Problems setting up Tor bridges and relays with UK internet BT Home Hub 6

Question

I have been trying to set up a relay from a laptop running Ubuntu 16.04 connected to the internet through a BT Home Hub 6, and am having a problem reported as being with Port 9001 not being reachable.

What am I doing wrong, or what settings in my torrc file, or on the Home Hub 6 setup, do I have to add, delete or change?

Or am I trying to do the impossible, and should forget about setting up any or all of a bridge relay, a full relay or an exit relay?

The active commands in my torrc file are shown below.

SOCKSPort 0 # Default: Bind to localhost:9050 for local connections. 
Log notice file /home/XXXXXX/tor/notices.log
ORPort 9001 
BridgeRelay 1 
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy 
ExtORPort auto 
Nickname ieditconfig100times 
RelayBandwidthRate 2500 KBytes  # Throttle traffic to 100KB/s (800Kbps) 
RelayBandwidthBurst 5000 KBytes # But allow bursts up to 200KB (1600Kb) 
AccountingMax 100 GBytes
AccountingStart day 03:00 
ContactInfo Xxxxxx Yyyyy <zzzzzzz[email protected]> 
ExitPolicy reject *:*, # no exits allowed

The message in the notices.log file ends with

Sep 28 17:20:28.000 [warn] Your server (XX.YYY.ZZZ.AAA:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

Answer 1

You will likely need to set up Port Forwarding on the HomeHub itself, what is happening is that Tor is trying to connect into your Ubuntu computer, but the traffic is pointed at the HomeHub's IP.

The HomeHub is getting the traffic but it doesn't know what to do with it, you need to configure the HomeHub so that it knows that if it recieves traffic from the internet on port 9001, it should forward it to your Ubuntu systems LAN IP address (e.g. 192.168.1.2) on port 9001.

BT have some guides for this on their customer support section.

Since you're looking to be an obfs4 bridge, you should also know that obfs4proxy runs on another port entirely, it should report what port it is listening on in the Tor logs. You'll want to setup the same forwarding you did for 9001 but for the port that obfs4 is using.

Another step you'll likely want to take in Ubuntu is to open up the port in the local ufw packet filter ("firewall"), by issuing the command: sudo ufw allow 9001/tcp and again you need to do this for the obfs4 port, just changing 9001 for whatever port obfs4 is using.

Answer 2

So, here is your resolution checklist:

• First of all, you also need a line ExitPolicy reject6 *:* to block IPv6 exit traffic as well.
• Second - if this is your device, then make sure that bridge is plugged via wired ethernet, not wifi - there're a lot of glitches with wifi, you'll learn a lot of new bad language even digging them out :) So - plug the jack and set a static IP for your laptop in /etc/network/interfaces and add it to your torrc ORPort XX.YY.ZZ.VV:9001 instead of just ORPort 9001 - it will save you from some trouble.
• Third - you have a port reachability issue. It can be caused by a various reasons.

How to check the problem source? Here is another checklist:

• Go to your router's setup and make sure that the port 9001(it's in your ORPort directive) is forwarded to your static lan IP for a node.
• Also make sure no SPI/DPI/firewall is enabled on your router. Sounds a bit weird, nut here is the brief: the home routers are not hardware-advanced ones, so it slows them down like hell and make them really hot on a moderate+ packet count just by overloading the CPU. router is a NAT device, so - if you haven't explicitly forwarded the port to a LAN member - it is not reachable from the outer world and no security will suffer if you turn off the unneeded filtration. These toy firewalls, and especially SPI and DPI on a home-toothpicks are problem-causers, not helpers.
• On your router - completely disable UPnP - it can cause much more problems than it solves. Also it's a frequent helper for an attacker exploiting your LAN devices. So - turn it off. In our case it can make a conflict if the port 9001 is UPnP-forwarded, especially to somewhere else. Yes, it does not happens frequently and by the logic it should not happen at all - but trust me, if you'll take a look at upnp-forwarded port list, sometimes you'll find even a manually forwarded ports routed to somewhere else. It's a firmware glitch, but knowing that does not makes your network setup working as designed. So shut it off.
• On your Ubuntu node check for error logs in a syslog and all others, look for AppArmor and/or SELinux messages - and even if there're none, try turning them off until you'll make it work. You'll be able to fix the rules for Tor process later, if after reenabling them it will brek: you'll know what exactly to tweak and it will be the one-time action.
• On your Ubuntu - check the firewall, just iptables --list... Also check the program fail2ban - it can give a false positive and block the addresses of the tore external ip-checking parties.

If it will not work or you'll need a further help - just drop me a line and we will fix this!