an Ubuntu 16.04 server, but should work with really anything with nginx and tor on it.

Configuration is pretty easy, I've just got the defaults in the /etc/nginx/nginx.conf file. Then in a new file /etc/nginx/sites-enabled/mail-reverse.conf I've got: 

server {
    listen 8880;
    location / {
        proxy_pass https://webmail.emailsrvr.com/;
    }
}

Finally, in /etc/tor/torrc I've got this added: 

HiddenServiceDir /var/lib/tor/mail
HiddenServicePort 80 127.0.0.1:8880

Now I can connect to the hostname in /var/lib/tor/mail/hostname through Tor Browser and I get my webmail service - and as far as the provider sees, I only ever connect from my home IP address (which is where the hidden service is hosted).

Note that it's not perfect - in Tor Browser, I can see most of the requests got to the .onion site, but there are still a lot of other requests to the "normal" domains that make the site work (i.e. static resources like images and styles). I guess in this case, the page was able to work with just this simple config - I'm sure there would be more complex sites that might not work.

|improve this answer|||||
  • I'm also looking at how I would configure nginx to reverse proxy the IMAP and SMTP traffic, so I can use Thunderbird over the hidden service as well. I just need to make sure I correctly handle using IMAP over TLS from nginx to the provider, but then remove the TLS over tor from Thunderbird to nginx. – seanlano Oct 25 '17 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.