4

As you know following the recent social unrest, Iranians are literally cut off from the outside world. Earlier and upon situations like this we used to get used to using tor and pretty much in extreme scenarios ssh tunneling. Now both are also cut off by the regime DPI. Issues worsened as we can not get to the banned sites like torproject.org and google searches are filtered. It is a complete blackout unless we setup obfs4proxy to a tor network outside. I have not used it yet and due to the limited access to the Internet need your help. Here is the scenario: Server side: Centos7+obfs4proxy this is a VPS in OVH Client side: Archlinux+obfs4proxy this is inside Iran. Now have installed obfs4proxy using go and it is working fine at centosbox,and have set up the tor needed configs as online limited instructions I could get my hands on like below:

ControlSocket /run/tor/control
ControlSocketsGroupWritable 1
CookieAuthentication 1
CookieAuthFile /run/tor/control.authcookie
CookieAuthFileGroupReadable 1
Log notice file /var/log/tor/notices.log
SocksPort 0
ORPort auto
Nickname Something
ContactInfo Mymail
ExitPolicy reject *:* 
ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy managed

Once the tor starts it randomly assigns a port for ORPort,it is fine and I have to open up the port in firewalld -some online documents stated that after the first time tor remembers and locks to it for further consistency which is not true...better if it binds to one specific port so that the firwalld rule stayed valid.

Now what are the further commands and configs? My client side has something like:

UseBridges 1
Bridge obfs4 Centos7IP:TheRandomPort
ClientTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy --managed
Improve this question
4
  • You need the full Bridge line from the server, it's missing the cert= and iat-mode= values, you can find them in the file at /var/lib/tor/pt_state/obfs4_bridgeline.txt.
    – cacahuatl
    Jan 5, 2018 at 4:33
  • Also both the ClientTransportPlugin and ServerTransportPlugin lines shouldn't have managed or --managed at the end, they should just read ClientTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy and ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy.
    – cacahuatl
    Jan 5, 2018 at 4:36
  • @cacahuatl,The file not found,here is the dir structure: ls /var/lib/tor/ cached-certs cached-descriptors.new cached-microdescs.new lock cached-consensus cached-microdesc-consensus fingerprint state cached-descriptors cached-microdescs keys stats I presume the best bet yet is the keys dir with the below certs: ed25519_master_id_public_key secret_id_key ed25519_master_id_secret_key secret_onion_key ed25519_signing_cert secret_onion_key_ntor ed25519_signing_secret_key `can you please suggest which?
    – h.safe
    Jan 6, 2018 at 6:23
  • None of them, if that folder doesn't exist then obfs4proxy hasn't started on the server or that isn't your DataDirectory.
    – cacahuatl
    Jan 6, 2018 at 18:29

1 Answer 1

Reset to default
0

After a lot of different configuration, I can start both the services at two ends with no issue except the @cacahuatl's keys ...Both sides are in started mode and on the client side the error I get is:

Jan 30 12:07:37.000 [warn] Proxy Client: unable to connect to 178.32.93.229:4235 ("general SOCKS server failure")

Mostly the partial success needs to go to the yawning angels insights and ofcourse cacahuatl....but still can not figure out how to create the keys... any help will be super appreciated...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .