0

I run a obfs4 bridge on my Raspberry Pi3 and every few hours I get this warning from Tor (I can read it from my notice.log file):

Sep 15 19:51:29.000 [warn] Your Guard TokenBlack ($91516595837183D9ECD1318D00723A8676F4731C) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 83/180. Use counts are 22/22. 137 circuits completed, 0 were unusable, 54 collapsed, and 12 timed out. For reference, your timeout cutoff is 60 seconds.

This is my relay related torrc section:

################ This section is just for relays #####################
#
## See https://www.torproject.org/docs/tor-doc-relay for details.

## Required: what port to advertise for incoming Tor connections.
ORPort 9001
## If you want to listen on a port other than the one advertised in
## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as
## follows.  You'll need to do ipchains or other port forwarding
## yourself to make this work.
#ORPort 443 NoListen
#ORPort 127.0.0.1:9090 NoAdvertise

## The IP address or full DNS name for incoming connections to your
## relay. Leave commented out and Tor will guess.
#Address example.com

## If you have multiple network interfaces, you can specify one for
## outgoing traffic to use.
# OutboundBindAddress 10.0.0.5

## A handle for your relay, so people don't have to refer to it by key.
Nickname name

## Define these to limit how much relayed traffic you will allow. Your
## own traffic is still unthrottled. Note that RelayBandwidthRate must
## be at least 20 KB.
## Note that units for these config options are bytes per second, not bits
## per second, and that prefixes are binary prefixes, i.e. 2^10, 2^20, etc.
RelayBandwidthRate 40 KB  # Throttle traffic to 100KB/s (800Kbps)
RelayBandwidthBurst 50 KB # But allow bursts up to 200KB/s (1600Kbps)

## Use these to restrict the maximum traffic per day, week, or month.
## Note that this threshold applies separately to sent and received bytes,
## not to their sum: setting "4 GB" may allow up to 8 GB total before
## hibernating.
##
## Set a maximum of 4 gigabytes each way per period.
#AccountingMax 4 GB
## Each period starts daily at midnight (AccountingMax is per day)
#AccountingStart day 00:00
## Each period starts on the 3rd of the month at 15:00 (AccountingMax
## is per month)
#AccountingStart month 3 15:00

## Administrative contact information for this relay or bridge. This line
## can be used to contact you if your relay or bridge is misconfigured or
## something else goes wrong. Note that we archive and publish all
## descriptors containing these lines and that Google indexes them, so
## spammers might also collect them. You may want to obscure the fact that
## it's an email address and/or generate a new address for this purpose.
#ContactInfo Random Person <nobody AT example dot com>
## You might also include your PGP or GPG fingerprint if you have one:
#ContactInfo 0xFFFFFFFF Random Person <nobody AT example dot com>

## Uncomment this to mirror directory information for others. Please do
## if you have enough bandwidth.
#DirPort 9030 # what port to advertise for directory connections
## If you want to listen on a port other than the one advertised in
## DirPort (e.g. to advertise 80 but bind to 9091), you can do it as
## follows.  below too. You'll need to do ipchains or other port
## forwarding yourself to make this work.
#DirPort 80 NoListen
#DirPort 127.0.0.1:9091 NoAdvertise
## Uncomment to return an arbitrary blob of html on your DirPort. Now you
## can explain what Tor is if anybody wonders why your IP address is
## contacting them. See contrib/tor-exit-notice.html in Tor's source
## distribution for a sample.
#DirPortFrontPage /etc/tor/tor-exit-notice.html

## Uncomment this if you run more than one Tor relay, and add the identity
## key fingerprint of each Tor relay you control, even if they're on
## different networks. You declare it here so Tor clients can avoid
## using more than one of your relays in a single circuit. See
## https://www.torproject.org/docs/faq#MultipleRelays
## However, you should never include a bridge's fingerprint here, as it would
## break its concealability and potentionally reveal its IP/TCP address.
#MyFamily $keyid,$keyid,...

