How to make Tor relay's ORPort reachable?

Question

I have Tor expert bundle v0.2.8.7. I'm trying to configure a relay under Windows 7. After a day of work the relay is still not reachable:

Nov 13 20:08:14.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

I've checked Windows firewall, all connections are allowed. Port 9001 on my router is also opened. I've checked that I'm correctly opening port on my router using utorrent. I've opened port 43634 for it, and it works.

The thing is that when I'm trying to check if port is opened with any online checker, checker says that utorrent port 43634 is "open", and tor port 9001 is "closed", even when Tor is running.

But still Tor works as proxy, and connecting to tor network.

Nov 12 23:07:13.000 [notice] Tor 0.2.8.7 (git-263088633a63982a) opening log file.
Nov 12 23:07:13.148 [notice] Tor v0.2.8.7 (git-263088633a63982a) running on Windows 7 with Libevent 2.0.22-stable, OpenSSL 1.0.1t and Zlib 1.2.8.
Nov 12 23:07:13.152 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Nov 12 23:07:13.165 [notice] Read configuration file "D:\PROGRAMS\tor\Tor\torrc".
Nov 12 23:07:13.174 [notice] Opening Socks listener on 127.0.0.1:9050
Nov 12 23:07:13.174 [notice] Opening Control listener on 127.0.0.1:9051
Nov 12 23:07:13.174 [notice] Opening OR listener on 0.0.0.0:9001
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv4 file D:\PROGRAMS\tor\Data\Tor\geoip.
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv6 file D:\PROGRAMS\tor\Data\Tor\geoip6.
Nov 12 23:07:13.000 [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now.
Nov 12 23:07:13.000 [notice] Your Tor server's identity key fingerprint is 'ididntedittheconfig xxx'
Nov 12 23:07:13.000 [notice] Bootstrapped 0%: Starting
Nov 12 23:07:14.000 [warn] Please upgrade! This version of Tor (0.2.8.7) is not recommended, according to the directory authorities. Recommended versions are: 0.2.4.27,0.2.5.12,0.2.7.6,0.2.8.9,0.2.9.4-alpha,0.2.9.5-alpha
Nov 12 23:07:39.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Nov 12 23:08:05.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Nov 12 23:08:05.000 [notice] Guessed our IP address as xx.xx.xx.xx (source: 86.59.21.38).
Nov 12 23:08:07.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Nov 12 23:08:08.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Nov 12 23:08:08.000 [notice] Bootstrapped 100%: Done
Nov 12 23:08:08.000 [notice] Now checking whether ORPort xx.xx.xx.xx:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
Nov 12 23:08:50.000 [warn] Failure from drain_fd: No error
Nov 12 23:14:15.000 [notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 101 buildtimes.
Nov 12 23:28:05.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
Nov 12 23:28:46.000 [notice] No circuits are opened. Relaxed timeout for circuit 1162 (a Measuring circuit timeout 3-hop circuit in state doing handshakes with channel state open) to 60000ms. However, it appears the circuit has timed out anyway. 1 guards are live.

torrc:

DataDirectory D:\PROGRAMS\tor\Data\Tor
GeoIPFile D:\PROGRAMS\tor\Data\Tor\geoip
GeoIPv6File D:\PROGRAMS\tor\Data\Tor\geoip6
HiddenServiceStatistics 0

#-=- relay -=-#

ORPort 9001
Exitpolicy reject *:*
Nickname ididntedittheconfig
ContactInfo [email protected]
RelayBandwidthRate 500 KBytes
RelayBandwidthBurst 1 MBytes

#=-= other =-=#

MaxMemInQueues 512 MB
SOCKSPort 9050
ControlPort 9051
HashedControlPassword 16:xxxx

Log notice file D:\PROGRAMS\tor\Data\Tor\tor.log

Answer 1

Prolem was solved with the help of some commenters by using tor forward helper tool. It forwards ports appropriately on the internal windows router. For that I downloaded go language builder, installed it, and build tor-fw-helper tool from source. After that one need to add to torrc two directives:

PortForwarding 1
PortForwardingHelper [path-to]\tor-fw-helper.exe

Answer 2

Originally torrc configures you listening on localhost 127.0.0.1 so change listen address to global 0.0.0.0 or LAN IP 192.168.1.XXX in /etc/tor/torrc.

Relay config:

#ORPort 443 <-- Make sure to comment this line out!
ORPort 443 NoListen
ORPort 0.0.0.0:9999 NoAdvertise

[DirPort optional]

#DirPort 80 <-- Make sure to comment this line out!
DirPort 80 NoListen
DirPort 0.0.0.0:22222 NoAdvertise

Bridge config: Then for testing purposes, you would enter obfs4 port 443. Watch out! Test fails when run from the same device you are running Tor Bridge on.

#ORPort 80 <-- Make sure to comment this line out!
ORPort 80 NoListen
ORPort 0.0.0.0:22222 NoAdvertise

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:99999
ExtORPort auto

Tighten it: Local port 99999 reachable from LAN, listening for incoming connections from router. Router listening on 0.0.0.0:443 = ORPort reachable from WAN. Possible TCP backdoor closed.

#ORPort 443 <-- Make sure to comment this line out!
ORPort 443 NoListen
ORPort 192.168.100:9999 NoAdvertise # Notice LAN address

If you are running a httpd web server: Forward a random WAN port to local port 80. That done, let people know they have to access a web server on your network like this now: XXX.XXX.X.XXX:8000

DIY Portforwarding:

1. Find out which router you have and ho to log into it. Read the documentation for your specific router. For Asus. Asus specifically states that i need to give my computer a Manual(static) IP address to portforward.

2. Make your IP static from the computers side. "Preferred DNS server" will be your routers LAN IP, for asus 192.168.1.1 is the one.

For purpose of above examples: Say i portforwarded like this, External 443 -> Local 99999 and External 80 -> Local 22222, where External port = on your router (WAN port), and, Local port = on your computer.

Listening globally is already default on the router. So configure your torrc like under the heading Tighten it.(For asus, default listening would be changed by filling in the Source IP input field, e.g. 192.168.1.101/24 would make port listen only for connections from 192.168.1.2 - 192.168.1.255 (/24 for the first 3x8 bits must be identical).

Dont worry, this is safe. Like this port 80 and 443 wont actually be standing open on your computer and your router should have default setting 'WAN config' disabled. [Asus: Administration>System>Remote Access Config>Enable Web Access from WAN=NO].

Of course you could however forward external port 443 to local port 443, and 80 to 80. But TLS protocol is configured to send your computers standard certificates on port 80 and 443. Tor genereates special Tor certificates verified by Tor Directory Authorities for TLS handshake.

Make sure to build yourself a good portscanner to calm your paranoia in times of need with youtube instructions from DRAPS TV [Hint: optparse is depreceated since python3.2, use argparse]