6

I would like to run a Tor relay through my VPN (Linux using OpenVPN).

My anonymous VPN service connects through an OpenVPN tun0 interface. I run both "Tor ->- over ->- VPN" and "TBB ->- over ->- VPN" with no problems.

Using the netstat -nr command to check (I blocked out my VPN's public IP address and internal IP addresses):

$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.---.---.---  0.0.0.0         UG        0 0          0 tun0
10.-.-.-        10.---.---.---  255.255.255.255 UGH       0 0          0 tun0
10.---.---.---  0.0.0.0         255.255.255.255 UH        0 0          0 tun0
111.222.333.444 192.168.1.1     255.255.255.255 UGH       0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

I have my /etc/tor/torrc configured to run a middle-man relay on port 9001.

Right after, I start Tor using this command:

systemctl start tor.service

And then using these two netstat commands to check right after starting tor:

netstat -tuapenv | grep -i established
netstat --all --numeric --programs --inet --inet6

I am able to see about 80 different ESTABLISHED connections to "foreign addresses" that are linked to my VPN's internal IP address in the "Local Address" column.

The 80 different "Foreign Address" are only shown for the first few minutes, then after a couple of minutes all I have left are my original three EntryGuard IP addresses shown when using those netstat commands.

So if my VPN's public address is 111.222.333.444 and its internal IP address is 10.---.---.--- which connects to my local 127.0.0.1 then how would I run a relay that stays connected and shows its IP address on the Tor Network Status page at blutmagie?

Improve this question
7
  • Isn't this behavior normal for new relays? I suggest running the relay for a day or so and then seeing if it's in the directory.
    – Vreality
    Mar 2, 2014 at 21:12
  • 2
    What sort of VPN is this? Is it your private VPN to a remote server that you're leasing? Or is it a third-party VPN service? If it's the latter, you may have no ports forwarded to the VPN exit. And so other Tor relays can't find you.
    – mirimir
    Mar 27, 2014 at 3:55
  • To Vreality: I am new to running a relay and I think this might be normal behavior since I tested my relay config with just my regular isp connection and it seemed to do the same thing (80 connections that turned into about 3 entry guard connections after a few minutes.) May I ask how I would see if the relay is in the directory? Thanks.
    – human
    Apr 17, 2014 at 21:39
  • To mirimir: I am using a logless 3rd party vpn service that says it's ok to run tor relays (some people might even run exit relays but not me)... but I've been having trouble finding out about forwarded ports and iptables configurations. I was finally able to get ports forwarded through my iptables rules but saw no difference in the way that it was working.
    – human
    Apr 17, 2014 at 21:39
  • also To mirimir: "you may have no ports forwarded to the VPN exit. And so other Tor relays can't find you." - I felt like this might have been the issue, but when I finally found out the correct rule to open up my iptables and use the vpn's "port forward service" (which I was able to ping through), I found that the same 80 connections would eventually become about 3 to 6 entry guard connections that would stay connected over a few hours. Maybe this is all there ever are... I had always thought it would be a steady stream of about 80 constantly changing addresses connecting through a relay
    – human
    Apr 17, 2014 at 21:49

3 Answers 3

Reset to default
3

A relay requires a public IP address as it needs to accept incoming connections. As far as I can see from your routing table, your tunnel provider does not give you a public IP address. Your Tor log messages should currently contain something like:

Your server has not managed to confirm that its ORPort is reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

Please note that the idea of running a Tor relay behind a tunnel is not a very good idea. The relayed packets are going to take a round-trip through the tunnel, adding latency and minimizing bandwidth. Please consider running a bridge on the public IP address given by your ISP instead.

Improve this answer
1

I would add that if you really want to do this you need to forward ports from the outside so that other peoples tor clients can connect to your relay, since you are not being given a public ip your traffic over the vpn is being NAT'd. Usually VPN service do not want you to do this and yes, its generally not a good idea for the reasons above as well.

Improve this answer
0

It's very simple: In most of tor's port-related directives - an IP-address can be specified. For example try use ORPort 111.222.333.444:<port> instead of just ORPort <port>. Actually if you'll post your torrc config it will be a way better and easier to advise you, but the basic concept is in answer.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.