I would like to deny my Hidden Services (HS) to speak with any servers from one country but I would like to allow other hop of my circuit to be from that country

For example my HS is hosted in country X, I would to deny my HS to communicate directly to any servers in this country X but the HS is allowed to have country X for the second or last hop of his circuit

Is this possible ?


In full - impossible, because HSDir, for example, is a passive replica, i.e. you are not controlling how it's formed. Partially - with nodes in chains - you can utilize ExcludeNodes and ExcludeExitNodes with StrictNodes 1 in 2-instance setup - but it will barely help you... And it's not a flaw of Tor: such selection ability would be a great deanonymization possibility and quite good for fingerprinting your HS

  • won't help either: iptables are unable to "dig into" the Tor circuit pipes, i.e. it will disable only the 1st hops of any kind in the particular IP ranges
    – Alexey Vesnin
    Oct 3 '17 at 0:24
  • well, then try using iptables + 2-instance setup. One instance is a hidden bridge with exludenodes - and it's the gateway for the second tor instance carrying HS itself. but HSDir's will have your HS descriptor even in this country regardless of your will
    – Alexey Vesnin
    Oct 3 '17 at 0:27
  • no, just 2 Exclude's I've mentioned and set StrictNodes 1, that's on the bridge-instance. HS instance uses just this bridge and has no excludes in it
    – Alexey Vesnin
    Oct 3 '17 at 0:40
  • not the middle ones - they can not be selected or filtered out.
    – Alexey Vesnin
    Oct 3 '17 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.