0

I have been using tor for a long time now. In torrc I specify ExitNodes with a list of IP-addresses of exitnodes.

That always worked, until recently tor started ignoring the ExitNodes directive. It connects via an exitnode that is not in the specified list.

This can easily be verified with some site that shows the clients ip-address, like ipchicken.com

Tor exits via 77.247.181.162, even thought that is specifically excluded with ExcludeNodes.


Apparenty something has changed recently and I cannot figure out what.

I have also tried x.x.x.x/32 and x.x.x.x/24, that does not help either.

THX, stn

This is my torrc:

SafeLogging 0

SocksPort 9330

DataDirectory /tmp/tor-9330.dir

ExitNodes 87.118.115.176,82.199.155.89,84.56.116.163,130.255.72.164,93.104.213.65,81.7.10.68,46.38.237.221,62.141.36.213,87.118.110.158,46.4.76.229,217.235.190.240,62.158.82.89,79.196.250.71,176.9.133.154,188.40.49.86,78.47.201.181,178.202.237.131,89.163.196.221,188.40.166.29,5.45.108.48,5.45.98.111,188.194.248.249,78.47.239.80,85.216.9.254,84.159.93.204,176.28.9.120,91.67.246.119,213.136.69.162,185.15.94.14,78.47.249.226,87.128.102.135,85.214.144.127,85.25.150.216,188.103.124.140,91.5.97.157,144.76.105.169,130.75.178.38,87.181.43.249,84.19.178.79,130.180.72.178,31.18.1.236,88.217.171.225,144.76.50.37,88.80.214.189,46.101.142.174,89.163.134.76,213.239.205.239,188.40.59.80,178.254.26.244,185.34.0.188,78.47.29.68,85.214.117.156,217.79.182.222,37.120.162.196,5.9.158.75,134.130.181.212,78.47.120.150,78.46.37.26,81.7.16.59,95.143.172.147,37.4.233.246,62.141.55.117,46.165.222.29,54.93.177.217,89.163.128.66,84.200.14.206,176.9.138.4,86.56.56.128,134.130.181.49,178.6.29.148,193.200.241.66,141.101.32.104,176.9.90.215,89.22.97.58,78.46.223.134,5.9.7.130,46.101.223.231,5.189.146.133,91.53.99.70,146.52.207.49,148.251.68.100,85.214.108.95,188.40.248.57,134.119.3.2,37.58.57.231,134.3.17.14,176.198.95.105,217.13.197.5,87.79.79.142,85.25.130.154,178.238.230.14,178.254.13.92,217.79.179.177,94.114.193.87,84.200.8.207,217.79.189.243,178.26.128.20,178.254.12.123,31.47.238.152,178.254.36.61,83.141.2.52,88.78.64.16,81.169.222.158,77.23.46.211,46.165.221.166,84.19.176.95,93.180.156.84,46.89.215.167,81.169.130.214,89.163.246.127,178.63.209.51,144.76.100.57,5.189.150.139,62.138.10.60,217.79.178.60,46.182.19.151,141.54.159.184,95.88.91.197,213.136.71.21,88.198.212.3,185.17.144.138,5.199.142.236,178.27.158.194,109.193.253.241,91.59.147.155,193.104.220.54,176.9.75.108,77.23.213.250,46.59.249.65,178.63.19.126,95.88.245.219,176.9.53.52,78.94.97.238,5.9.88.74,91.250.115.185,213.239.217.18,5.9.83.204,37.120.175.187,217.241.116.122,178.63.97.34,87.118.116.227,188.195.15.82,31.185.104.19,46.4.25.214,149.154.159.87,37.209.38.143,5.189.143.28,81.7.11.154,144.76.26.175,144.76.92.176,217.79.179.14,81.173.240.81,185.37.145.44,79.140.41.118,85.25.103.119,85.25.103.69,95.143.172.212,46.237.253.217,136.243.214.137,87.182.214.183,78.47.35.35,178.63.16.48,188.138.125.136,141.22.213.35,89.163.224.212,92.206.221.70,84.56.62.120,88.198.14.171,46.128.114.12,193.164.133.53,82.211.0.180,213.239.212.20,178.162.194.210,82.116.120.3,212.37.176.251,62.176.239.229,37.221.196.31,94.114.172.220,62.113.216.177,213.211.226.13,148.251.214.53,88.198.253.24,93.218.127.189,78.46.249.71,5.199.133.193,178.7.9.163,178.63.116.157,93.104.211.62,91.64.54.129,5.45.100.22,79.193.219.231,176.9.1.211,5.9.159.14,5.189.153.185,78.47.101.157

ExcludeNodes 85.248.227.164,188.226.192.48,51.255.202.66,149.56.229.17,199.87.154.255,37.220.35.202,163.172.21.117,162.213.3.221,93.158.200.242,77.247.181.162

1
  1. There's no guarantee that the IP the Exit listens on is the same IP it sends outbound traffic from, and in some cases it differs.
  2. You need to specify StrictNodes 1 so that Tor will fail to connect rather than use a different node.
  3. Your torrc is, frankly, stupid.

At least some of the relays you've specified (I picked about 5 from the list randomly) don't even have any destinations allowed in their Exit Policy and so can't be exited from.

Stop it. Whatever you think it's achieving, it's only harming you.

  • It may differ in some cases, but not all of them. StictNodes 1 does not change anything. Don't worry about the nodes, that ist just a random list of tor-nodes. The question still is: why does tor not use the ExitNodes and ExcludeNodes ? – stn Oct 22 '16 at 14:42
  • I can't reproduce this, if I copy that config, with StrictNodes 1 added, it works as expected. – cacahuatl Oct 22 '16 at 16:09
  • Yes, the change was with torsocks, not tor. See my other comment in this thread. Thank you for your help. – stn Oct 22 '16 at 16:44
-1

It's technically impossible for this to work even on old version of Tor: now you must use StrictNodes 1, before some time this was StrictExitNodes 1. Without one of these directives ExitNodes were not restricted at all.

  • Thank you for the hint. I have added StrictNodes 1 , unfortunately that did not change anything. Tor still exits via an IP that is explicitly named in ExcludeNodes. – stn Oct 22 '16 at 14:37
  • Also I have tested a list of 5 random ExitNodes, then another list of 5 different random ExitNodes. In both cases tor exits via the same IP, in both cases that IP is not among the ExitNodes. – stn Oct 22 '16 at 14:57
  • try to put not IP's but hashes of the nodes, it will be more correct. you can get hashes for your nodes in a list at Atlas, for example – Alexey Vesnin Oct 22 '16 at 14:59
  • OK, found it. Something had indeed changed, as I thought. But it was not tor, it was torsocks. With the update from ubuntu 14.04 LTS to 16.04 LTS the syntax of torsocks.conf had changed. In the previous version the port was specified with the line 'server_port = xxxx' ,now it is 'TorPort xxxx'. Everything is back to normal. Thank you for your help. – stn Oct 22 '16 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.