0

In response to the blocking of Tor in even more countries and organisations, I decided to set up a (private) bridge. I would like the bridge to:

  • be accessible to users with strict outgoing connection filtering (in particular, blocking of access to non-standard ports)
  • be as difficult to discover as possible (consider scanning of known ports for Tor protocol)

What would be the configuration of the bridge to best address these goals?

Namely:

  1. What numbers to choose for OR and obfs4proxy ports?
  2. Does opening a DIR port on a bridge make sense, and if yes, on which port?
  3. Which ports to forward on the router?
  4. Does using IPv6 provide any benefit over just IPv4?

How to run an obfs4 bridge? provides some highlights but does not exactly answer the questions I have.

Improve this question

1 Answer 1

Reset to default
2

What numbers to choose for OR and obfs4proxy ports?

For an obfs4 bridge I'd recommend:

  1. Picking a low numbered port that's used by a common service for obfs4 (it takes a few extra steps to allow obfs4 to bind to low ports) might help some user (and may hinder others, e.g. if their DPI reasons: "I know that obfs4 traffic definitely isn't the service that normally runs on port 443".)
  2. Picking a randomly chosen high numbered port that isn't used by any common services for the ORPort to make it more difficult to detect by someone performing internet wide scans on common ports. (e.g. python2 -c 'import random;print random.randint(1025,65535)')

I'd strongly recommend that you implement 2, but 1 is more of an open question. By default obfs4proxy will pick a random high numbered port for itself.

Does opening a DIR port on a bridge make sense, and if yes, on which port?

No, the client will use you as a directory guard but this communication is done over the obfs4 or OR connection. This doesn't require exposing a DirPort and exposing one is just adding more potential for your bridge to be detected as a bridge from some adversary scanning for bridges.

Does using IPv6 provide any benefit over just IPv4?

It will allow users who are on IPv6-only connections to use your bridge. Anecdotally, since IPv6 isn't widely adopted some (of the crappier) DPI might have a tougher time censoring IPv6.

Improve this answer
4
  • Thanks. I am wondering about your example of obfs4 on port 443 hindering some users; obfs4 spec says: obfs4 offers protection against passive Deep Packet Inspection machines that expect the obfs4 protocol.
    – ilya
    Commented Jun 29, 2017 at 18:33
  • Yet another question: would it make sense to hide the ORport (by not forwarding it on the router) and setting AssumeReachable to 1?
    – ilya
    Commented Jun 29, 2017 at 19:39
  • 1
    obfs4 looks like random data, if it sees random data on port 443 it could tell that it is not HTTPS/TLS traffic (since no TLS handshake was observed) and block it. It might expect strange traffic on higher number ports (some unknown peer-to-peer protocol). I don't have solid answers for those.
    – cacahuatl
    Commented Jun 29, 2017 at 19:45
  • 1
    If you're distributing a private bridge (e.g. one that isn't given out by BridgeDB and is handed out by you manually) then it absolutely makes sense to block the ORPort. But I believe that BridgeDB will want to use the ORPort, it's expected that an ORPort is exposed, so it may result in BridgeDB considering your bridge down and not distributing it.
    – cacahuatl
    Commented Jun 29, 2017 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .