Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
My tor exit node was 31.172.30.4:443 and at the same time I observed direct connection established to this IP
TCP 192.168.1.xx:xxxxx->31.172.30.4:443 (ESTABLISHED)
Maybe my knowledge on tor is not as good as thought, but I'm quite sure it shouldn't happen. Security issue?
My setup: tor daemon running on Debian; all non-tor connections dropped.
When you say "My tor exit node was 31.172.30.4:443", I presume you do not mean that you are the operator of the nicknamed chaoscomputerclub21 Tor node.
I think you mean that the Tor node in use as an exit node, for one or more of your Tor client's open circuits, was at that IP address.
Your Tor client will create multiple circuits at one time, and over time. Any node with Guard and Exit flags (chaoscomputerclub21 has both at the present time) could randomly be used as an entry guard, a middle node, and an exit. It being an exit in one circuit doesn't mean it can't be an entry guard in another, or a middle node in still another.
You should be able to use the tool (arm?) that showed you the chaoscomputerclub21 exit node selected for that one circuit to also see the entry and middle nodes. You can look at multiple circuits in that and probably see more than one instance of any given high capacity node showing up in various roles.
31.172.30.4is the public IP address of the exit node. --- Do you know what is the machine with the private IP address192.168.1.xx? What is running on the port443on your exit node? To see which process created the TCP connection run this command on the source machine (192.168.1.xx):sudo netstat -apnet | grep -F 31.172.30.4. Run it asrootif you do not have (configured)sudo.31.172.30.4configured directly on the exit node machine or is it configured as a static NAT? Where is the private address machine (192.168.1.xx) in the network topology related to the exit node machine and the possible NAT device? --- Are there any DNS records for the exit node IP address31.172.30.4?