## A comma-separated list of exit policies. They're considered first
## to last, and the first match wins. If you want to _replace_
## the default exit policy, end this with either a reject *:* or an
## accept *:*. Otherwise, you're _augmenting_ (prepending to) the
## default exit policy. Leave commented to just use the default, which is
## described in the man page or at
## https://www.torproject.org/documentation.html
##
## Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses
## for issues you might encounter if you use the default exit policy.
##
## If certain IPs and ports are blocked externally, e.g. by your firewall,
## you should update your exit policy to reflect this -- otherwise Tor
## users will be told that those destinations are down.
##
## For security, by default Tor rejects connections to private (local)
## networks, including to your public IP address. See the man page entry
## for ExitPolicyRejectPrivate if you want to allow "exit enclaving".
##
#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports but no more
#ExitPolicy accept *:119 # accept nntp as well as default exit policy
ExitPolicy reject *:* # no exits allowed

## Bridge relays (or "bridges") are Tor relays that aren't listed in the
## main directory. Since there is no complete public list of them, even an
## ISP that filters connections to all the known Tor relays probably
## won't be able to block all the bridges. Also, websites won't treat you
## differently because they won't know you're running Tor. If you can
## be a real relay, please do; but if not, be a bridge!
BridgeRelay 1
## By default, Tor will advertise your bridge to users through various
## mechanisms like https://bridges.torproject.org/. If you want to run
## a private bridge, for example because you'll give out your bridge
## address manually to your friends, uncomment this line:
#PublishServerDescriptor 0

# Riduce scrittura per SSD
AvoidDiskWrites 1

# Per permettere ad arm di mostrare le connessioni
DisableDebuggerAttachment 0 

# Configurazione Pluggable Transport
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ExtORPort auto

I'm behind NAT and so I forwarded for port 9001 and for obfs4 port (found it in notice.log file).

EDIT: My router model: DG834Gv5 – 54 Mbps Wireless ADSL Firewall Modem

Any suggestions?

Thank you very much!

  • First of all, that's an incredibly slow bridge (40KB/s), Tor manual states: "we recommend at least 250 KBytes (2 mbits) if possible.". I'd expect it to be slow and be unable to handle high loads/throughput. It's also possible that the NAT device is causing it issues. – cacahuatl Sep 15 '17 at 19:45
  • I read in the same sentence you cited "If you want to run a relay in the public network, this needs to be at the very least 75 KBytes for a relay (that is, 600 kbits) or 50 KBytes for a bridge [...]". My bandwidth is limiteted to ~ 120 KBytes for upload, so i can't dedicate more. Anyway my actual medium upload bandwidth usage (from arm) is ~50 Kbits and even less for download, so I think that's not the problem. Can you be more precise about NAT? Thanks! – savo Sep 15 '17 at 20:07
  • NAT requires tracking connections, if you have a large number of circuits open it can often cause problems on NAT devices like consumer grade routers and will result in dropped connections. They simply don't have the processing power or memory to track all the connections. – cacahuatl Sep 15 '17 at 21:04
  • Thank you very much! I didn't think about this kind of problem. In fact my modem sucks... Anyway the problem is i have a ridiculous medium number of open connection (~5). I can't explain :( – savo Sep 15 '17 at 21:42
  • yeah, 5~ connections shouldn't cause that kind of problem (relays will have thousands of connections kept open which definitely causes problems on lower powered devices). It could be that it's nothing to do with your bridge, it could be that your guard is actually having issues or is overloaded. – cacahuatl Sep 16 '17 at 0:24
0

So - your problem looks like a stock firmware issue, I have had it myself quite often even on a powerful/hardware-beefy routers. Your router looks like to be supported by OpenWRT - check the official hardware table for details. So - if your revision is listed there - try OpenWRT and feel the difference. If it's not enough or not supported - I do recommend you to pick a router supported by LeDe project or OpenWRT(linked upstrings) and grab a more powerful router.

The root of the problem resides in two parts:

  • First of all, it's a very limited hardware resources on your router - it looks like 4Mb flash and 16Mb RAM. I know, maybe it sounds ridiculous, but your router vendor is the one to blame: MIPS CPUs on even the cheapest routers are capable of at least 64MB of RAM and ROM, usually more - for both of them. But these fatcats just want you to spend your money on new models.
  • On even the good ones you often can see up to 1.5x-3x connection number on OpenWRT/LeDe - why? Because of the firmware config that can not be changer. Very basically speaking, it's Linux kernel sysctl's and kernel timer(HZ settings) that are just set not to be right and not allowing you to fully utilize the hardware - even a decent one. Sadistical part of this is that as to my knowledge - NO official firmware exists that allows you to change these settings

So - a cost-effective variant will be to buy the router at your local shop with 128(or better 256) megs of RAM and at least 32MB of ROM, and it should have a USB port - so you'll be able to utilize it as a storage for your router OS/firmware of a decent size.

Feel free to ask further questions if you have any - I'm glad to help! Usually it takes about 100 USD to grab a very good router that can be used with OpenWRT or LeDe(usually both - and prefer LeDe there, because it has a newer Linux kernel inside).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.